DarkXero you can use this extension to obtain the correct configuration in "1 step" https://discuss.flarum.org/d/19307-canonical-url-redirect

If you want to do it "the proper way" without an extension, you can search something like "<your hosting> force www" or respectively "no-www" depending on your preferred domain. If your hosting is managed, it might be one click in the management panel. Or it might be in your provider's online documentation. If it's a VPS or if there's no documentation, you can search for "<webserver> force www", for Apache, Nginx or other webserver.

Basically there are many different ways to achieve it depending on your exact hosting situation. If you need further help, please let us know what kind of hosting you are using for your forum and which company provides it.

      clarkwinkelmann My hosting is shared with limited access... Plus no idea where to fix that... But will try extension easier

        2 months later

        Darkle ahah, oops. I forgot to disable the April Fools mode! It's gone now 👀

        There are a few special extensions that appear when this mode is enabled 😇 I have enabled it each year but you might be the first visitor to actually notice 😂

          a month later
          2 months later

          The lab is now able to scan forums running Flarum 1.4.

          While the release contains no breaking changes for extension, there was an important change to the inline javascript/json in the homepage I had not noticed in advance and of course it broke everything in my script.

          In future lab updates I will probably start dropping compatibility with older Flarum betas, at the moment you can still scan forums that run versions as old as Flarum beta 7 (the current Flarum release when the lab was launched). The code starts getting a bit complicated with all the changes during the years.

          2 months later

          Can we control extension's version control? Which is updated which is not updated? I think it should list unupdated extensions and show the last versions. Thank you very much for this great tool. @clarkwinkelmann

            fakruzaruret I'm not sure what you mean I could/should change on the lab or what are you suggesting people do?

            The lab tries to warn of extension updates but it's very limited in the ways it can guess the current version of the extension. If the lab isn't sure the extension is outdated, it won't say anything.

            To check for updates on your own forum more accurately, you should use Mercury or the composer outdated -D command.

                May I suggest that you make the option to not publish the results the default one? Because from my understanding this is where a lot of recent Chinese spammers are getting their way to raid Flarum forums.

                clarkwinkelmann such as mercury.

                I used composer update -w command to update extensions but it does not works always. For example fof/sitemap extension is not updated this command. Then I found the new version (2.x) and I tried to update it changing composer json file. I learned the new version by chance. Composer outdated -Dshows other packages like illuminate etc.

                Mercury shows a list current version and last versions. This is nice view to examine. But currently I cant use it I get error 🙁

                https://discuss.flarum.org/d/27620-mercury-the-extiverse-extension-to-understand-extension-updates

                command: php flarum mercury:update-check

                  2 months later
                  2 months later

                  I have marked all Flarum versions that the lab can recognize (beta 7 to stable 1.6.1) as vulnerable.

                  The Lab cannot tell Flarum version 1.6.3 apart from 1.6.2 since all changes are server-side and you need an account to probe for the vulnerability, so 1.6.2 will not show a vulnerable rating. You should still update as soon as possible if you are still running Flarum 1.6.2.

                  If you are wondering why the list of recent scans disappeared (already a few weeks ago), the SQL query that fetched that information was poorly written and there are now so many entries in the database that the whole website would time out because of it. I still haven't had time to rewrite it properly, so for the time being the list is hidden.

                  a month later

                  Sorry to bother you Clark.
                  I've previously gotten A+ score in your tool. 😃

                  Now I get this

                  I am 100% that it's my fault, but do you know which parameters control this?
                  I've messed around with permissions, reinstalling composer and other stuff.
                  Forum still works, but for example your anonymous extension don't.

                  I'm grasping for clues for what to troubleshoot

                    FullThrottle83 what's your Flarum version in admin dashboard? All versions below 1.6.2 will receive rate D. If you really are on Flarum beta 8 or 9 you need to update ASAP as there have been numerous security fixes since then. If you were up to date but no longer are, maybe you ran a composer update that accidentally forced Flarum to downgrade?

                    I'll need to know your forum URL to investigate further. You can send it to me privately via Discord or email if you prefer.


                      It is up to date 🙂

                      My problem started when I updated composer from 2.4.2 to 2.5.2
                      Don't remember exactly, but at some stage I ran it as root.
                      That must've messed up permissions somehow. I think that is the cause of this.

                      You are most kind, I'll reach out to you on discord. To seek your knowledge, not to demand anything!

                      FullThrottle83 as confirmed on Discord, the odd "beta"/vulnerable results were because Cloudflare Rocket Loader interfered with my version detection code.

                      I have published an update to the lab that fixes the version detection and shows a message at the top of the scan if Cloudflare Rocket Loader was detected. Most of the features work but the list of extensions on the Lab will be incomplete when Rocket Loader is active, because my code only looks for specific patterns in the assets and those are different when Rocket Loader is active.

                      While Rocket Loader causes issues with my Lab scanner, I am not aware of it causing any issue when it comes to using Flarum. I am curious whether it brings any benefits though, because according to the Cloudflare documentation this feature accelerates the website rendering by prioritizing text and images and delaying javascript. But since Flarum is a single page app, nothing will be visible until javascript is loaded anyway. So it could maybe even be worse? I'd be curious to know if anyone made tests to compare the performance with any without Rocket Loader.

                        Thank you for your fast fix, and for identifying and explaining the cause!

                        You are correct, it makes hardly any difference with Rocket Loader enabled.

                        Without

                        With

                        Cloudflare's own speed test - Upper value is with Rocket Loader

                        I come from mainly handling WordPress, where Rocket Loader can have a bigger impact (depending on the site).
                        I'll be trying out other settings in Cloudflare.

                        3 months later

                        The Lab can now scan Flarum 1.8 forums.

                        I also fixed an issue that caused forums using the FontAwesome6 extension to be impossible to scan.

                        3 months later

                        I discovered it completely breaks with the extension Private Forum Facade, due to the redirect it does to the /login page, therefore it will always cap you to a C, and even when the extention is removed MTF Labs still thinks the homepage is https://example.com/login, despite the canonical domain being https://example.com, and no matter how it is typed in the scan bar, will revert to https://example.com/login 😐