CIDRAM v Cloudflare

[Taffman]

Before I upgraded from e107 v1.4 to 2.3.11 I used to use ZBBLOCK to protect my site, as this hasn't been maintained for a while I'm looking for a more modern alternative. I'm considering CIRAM or Cloudflare or maybe both. Any advise from anyone using these would be much appreciated.

[Alex-e107nl]

Taffman, you could also search and try things out, for instamce: https://github.com/e107inc/sfs
You could also combine it with https://github.com/Jimako-e107-plugins/signup_secure for extra spam protection. I like to read from someone else if this works for the latest github version of e107 :-)

Succes!

[Taffman]

Thanks for this, I'll look them up. I haven't got a forum installed but these users should be blocked anyway.

On my v1.4 site I had some mandatory extended user field questions which had to be answered as a deterrent with regex validation, however the current version of e107 doesn't seem to be able to make any of these fields mandatory on signup or have I forgotten to configure something?

[Taffman]

Just tried to download sign-up secure from within e107 admin and I get:

Couldn't detect the root folder in the zip.
Unable to continue

?

[Alex-e107nl]

I never use this feature, only FTP so i cannot help you with this...

[tgtje]

@Taffman from within e107 admin that would be one of the oldest, and is in rar format. (root folder is inside) so maybe that could be the issue (as unknown iff importer accepts rar / not shure if all others are zip.)
The site recommended by @Alex-e107nl points to a newer one (for v 2.33). (manual download/upload/install).

[rica-carv]

I've used a old CIDRAM in a v2.x live site, but that was long ago...

[Taffman]

Ignore my comment regarding extended user field and mandatory setting on sign up. After further testing this does in fact work

[e107help[bot]]

@Taffman On the download first, since that is what is blocking you. That message is vaguer than it reads: e107 only looks inside the archive if PHP can open it as a zip in the first place, and everything else lands on the same "root folder" error (file_class.php L2944-L2950 on 2.3.11), so it covers "what came down was not a readable zip at all" too, which is the direction @tgtje is pointing. By hand gets you past it: take the newer copy from the link @Alex-e107nl posted, unzip it on your PC, and FTP the plugin folder into e107_plugins/. GitHub adds a branch suffix to folder names in its zips, so make sure what lands there is called signup_secure and nothing else. It turns up in Admin -> Plugins ready to install, exactly as though the button had worked.

On the question itself: CIDRAM is the like-for-like replacement for what ZB Block did for you, wired through the same one-line $CLASS2_INCLUDE entry in e107_config.php as on the earlier thread. That file is not part of the upgrade package, so it stays put across updates. Cloudflare works at a different distance, turning traffic away before it reaches your host at all, and the two stack happily, but it is a separate project you can park; nothing about CIDRAM needs it.

You said in July that you were going to try Cloudflare, so this may be live already. Either way it is worth two clicks: Admin -> Users, tick the IP column in the column chooser, and look at your own row. An address that is not yours means e107 is recording Cloudflare instead of your visitors, because it reads REMOTE_ADDR and only consults the forwarded-for header when REMOTE_ADDR is private (iphandler_class.php L345-L356), and Cloudflare's edge addresses are public. In that state a ban lands on Cloudflare, and the "maximum signups per IP" setting, if you use it, counts every visitor as one person (signup.php L279-L291) and shuts registration for the lot of them once the number is reached.

e107 has no setting for that, so it is fixed at the web server, and it is one sentence to your host: please restore the original visitor IP for Cloudflare, with mod_remoteip on Apache or the real_ip module on nginx. Being server configuration, it survives e107 upgrades, and it fixes what CIDRAM sees at the same time. While you are in the Cloudflare panel, have it reach your server over HTTPS with a real certificate on it (Full (strict), as that option is called today). On Flexible it fetches your pages over plain HTTP, and e107 takes its scheme from the connection it can see, so it starts writing http:// links into pages the visitor loaded over https://.

Happy to dig further if that IP column turns up something odd.

[e107help[bot]]

@Taffman, the half of my last answer that was missing: where to get CIDRAM, and which of it to get.

The downloads are at https://github.com/CIDRAM/CIDRAM/releases. CIDRAM publishes four lines side by side, and your host's PHP decides which you can run: CIDRAM v1 wants PHP 5.4 or newer, CIDRAM v2, v3 and v4 all want PHP 7.2 or newer. Those numbers are CIDRAM's own and have nothing to do with e107's. CIDRAM v4 is the current line, and the one the project's own repository opens on, so take that if your PHP is 7.2 or above.

Landing on an older line is not a dead end either: all four had a release on the same day, 2026-08-20.

Wiring it in is what I described before, whichever line you pick: the one $CLASS2_INCLUDE line in e107_config.php, pointed at the loader file CIDRAM's installation instructions name. e107_config.php is not part of an e107 update, so it stays put.