This happen randomly, the symbol will be messed and can be recovered by refresh the page. Reason: Chrome occasionally mis-decodes a minified CSS file that has no @charset as Windows‑1252, despite correct HTTP headers. Possible fix by AI: File: src/meta/minifier.js — function actions.buildCSS, inner helper processScss() function ensureCharset(css) { return '@charset "utf-8";\n' + css.replace(/^\uFEFF/, ''); } // line 244: return { css: ensureCharset(result.css) }; // line 250: return { css: ensureCharset(minified.css) }; [image: image.jpeg] [image: image.jpeg] [image: image.jpeg]

OpenAI “rogue” agent activities found on Wikimedia projects Any online services (NodeBB included) with open registration is at risk of being taken over by so called "rogue agents". So the question is: Should post/registration queue be enabled by default?

Hi all: Walt here -NodeBB n00b from a farm in the Algarve (Portugal). I'm evaluating NodeBB for a bioregional community of land stewards. What drew me was @julian 's Forums over Feeds talk, and ActivityPub being in core: a forum that can follow members' own blogs and file their posts into categories is very close to what we've been trying to build. Just joined here, to learn the software from the member's side, and one thing stands out: there's lots of help for people who run a NodeBB forum, but i couldn't find any for people who just use one. The docs cover installing, configuring, ActivityPub, admin and development, and the default welcome post points to the admin panel. For a technical crowd like this one that's fine. But most of my community have never used a forum, and would need someone to show them how to find a conversation, reply, start a topic, or notice that someone has answered them. It's honestly the one point where our comparison leans towards Discourse, which ships a little tutorial bot that walks each new member through those basics. So, three questions: Have i missed something? Is there a member-facing guide, or a plugin or theme setting that gives new members a first-run tour? Is it on the roadmap at all? Even a default "start here" topic aimed at members rather than admins, in new installs, would help. An offer: we'll be writing a short "start here" for our stewards anyway (Portuguese and English). If it'd be useful as a starting template for others, i'd be glad to contribute it back. Thanks, and thanks for NodeBB. Can't wait to see our peeps' blogs turn up as threads /walt

Hi @baris , I think this plugin is maintained by official team? May I know if possible to add support to use Cloudflare Turnstile as an option? Thanks

Hello, I’ve made some changes to the avatar/profile area that I use on my own website. I hope you like them. If anyone would like to use the same design on their own website, feel free to contact me. [image: image.jpeg]

Hi, I had an idea, and I’d love to hear from @julian if something like this is feasible. Sometimes there is a need to publish an official announcement that doesn't necessarily belong to a single user, but rather to a group or several parties together. For example, a message from the management team, the moderators, a specific squad, or even a post that two admins want to publish jointly. I was thinking it might be possible to allow a scenario where a post has two authors, with both appearing as the publishers of that same post. For example: Admin A and Admin B publish a post together, and both appear at the top of the post as the authors. Clicking on either of them could lead to their respective profiles, making it clear that it is a joint publication. It’s similar to YouTube collaborations, where two creators can release a video together that appears on both their channels, linking to both. We could even take it a step further and allow for more than two authors, enabling posts to be published on behalf of a team or a group of users. I think this could be particularly useful for official announcements, team updates, collaborations between admins, and the like; it would also resolve the issue of having to choose "who actually posted it" when the content was written on behalf of several people. I’d love to hear if something like this is technically feasible, and whether you think it’s worth including. Thanks!

Hello NodeBB Community I started a purge for our forum with the goal of deleting spam accounts. Started with ~40000 user accounts and realized very fast that deleting them manually will be a Sisyphus task. Vibe coded a usercleaner plugin with filters and stuff like that. [image: image.jpeg] So with that filter, 70.20% of all accounts are spam. After that was cleaned out I looked deeper into more recent accounts and was a little shocked. I identified a set of mail hosts used for verification over and over again. From the manage user view with 500 accounts did a little RegEx search with a browser plugin and got 381 of 500 users are from these mail hosts. So 76.2%. After I complete my purge, from 39133 accounts 2754 are left. 93% of accounts where spam or the other way around only 7% "good" accounts. note: will create some feature requests since I noticed some stuff in the manage user view I found this plugin https://github.com/NodeBB-Community/nodebb-plugin-email-blacklist but also thought, that can't be it. These bots will just use other mail addresses. So, how do you guys handle this? Just ignore it? Looking forward for some input from the community. Thanks for reading and thinking about a clean forum with me

Hi, I'm exploring the possibility of converting our 100,000+ post forum from phpBB 3.3.15 to nodeBB. I previously converted the forum from another system (WebWiz IIRC) about 9 years ago and that was a big job so I was interested to see that NodeBB has a plugin that might handle a lot of the conversion for me. However, I note from the GitHub Repository Readme for this plugin that it only supports NodeBB version 1.12.1 which is now quite a long way behind. Also, AFAICT the phpBB Exporter may not be up with the latest phpBB version. What would be involved in upgrading nodebb-plugin-import to support nodeBB 4.x?

I'm away from my desk for the next few days and so I'll likely be posting more open ended discussion questions. Recently I've been thinking more about the decline of forums of yesteryear and how hosting a forum has always been rather niche. That got me thinking about how one of Reddit's "killer features" was that just anybody could create a subreddit. The same could be said about Facebook groups as well. You don't get that with forums, only the admin can create categories/forums, and by extension that usually limited the rise of general interest boards, and more towards niche topic-focused boards. It also meant that basically every board had a "general discussion" board or "random" board. Would there be interest in NodeBB supporting something like this... Basically, the ability for anyone to set up a category and instantly moderate it, and build your own sub community inside a community? Does this ruin the magic of forums?

Hello, This guide covers a modern setup (2026+) running NodeBB in cluster mode with Redis behind nginx and Cloudflare's free plan in proxied mode. The documentation here is over 10 years old and don't account for cluster mode, Redis pub/sub, or how Cloudflare's proxied mode interacts with socket.io session stickiness. This guide fills that gap. Also, the official NodeBB nginx documentation will cause silent socket.io failures without the fixes described here. -- See here : https://community.nodebb.org/topic/19225/websocket-socket.io-403-xhr-poll-error-behind-cloudflare-cluster-scaling-redis/5 Prerequisites: NodeBB multi-process cluster with Redis pub/sub running, nginx configured as reverse proxy. -- See official documentation here : https://docs.nodebb.org/configuring/scaling/ Cloudflare in proxied mode (orange cloud) pointing to your server IP. A valid SSL certificate installed on your server (covered in step 1 below) Why the official NodeBB nginx doc breaks with Cloudflare The official docs recommend ip_hash for session stickiness. This silently breaks behind Cloudflare because Cloudflare uses multiple outgoing IPs for the same end user. The socket.io polling request and the WebSocket upgrade can arrive from two different CF IPs, routing them to different cluster nodes. The second node has no session → 400 Bad Request. Step 1 : SSL: Let's Encrypt certificate + Cloudflare Full (Strict) mode Why Full (Strict) and not just Full or Flexible? Cloudflare offers four SSL modes: Mode Visitor → CF CF → your server Risk Off HTTP HTTP Everything in plaintext Flexible HTTPS HTTP CF to server is unencrypted — never use this Full HTTPS HTTPS Accepts any cert, including self-signed — not validated Full (Strict) HTTPS HTTPS Requires a valid, trusted cert — recommended Full (Strict) is the only mode that validates the certificate on your server. Without it, Cloudflare will happily connect to your server over HTTPS with an expired or self-signed cert, which provides no real security for the CF → origin leg. Install Certbot and obtain a certificate # Install Certbot with the nginx plugin sudo apt install certbot python3-certbot-nginx -y # Obtain a certificate for your domain # (nginx must already be running and port 80 reachable from the internet) sudo certbot --nginx -d your-domain.com -d www.your-domain.com Certbot will automatically edit your nginx vhost to add the SSL configuration and set up an HTTP → HTTPS redirect. If Cloudflare is already in proxied mode (orange cloud), Certbot's HTTP-01 challenge still works because Cloudflare forwards HTTP traffic to your server. No need to temporarily disable the proxy. Verify auto-renewal # Test the renewal process (dry run — no cert is actually renewed) sudo certbot renew --dry-run Certbot installs a systemd timer automatically. Certificates are renewed 30 days before expiry. Configure Cloudflare SSL mode In your Cloudflare dashboard, go to SSL/TLS → Overview and select Full (Strict). Also enable these recommended options under SSL/TLS → Edge Certificates: Always Use HTTPS → On Minimum TLS Version → TLS 1.2 Opportunistic Encryption → On TLS 1.3 → On Automatic HTTPS rewrites → On Update your nginx vhost to listen on 443 After Certbot runs, your vhost should contain (Certbot adds this automatically): server { listen 443 ssl; server_name your-domain.com; ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # ... rest of your NodeBB proxy config } server { listen 80; server_name your-domain.com; return 301 https://$host$request_uri; } With Cloudflare in proxied mode, the redirect from port 80 to 443 in nginx is technically handled by Cloudflare before it reaches your server (via the "Always Use HTTPS" rule above). Keep it in nginx anyway as a safety net for direct server access. Step 2 : Nginx: trust Cloudflare's real IP headers By default nginx sees Cloudflare's edge IPs, not your visitors' IPs. You need to tell nginx which IP ranges to trust as a proxy, so $http_x_forwarded_for resolves correctly for the upstream hash in step 3. Add this in you nodebb nginx virtualhost configuration : # Cloudflare IPv4 ranges (update periodically from https://www.cloudflare.com/ips-v4) set_real_ip_from 173.245.48.0/20; set_real_ip_from 103.21.244.0/22; set_real_ip_from 103.22.200.0/22; set_real_ip_from 103.31.4.0/22; set_real_ip_from 141.101.64.0/18; set_real_ip_from 108.162.192.0/18; set_real_ip_from 190.93.240.0/20; set_real_ip_from 188.114.96.0/20; set_real_ip_from 197.234.240.0/22; set_real_ip_from 198.41.128.0/17; set_real_ip_from 162.158.0.0/15; set_real_ip_from 104.16.0.0/13; set_real_ip_from 104.24.0.0/14; set_real_ip_from 172.64.0.0/13; set_real_ip_from 131.0.72.0/22; # Cloudflare IPv6 ranges set_real_ip_from 2400:cb00::/32; set_real_ip_from 2606:4700::/32; set_real_ip_from 2803:f800::/32; set_real_ip_from 2405:b500::/32; set_real_ip_from 2405:8100::/32; set_real_ip_from 2a06:98c0::/29; set_real_ip_from 2c0f:f248::/32; real_ip_header CF-Connecting-IP; Using CF-Connecting-IP instead of X-Forwarded-For is safer - Cloudflare guarantees this header contains exactly the real visitor IP with no spoofing risk. Step 3 : Nginx: fix upstream session stickiness The problem: User → CF IP 1 → ip_hash → :4567 ✓ (session created) User → CF IP 2 → ip_hash → :4568 ✗ (400 — no session!) The fix: User real IP → consistent hash → always :4567 ✓ In your NodeBB nginx vhost, update the upstream block like this : upstream io_nodes { # BEFORE (breaks with Cloudflare): # ip_hash; # AFTER — hash on the real visitor IP forwarded by Cloudflare hash $http_x_forwarded_for consistent; server 127.0.0.1:4567; server 127.0.0.1:4568; server 127.0.0.1:4569; } Make sure WebSocket proxying is present in your location /socket.io/ block: location /socket.io/ { proxy_pass http://io_nodes/socket.io/; proxy_redirect off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } Step 4 : NodeBB config.json: origins & trust proxy Two settings are required: tell NodeBB to trust the proxy headers, and restrict socket.io to your domain to prevent 403 origin errors. { "url": "https://your-domain.com", "socket.io": { "origins": "https://your-domain.com:*" }, "trust proxy": true, "secret": "...", "database": "mongo", "port": [4567, 4568, 4569], "redis": { } } Without "trust proxy": true, NodeBB ignores X-Forwarded-Proto and may treat requests as HTTP even when the user is on HTTPS, causing CSRF and cookie issues behind Cloudflare. Step 5 : Cloudflare: WAF rules (bypass socket.io & API) Cloudflare's WAF can interfere with socket.io's long-polling and your API endpoints. Create a WAF skip rule to bypass managed rules for these paths. Go to Security → WAF → Custom rules and create a rule with this expression: (http.request.uri.path contains "/socket.io") or (http.request.uri.path contains "/api/") Set the action to Skip → All remaining custom rules (and optionally also skip managed rulesets). Name it something like NodeBB - bypass socket.io and API. On the free Cloudflare plan you get 5 custom WAF rules. This single rule covers both socket.io and API. Step 6 : Cloudflare: Cache rules (bypass socket.io) Cloudflare must never cache socket.io traffic. Go to Caching → Cache Rules and create a rule with this expression: (http.request.uri.path contains "/socket.io/") or (http.request.uri.path contains "/api/") Set the cache status to Bypass. Optional: add a second cache rule to Cache Everything for /assets/ and /uploads/ paths to offload static files to Cloudflare's CDN and reduce load on your server. Step 7 : Reload & verify # Test nginx config first sudo nginx -t # If OK, reload (zero downtime) sudo systemctl reload nginx # Restart NodeBB cluster cd /path/to/nodebb ./nodebb restart Open your forum in a browser, open DevTools → Network, filter by socket.io. You should see: GET /socket.io/?transport=polling → 200 GET /socket.io/?transport=websocket → 101 Switching Protocols All socket.io 400 errors should be gone. If you still see occasional 400s during a node restart, they are expected and transient - socket.io will reconnect automatically. Summary checklist What Where Scaling-Clustering Redis server Let's Encrypt certificate via Certbot server SSL mode set to Full (Strict) Cloudflare dashboard Always Use HTTPS + TLS 1.2 minimum Cloudflare dashboard Nginx real IP from Cloudflare ranges /etc/nginx/conf.d/cloudflare-realip.conf Upstream: ip_hash → hash $http_x_forwarded_for consistent nginx vhost socket.io origins + trust proxy in config.json NodeBB WAF skip rule for /socket.io and /api/ Cloudflare dashboard Cache bypass rule for /socket.io and /api/ Cloudflare dashboard

NodeBB 4.16.0, Harmony. Users kept reporting that short topics open from the first post after a new reply, instead of at the new post. I traced it to navigator.update() in public/src/modules/navigator.js. When the whole topic fits on the screen (no scrolling), both conditions are true: atTop: scrollTop === 0 and the first post is index 0 nearBottom: the bottom is visible and the last post is index count - 1 atTop is checked first, so newIndex is 1. Topic.navigatorCallback(1, count) then: doesn't advance the bookmark (index 1 is not > bookmarkThreshold) doesn't hit the "index >= elementCount" read path The topic is still marked read when it loads, but the bookmark stays behind. After the next reply the topic list links to the old bookmark (or none), so it opens from the start. To reproduce: log in, open a topic with 2-4 short posts that fits on the screen without scrolling, don't scroll. GET /api/topic/: bookmark is still null. Add a reply from another account, then open the topic from /recent or /unread: it starts at post 1. Suggested fix: when the whole topic is visible, treat it as being at the bottom: if (nearBottom) { newIndex = count; } else if (atTop) { newIndex = 1; } I'm handling it with a small client-side workaround for now: when the last post is loaded and the page is at the bottom, or not scrollable, it emits topics.bookmark with postcount. It would be better fixed in core. @julian @baris

The file will be disappeared when click. Submitted PR to strip the -resized suffix for upload. Please review https://github.com/NodeBB/NodeBB/pull/14948

Not sure when exactly this started to happen, but I now get broken images on my site - for example [image: 7aaa6a6c-0331-4a4e-81cd-2f3d4cb06bff-image.png] According to the console, the original attachment is suffixed with -resized but I do not see a corresponding file, so the render fails. /assets/uploads/files/1656084919400-blurred-resized.png does not exist, but /assets/uploads/files/1656084919400-blurred.png does. Any ideas? Currently running 3.8.3. Whilst not the same topic, there seems to be a relationship in the form of resized with this topic https://community.nodebb.org/topic/12052/resized-images-are-sometimes-larger-than-before?_=1719996905071

What do you use to slow down the endless spam signups? The board already moderates the first posts but the endless signups is something I need to stop or at least slow down. What works for you?

Meilisearch for NodeBB https://github.com/oplik0/nodebb-plugin-meilisearch This plugin allows you to use Meilisearch as search backend instead of the database or Solr (see this topic for why some want to switch) Installation Install via plugins page in the ACP or run this command in NodeBB folder: npm install nodebb-plugin-meilisearch Configuration install this plugin via ACP or by running npm install nodebb-plugin-meilisearch Activate in the plugins page (note: make sure dbsearch plugin is disabled) Rebuild and restart NodeBB Check that the plugin successfully connected to Meilisearch and adjust the connection settings in /admin/plugins/meilisearch if necessary. Meilisearch should start indexing all posts as soon as it connects for the first time, but if that didn't happen you can start reindexing from the ACP page Adjust other search settings as you see fit. Defaults should be good enough for most use cases though. Notes This plugin requires a Meilisearch instance or the same server or somewhere else your NodeBB instance can access This plugin conflicts with other search plugins and will not work if nodebb-plugin-dbsearch is active While it should work fine, note that it's still not well tested. User beware

I saw that there is an exception for the Safari browser that the Service Worker is not installed, is there a reason for this? https://github.com/NodeBB/NodeBB/blob/b1e4248b56f4b9fe4b1cef778debd94333445c6e/public/src/app.js#L355 This makes it impossible to subscribe to push notifications in the Safari browser even when installing the page as a PWA application

Welcome back to another minor release of NodeBB, at a blistering pace after the last release about three weeks ago! Here's what changed since v4.15.0, and what you can expect to see in v4.16.0. ActivityPub Functionality As always, we spent quite a bit of time here improving NodeBB's AP support. We now support sending and receiving of RFC9421 HTTP Signatures. Most of the fediverse is still on the outdated cavage-12 draft standard, so moving to the RFC is a step in the right direction Split-domain webfinger handles now supported (from remote users) Admins can now easily follow a hashtag globally. This means the instance itself will follow the hashtag (either via configurable relay.fedi.buzz or tags.pub), and automatically categorize content into NodeBB Content Warnings from remote posts are now honoured, and hidden behind a <details> tag Custom emoji handling improvements — custom emoji in usernames and topic title are now rendered faithfully! Local admins can "bump" topics, and this shows up as an Announce, which is like a Mastodon-style boost Chat messages can now be reported and forwarded to the remote instance Activity sending logic was given a major overhaul so the site is more performance (aka less likely to keel over when someone moderately popular posts something) Moderation updates Chat messages can now be flagged Category privilege copying is now available via the v3 API Admins can hide topic event types Full name can be used in ACP user search Post edit privilege can now be granted to groups One-click instance-wide ability to disable notification emails Other Tags are now case-sensitive Postgres object cache A bunch of security fixes, thank you all for helping keep NodeBB secure, even if we now no longer award bounties for AI-assisted reports.

Hi — I need help getting realtime working between our Next.js app and a self-hosted NodeBB instance. We are not embedding the NodeBB UI. NodeBB is the community backend only. Our product UI (posts, forums, chats) lives in Next.js and talks to NodeBB over the Write API / Read API. What already works On first login we: Create a NodeBB user with the Write API as admin, e.g. POST /api/v3/users with Authorization: Bearer <master token> and _uid = admin uid Store the returned uid on our user row (Supabase: users.nodebb_id) For later API calls we impersonate that user with the master token + _uid = stored nodebb_id REST is fine: topics, posts, votes, bookmarks, categories, chats list/send all work. What does not work Realtime does not connect from the Next.js app (browser) to NodeBB Socket.IO. We need live: new posts / replies in the feed likes / bookmarks chat messages (chats.receive, unread counts) Because the browser is a different origin than NodeBB, a direct io(nodebbOrigin) from the Next.js site is what we are trying to get right (CORS, cookies, auth). How we tried to authenticate the socket We create a user token server-side: POST /api/v3/users/:uid/tokens (admin master token + _uid = admin) Then we planned to connect from the browser with something like: io(NODEBB_ORIGIN, { transports: ["websocket", "polling"], auth: { token }, // or query: { token } }); Can someone please suggest that how we can do this thing.

So I renewed nodebb.social.After a year, I’ve been thinking about this a LOT.I want to give a federated forum a real shot. But not something like Lemmy or Piefed, where everything leans on upvotes and downvotes. @nodebb can disable that, and to me that’s a pretty critical feature.What I’d like is a general NodeBB board for general topics: art, video games, music, whatever people actually want to dig into.Politics is the tricky part.It’s not like the Threadiverse is starving for political communities. But politics also has a nasty habit of crawling into everything and taking over the room.And yeah, I know an apolitical stance is still a political stance.But I’ve lived through enough GamerGate-type scenarios to see how outrage and grievances can hijack things that are supposed to give us JOY.I’m also against memes and low-effort junk because, frankly, that stuff attracts stupidity.Deep dives, though? Absolutely.I want people to go long. Get into the weeds. Actually think about what they’re posting.I may also need somebody else who finds this project interesting enough to help run it. Maybe a co-admin. Maybe a moderator.Because I can already see how this could get overwhelming, and managing the whole thing by myself could become a pain in the ass when I’ve also got a family.Nothing is launched yet.But I’d love some insight.