First published build of Traffic Guard. This release contains the complete feature set of the module:
- Early request interception on every public request, before any controller
or database query runs. Abusive requests receive a plain-text HTTP 429
(with
Retry-After: 60) or HTTP 403 response. - Risk scoring from 0 to 100 built from additive signals: empty user agent,
known bad-bot user-agent patterns, admin-defined user-agent block rules,
rate-limit proximity (soft at 80 percent, hard above 100 percent), deep
pagination (
pagegreater than 50) and very long search query strings. Throttle and block thresholds are configurable per protection mode. - Per-IP rate limiting with 60-second fixed windows for four endpoint categories (all public, search, API, item/media pages). Admin paths are never rate limited.
- Three protection modes (Normal, Elevated, Under Attack) that each carry their own set of rate limits, thresholds and signal weights.
- Automatic temporary bans when a request reaches the block threshold, with a configurable duration, plus manual bans (timed or permanent) and ban lifting from the IP detail page.
- User-agent allow and block rules using case-insensitive substring or regular-expression matching, evaluated in priority order.
- IP allowlist for single addresses and IPv4/IPv6 CIDR ranges, with optional automatic exemption of private and loopback ranges.
- Optional
X-Forwarded-Forsupport for installations behind a trusted reverse proxy. - Event log of throttle and block decisions (allowed requests optional), with a configurable retention period and a background purge job.
- Admin dashboard with 24-hour summary counts, top blocked IPs, active bans and a filterable, paginated event log; per-IP detail page; rules page; settings page; and a short configuration form on the Modules page.
- Fail-open design: any error inside the guard is logged and the request is allowed through, so the module never takes a site offline.