Hello Ben !
I don't encounter this issue on my Android device when browsing my Piwigo sites with Firefox Focus. Maybe your BYB settings are too strict. Or perhaps it isn't compatible with the Cloudflare service your site uses. Because I can easily connect to your site. And I'm not logged in, of course.
Offline
SchuminWeb wrote:
So I recently discovered that BYB is blocking logged-out mobile visitors, at least on Chrome for Android. When I have BYB turned on and I access the site in private browsing mode (so that I'm logged out), I get a 403 error:
https://imgur.com/MM237ai
When I turn BYB off, the site loads normally:
https://imgur.com/ukX3yQV
It happens to me when I'm logged out, and my mother got the same issue visiting the site on her Android phone (most likely using Chrome as well). When I'm logged in, everything loads normally.
For what it's worth, my site is https://www.benschumin.com/ and I'm running the Bootstrap Darkroom theme.
Hi SchuminWeb,
thank you again for reporting this.
I tested your site myself on a smartphone in private / incognito mode and I could not reproduce the issue on my side, even when testing without an existing referrer/cookie context. So at the moment it does not look like a general problem affecting every mobile visitor.
I also ran my BYB test checks against your site and BYB responded as expected there as well.
Because of that, I need a bit more information to see what is different in your case. Could you please provide:
-one exact matching log entry from bot_log.txt from the moment the 403 happens
-your Chrome version on Android
-Android version / device model
-the exact URL where it happens first (homepage, category, picture page, etc.)
-whether it only happens on mobile data, only on Wi-Fi, or both
-whether any ad blocker, privacy browser setting, VPN, DNS filter, antivirus, or proxy is active
One more note: your site currently shows a security check page in front of the website (“Security check in progress / verifying you are not a bot”). So there is also a chance that another security layer in front of the site is involved, not only BYB itself.
Once I have one real bot_log.txt line from the exact time of the block, I can check much more precisely what happened.
I would also like to add that I test BYB with the following browsers, and none of them show any issues:
-Chrome
-Microsoft Edge
-Mozilla Firefox
-Opera
-Avast Browser
Best regards,
Olaf
Last edited by Schneider-Fotografie (2026-04-20 15:31:35)
Offline
Hello SchuminWeb
I can now clearly see the cause.
Your site is using Cloudflare's security check (Turnstile / bot protection) in front of BYB. This means every request is processed by Cloudflare first and only then passed to BYB.
Because of this, BYB does not always receive the original browser request. Cloudflare may modify or delay certain headers (like referrer or cookies), especially on mobile networks or in private browsing mode.
That can lead to a situation where BYB receives a request without referrer and cookies, even though it is a real user — and then blocks it.
This would also explain why I cannot reproduce the issue on my device, and why the BYB test works correctly (Cloudflare allows my requests through cleanly).
So the issue is very likely caused by the interaction between Cloudflare and BYB, not BYB alone.
To confirm this, please temporarily disable the Cloudflare security check and test again. If the issue disappears, we have a clear confirmation.
Also, please provide one exact log line from bot_log.txt at the time of the block, so I can verify what BYB actually received.
Olaf
Offline
Got another one for you: Google is getting a lot of 403 results from my site in various categories. Here are two examples.
https://www.benschumin.com/picture/19295 - shows up in Google Search Console's "Blocked due to access forbidden (403)" list
https://www.benschumin.com/picture/17003/tags/bags - shows up in Google Search Console's "Server error (5xx)" list
Both pages open normally when viewed by a real person, but when BYB is enabled, Google gets a 403 error for both of these, and therefore cannot index the pages. When I hit the emergency stop for BYB and thus turn the service off, these pages are suddenly visible to Google again. When I reenable BYB, they again give Google forbiddens.
In trying to find the problem for this to allow Google to see my site better, I have scoured every single page on BYB's backend, and can't find the setting that will allow me to let Google in. What am I missing? How do I fix this so that Google can see my pages and index them?
Offline
Can you use Cloudflare with BYB or does Cloudflare interfere with BYB. Or is it just a bit of overkill. Or does every little bit help.
Offline
I use Cloudflare together with BYB, because every little bit helps. When I did my troubleshooting, I disabled Cloudflare to see if that changed things, but it didn't. Only when I knock out BYB does the problem go away, and it comes back immediately when I reenable it. So I've already isolated it to a BYB issue, but I just don't know what to change to fix the problem.
Offline
Maybe your BYB settings are too strict. For example, I no longer use the option "Block access without Referer and cookies" because I found myself locked out of my own site.
Offline
I agree that the settings are probably too strict. I'm just at a loss as to what settings I need to unset. The one that you mentioned, I've never turned on.
Offline
Not sure how much control you have over your web server, but I set up mod_remoteip in Apache so that even though traffic is coming from the Cloudflare proxy servers, the originating client (or bot) IP ends up in my logs which seems to help with BYB.
https://developers.cloudflare.com/suppo … sitor-ips/
https://devanswers.net/retrieve-real-cl … php-nginx/
Last edited by windracer (2026-05-12 14:46:08)
Offline
When I enable the plugin on website, immediately get the 403 Forbidden error and then can no longer access my webpage. Had to go into plugin folder on the server and remove the BYB folder to access webpage again.
Piwigo vs: 16.4.0
PHP: 8.0.30
MySQL: 5.7.23-23
OS: Linux
BYB Version: 2.5.0
Prior to May 9th, I had been running BYB for a long time on website with no issues.
Had a new event (new album) I uploaded on May 9th, so sent out link to people and then discovered website was down (403 error). At first I could still access my website but then even I couldn't access.
Since was completely down, I couldn't go into BYB settings. Removed it manually.
Today I tried activating the plugin again and as soon as I activated the plugin, my PC browser was thinking a lot and from -//:---\spam tried access my website and got the 403 error. I couldn't get the setting button to work on my PC (page was still thinking) so quickly clicked on the deactivate slider which did work to turn the plugin off. BYB settings second time I tried reactivating (today) were just default upon activation since I'd previously removed the folder from the server.
Thanks!
Jeff
Offline
Jeff, the BYB coder Olaf Schneider has not been able to connect to the forum for some days. You won't receive any answer from him until the forum administrators unblock his IP. (Same inconvenience happened to me twice)
Offline
Katryne
Thanks for letting me know!
Jeff
Offline