clarkwinkelmann You make very valid points. Without Cloudflare IP detection, this extension would not function properly for forums running behind Cloudflare, since the client IP would not be accessible at all.
Of course, as you mentioned, IP-based protections are inherently weak—rotating IPs through proxies is trivial. From that perspective, Cloudflare headers do not drastically change the risk model, but I wanted to ensure compatibility for forums hosted there.
For administrators seeking stronger moderation, I suggest using this extension together with First Post Approval. That way, guest submissions can always be routed through moderators before becoming visible.
As for the global guest prefix, this was an intentional design decision. Any account using the same prefix will be subject to the same restrictions. This is consistent with the behavior in the original Finteger Guest extension, which inspired this project.
That being said, I completely understand your concerns. I initially postponed publishing this extension for the very same reasons, as I couldn’t find a perfect solution that applied across all environments.
I’m very open to exploring alternatives—especially around Cloudflare header handling or IP restriction mechanisms. If you have suggestions on how to make these aspects more robust without sacrificing compatibility, I’d be glad to hear them.
Currently, the extension also blocks the creation of multiple guest accounts from the same IP.
