Repository navigation
Anubis not working well to reject bots, even with the 6 challenge #2044
Description
Describe the bug
We have been using Anubis since 2026 January for our hgweb server. (Both hg.pushbx.org and hg.ulukai.org are served by the same server.)
Recently, it lets through many of the bots, even with a 6 challenge.
Steps to reproduce
Run Anubis on hgweb. The web address of this hgweb instance is well known, so it attracts many scrapers.
Expected behavior
Anubis should reject the bots.
Your operating system and its version.
Debian 11
Your browser and its version.
not needed
Additional context
Here's the currently installed Anubis package:
root@ulukai:~# dpkg -s anubis
Package: anubis
Status: install ok installed
Priority: optional
Installed-Size: 75292
Maintainer: Xe Iaso <me@xeiaso.net>
Architecture: amd64
Version: 1.28.1
Description: Anubis weighs the souls of incoming HTTP requests and uses a sha256 proof-of-work challenge in order to protect upstream resources from scraper bots.
Homepage: https://anubis.techaro.lol
The server runs Debian 11.
The last 100 log entries are available in https://pushbx.org/ecm/test/20261017/20261017_161303265_8799.txt
Activity
ecm-pushbx commentedon Oct 17, 2026
As noted in https://pushbx.org/#hgweb we re-enabled password auth for the hgweb, so now it is protected both by Anubis and a login ("anonymous" as user, any nonempty password).
ecm-pushbx commentedon Oct 17, 2026
This is the configuration, which I am told is the default: https://pushbx.org/ecm/test/20261017/20261017_163034720_5990.txt
dwhitemv25 commentedon Oct 17, 2026
Anubis is not designed to stop bots using headless browsers (or other situations with full JS engines that can run the challenge), just slow them down.
Try enabling the new WASM-based challenges and see if that slows them down further.
The IPs in use are from home ISPs and not datacenters so the traffic is sourcing from a residential proxy network and/or hijacked/trojan'd apps, browser plugins, or hardware.
If you look at the access log entries for the pass-challenge hit, it has the elapsed time of the challenge computation in the query string. You can use that to tune the challenge strength.