Bad Behavior 2.2.24 has been released. This is a maintenance release for WordPress users. users of other platforms do not need to update at this time.

Changes

The following changes have been made since 2.2.23:

• WordPress: Some deprecated code has been rewritten. Thanks to Doug Joseph for reporting the issue.

Download

Download Bad Behavior now.

Notes

Just as a reminder, if you use CloudFlare, Incapsula, Amazon Elastic Load Balancer, Azure Load Balancer, Google Cloud Load Balancing, or similar services on your site, you may need to enable the Reverse Proxy option in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.

Bad Behavior 2.2.23 has been released. This is a maintenance release and is suitable for all users.

Changes

The following changes have been made since 2.2.22:

• All live links to web sites have been converted to HTTPS links, where available.

Download

Download Bad Behavior now.

Notes

Just as a reminder, if you use CloudFlare, Incapsula, Amazon Elastic Load Balancer, Azure Load Balancer, Google Cloud Load Balancing, or similar services on your site, you must enable the Reverse Proxy option in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.

Bad Behavior 2.2.22 has been released. This is a maintenance release and is recommended for all users.

Changes

The following changes have been made since 2.2.21:

• A leftover bit of the screening code which was removed in Bad Behavior 2.2.21 caused a spurious PHP notice. This bit has also been removed.

Download

Download Bad Behavior now.

Notes

Just as a reminder, if you use CloudFlare, Incapsula, Amazon Elastic Load Balancer, Azure Load Balancer, Google Cloud Load Balancing, or similar services on your site, you must enable the Reverse Proxy option in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.

Bad Behavior 2.2.20 has been released. This is a maintenance release and is recommended for all users.

Changes

The following changes have been made since 2.2.19:

• A spurious PHP notice was removed. Fixes issue 121.
• The current use of cookies to screen requests is being deprecated. Any cookies will be removed from users’ browsers, if they exist. Fixes issue 131.

Download

Download Bad Behavior now.

Notes

Just as a reminder, if you use CloudFlare on your site, you must enable the Reverse Proxy option in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.

Bad Behavior 2.2.19 has been released. This is a security release affecting WordPress users, who should update as soon as possible.

Changes

The following changes have been made since 2.2.18:

• WordPress: In certain circumstances, a cross-site scripting attack was possible via the Bad Behavior Whitelist options page. This issue has been fixed.
• WordPress: Protection from cross-site request forgery (WordPress nonces) has been added to the Bad Behavior Whitelist and Bad Behavior Options pages. This covers cases where Bad Behavior’s built-in CSRF protection is disabled or ineffective.

These issues were reported by Plugin Vulnerabilities.

Download

Download Bad Behavior now.

Notes

Just as a reminder, if you use CloudFlare on your site, you must enable the Reverse Proxy option in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.

Bad Behavior 2.2.18 has been released. This is a maintenance release and is recommended for all users.

Changes

The following changes have been made since 2.2.17:

• A new IP address range is in use by the Bing search engine; this range has been added to Bad Behavior.

Download

Download Bad Behavior now.

Notes

Just as a reminder, if you use CloudFlare on your site, you must enable the Reverse Proxy option in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.

Bad Behavior 2.2.17 has been released. This is a maintenance release and is recommended for all users.

Changes

The following changes have been made since 2.2.16:

• Bad Behavior is now compatible with PHP 7.
• WordPress: Bad Behavior is now compatible with WordPress 4.4.
• Bad Behavior can now be used on sites which run on a non-standard HTTP port (the standard ports are 80 for HTTP and 443 for HTTPS).

Download

Download Bad Behavior now.

Notes

Just as a reminder, if you use CloudFlare on your site, you must enable the Reverse Proxy option in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.

Bad Behavior 2.2.16 has been released. This is a maintenance release and is recommended for all users.

Changes

The following changes have been made since 2.2.15:

• The via HTTP header, when present in all lowercase letters, violates a convention that headers should be in mixed case, and the lowercase-only header is commonly seen from malicious proxy servers. However, the actual HTTP specifications do not disallow it, and a check for this lowercase header does block some legitimate traffic. Therefore this version of Bad Behavior has been changed to check for lowercase via only in strict mode. This resolves an issue where web users at certain large companies are blocked; sites expecting these visitors should not enable strict mode.

Download

Download Bad Behavior now.

Notes

Just as a reminder, if you use CloudFlare on your site, you must enable the Reverse Proxy option in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.

Bad Behavior 2.2.15 has been released. This is a maintenance release and is recommended for all users.

Changes

The following changes have been made since 2.2.14:

• An additional exploit scanner has been identified and blocked.
• Issue #66: WordPress: A deprecated function has been removed and replaced.
• Issue #72: Recent versions of the Google Chrome and Firefox browsers do not actually delete session cookies by default when closing the browser. This resulted in a rare case where old session cookies, served when the site’s EU Cookie setting was off, would be returned if the EU Cookie setting was later enabled. When this happened, the visitor would be blocked. This issue is now resolved.

Download

Download Bad Behavior now.

Notes

Just as a reminder, if you use CloudFlare on your site, you must enable the Reverse Proxy option in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.