Loghound 1.3.4

Fixed

• Your own site is never where a visit came from. A session whose first request carries a
  referer on the visited host, which happens when a tab is restored or a visit resumes after the
  idle timeout, used to report that host as its source. It now takes the latest external referer of
  the same address on the same host, or counts as direct when there is none. A referer on the
  www. variant of the host is the same site.

• Same site no longer shows as a channel with no visits in it.

Changed

• A spoofed User-Agent is always bot. A client hint that contradicts the User-Agent, a
  platform hint that contradicts it, or a crawler claim that reverse DNS does not confirm now
  forces the verdict to bot, whatever else the session did. Client hints are no longer expected
  from iOS browsers, Android WebView, or requests not proven to be TLS.

• A declared bot or a non-browser client is always bot. Neither a referrer nor human-looking
  behaviour moves it off the verdict.

• Signed in means a valid email address and nothing else. The beacon keeps the identity only
  when it is a valid email, and beacon interactions or scroll depth no longer count as signed in.

Loghound 1.3.3

Changed

• Screenshots of the panel in action. The README, PANEL.md, DETECTION.md and ATTACKS.md now
  open with a link to 19 captioned screenshots on the Loghound page at opensolr.com, replacing the
  placeholder that stood where screenshots should have been.

• The documentation covers everything since 1.2. A summary of what is new at the top of the
  README, and PANEL.md now describes exclusions, attack patterns, CSV import and export of every
  rule list, and the chart above every ranked table.

Loghound 1.3.2

Changed

• Filter by comes first in the top bar. Applied filters now sits to its right.

Loghound 1.3.1

Added

• A chart on every SEO Tools page. Search engines and AI, landing pages, referring sites and
  countries and devices draw this period beside the comparison period for the rows the table ranks.
  Engagement by channel compares channels on visits, pages per visit, one-page visits or engaged
  time. Crawlers draw requests per crawler and their 4xx and 5xx answers. Crawled, not visited draws
  crawler requests beside the visits each page received. Top 12 rows on a desktop, top 8 on a phone.

Loghound 1.3.0

Added

• SEO Tools, a new page in the navigation right below Visitors. Every number on it is shown for
  two periods side by side: the one you pick and the one you compare it with. Presets are today so
  far, yesterday, the last 7, 28 or 90 days, this month so far and last month, or any two calendar
  ranges back to the first day your index holds. A period that is still running is compared like for
  like: today until now against yesterday until the same time. Every page follows the filters in
  force, so humans only is the Verdict filter, set once.

• Nine pages, one question each. A scorecard with the headline figures and both periods over
  time; channels, as bars, a table and a line per channel; search engines and AI assistants by the
  site that sent the visit; landing pages; referring sites; countries, regions, cities, devices,
  browsers and operating systems; engagement by channel; declared crawlers with the pages they
  fetched, their 4xx and 5xx answers and how many were confirmed by reverse DNS; and the pages
  crawlers fetch most against the visits the matching channel sent to them.

• Rankings by change. Biggest gains, biggest losses, most visits now, new and gone, on every
  table that ranks values, each with a CSV export that carries the two periods and the choices on
  screen.

Fixed

• Every CSV export says when it was taken again. The Taken line in the file's header was empty
  and the time was missing from the file name, on every export in the panel.

Loghound 1.2.3

Added

• A chart above every ranked table on the analysis pages. Bot classes and declared crawlers
  (verified or not), the addresses behind matched requests (answered or refused), crawler
  impersonation, netblocks and countries (by population), top pages, entry and exit pages, trending
  paths and search terms, channels, referring sites, landing-page bounce and signed-in visitors. Each
  chart is drawn from the rows its table was filled with, so the two always agree and no extra
  request is made. A card whose data is a handful of headline numbers keeps its figures instead.

• Compact on a phone. A chart shows the top 12 rows on a desktop and the top 8 at phone width,
  at a shorter row height, and the full list stays in the table underneath. Colours are the ones the
  tables' own bars use, checked for separation in both themes.

Fixed

• Charts created after the page loaded now follow their card's width. Only the charts present
  in the markup were watched for resizing, so a chart a card drew when its data arrived kept the
  width it was born at through a rotation, a rail toggle or a window resize.

Loghound 1.2.2

Fixed

• On a phone, form controls are compact. The sort pair above a table was drawn at desktop size —
  a 120px minimum width, 15px type and a 44px height — because its compact rule sized the hidden
  native select instead of the control on screen. It is 24px now, and every field, dropdown and
  button in pages and dialogs is 32px at phone width. Text fields keep 16px type so iOS does not zoom
  in when one is tapped. Desktop is unchanged.

Loghound 1.2.1

Added

• Rules travel as CSV, in and out, on all three rule lists. Ingest exclusions, live stream
  exclusions and attack patterns each have a CSV export and an Import from CSV control. An import
  reads the file the same card exports, adds its rules to the ones already there with duplicates
  skipped, switches shipped defaults and built-in groups on or off as the file says, and holds
  every row to the same checks as a rule typed by hand. The file is read in the browser and sent
  as text, so nothing is uploaded; anything over 500 KB is refused.

Loghound 1.2.0

Added

• Attack patterns, on a Settings page of their own. Requests that are an attack on your sites, on
  top of the built-in detector, for every host or for one, as text or as a regular expression. A match
  is flagged Your attack pattern on the Attacks page, the pattern is shown on the request, and the
  visit is scored a bot. Loghound ships with defaults that are an attack on any website — webshell
  names, deployment secrets, botnet droppers — and a default you switch off stays off after an update.

• A User-Agent that is not a browser is not a person. A visit whose User-Agent is neither a browser
  nor a declared crawler — an empty header, a bare Mozilla/5.0, WordPress/6.4.3 — is scored a bot
  and classed Undeclared client. The browser recognition behind it covers every engine and every
  desktop, mobile, regional, in-app, privacy and text-mode browser, TVs, consoles and feature phones.
  A log format that does not record the User-Agent is never judged by it.

• A refused attack convicts. A request matching an attack pattern that the site answered with 403
  or 406 is scored a bot. Any other 403 adds points towards bot without convicting on its own.

Changed

• Mostly refused counts pages and endpoints, and half is enough. It required the visit's first
  request to be refused and four fifths of everything to be refused, and a WordPress sweep that opened
  on a request answered with the homepage slipped through at 57%. Assets and sign-in or rate-limit
  refusals are not counted.

• Rule versions. Scoring rules are version 4 and the attack table is version 2. Verdicts and flags
  already written are not recomputed.

• Deploying this release needs a schema push for the new hit_patterns_ss field:
  php bin/loghound-schema --force, before the reader restarts.

Loghound 1.1.9

Changed

• The attackers table leads each address with its country's flag. The country was a two-letter
  code under the network, where it read as part of the network's name. It is the flag in front of
  the address now, as in every visit table, with the country's name on hover and a filter behind a
  click.

Fixed

• A website measured by the beacon alone opened to an empty dialog. The dialog borrowed the
  Recent visitors rule that a visit must reach an HTML page, and a site with no access log behind it
  has no page count at all, so a host listed with 129 visits opened to 0. A dialog now counts every
  visit the value has, and the Recent visitors table keeps its rule.

• A dialog opened from the attack views said 0 without saying why. Those tables are built from
  the request log, which cannot apply a verdict filter, so they list addresses and networks the
  dialog, which can, then hid entirely. The dialog now says how many visits there are without that
  filter and that the table it came from may not apply it.