I have question about travian bot detection?

[cheryiit]

Does anyone know, how they are detecting bots?

[hdmaniak2]

trivially easy for majority of bots, but as private servers are maintained by one or few admins, they just do not have time to do it or just simply do not care.

[NazgulCoder]

Does anyone know, how they are detecting bots?

I simply asked Github Copilot whether this repo has some logging feature

Based on my search, I found **two main logging systems**:

## 1. **AccessLogger** (`src/Utils/AccessLogger.php`)
This class logs all HTTP requests with comprehensive details:
- **URLs visited** - Logs `$_SERVER['PHP_SELF']`
- **Request data** - Captures GET parameters
- **POST data** - Records POST submissions
- **Cookie data** - Tracks session cookies
- **User IP address** - Stores `$_SERVER['REMOTE_ADDR']`
- **Timestamps** - Records date and time of each access

The `AccessLogger::logRequest()` method is called on virtually every page in the application (login.php, build.php, logout.php, berichte.php, etc.), writing logs to a file defined in the configuration as `var/log/access.log`.

## 2. **Logging Class** (`GameEngine/Logging.php`)
This handles activity-specific logging:
- **Login logs** - `addLoginLog()` - Tracks user login attempts with timestamp and IP
- **Build logs** - `addBuildLog()` - Logs when buildings are constructed/upgraded
- **Tech logs** - `addTechLog()` - Records technology research activities
- **Market logs** - `addMarketLog()` - Tracks resource trades and sending between villages
- **Illegal activity logs** - `addIllegal()` - Logs unauthorized access attempts
- **Gold finish logs** - `goldFinLog()` - Tracks when users spend gold to finish construction

These logs are stored in database tables like `{TB_PREFIX}login_log`, `{TB_PREFIX}build_log`, `{TB_PREFIX}market_log`, etc.

Both systems are controlled via configuration constants like `LOG_PAGE_ACCESS`, `LOG_LOGIN`, `LOG_BUILD`, etc., allowing server administrators to enable/disable specific logging types.

With said so, I'm pretty confident we can create a very simple cronjob that checks all these logs, e.g. 24h non stop with always same intervals, or just in 1h constant building with perfect timings etc.
Be aware, there is no 100% guarantee you detect every bot, because bots can try to automate stuff and pretend to be human like, with random delays etc.

I asked to Grok what he thinks about this

Yes, I’d implement a BotDetector class that leverages both logging systems you already have in your Travian pserver:

AccessLogger (var/log/access.log) → for raw request timing, frequency, and URL sequences (the strongest bot signals).
GameEngine/Logging (DB tables like build_log, market_log, etc.) → for game-specific patterns (perfect build orders, market spam, 24/7 activity).

Core Bot-Detection Signals (what actually catches bots)
Bots (especially cheap pserver bots) show:

Extremely low variance in inter-request timing (humans have natural jitter; bots have near-constant delays).
Unnaturally high sustained request rate (e.g. >25–40 requests/minute for long periods).
Long continuous sessions without natural breaks (no 4–8 hour sleep gaps).
Repetitive / predictable URL sequences (e.g. always dorf1.php → build.php → dorf2.php in the exact same order).
Perfect action timing in DB logs (builds started exactly at completion time, market trades every X minutes on the dot).

The class uses a score-based system (0–100). Anything ≥ 70 → flag as bot (log + optional auto-ban / captcha trigger).

Another tip that comes to my mind, reduce the PHP session time, that it will last only 1h for example. Then in the login implement some captcha or cloudflare turnstile, this literally would break 99% of the current bots available on the market.
Also pay attention that captcha solvers do exist, but they pay $$$ each solve.

[hdmaniak2]

In my work I use Grafana + Loki to aggregate every log from every service and you can very easily analyse this data, either searching, grouping or showing visual representation. There are tons of possibilities.
Captcha is a good idea but bot can detect it, alert you, you solve it and continue. The more captcha you introduce the more you annoy serious players.
Analysing the behavior is the key in my opinion. But as as I said admins do not have time for that.

[NazgulCoder]

In my work I use Grafana + Loki to aggregate every log from every service and you can very easily analyse this data, either searching, grouping or showing visual representation. There are tons of possibilities. Captcha is a good idea but bot can detect it, alert you, you solve it and continue. The more captcha you introduce the more you annoy serious players. Analysing the behavior is the key in my opinion. But as as I said admins do not have time for that.

correct, however Cloudflare Turnstile does not require most of the time user interaction because it automatically detects sus behaviours e.g. mouse movements and clicks.

I personally don't use any monitoring software for logs, I will eventually try that, do you need any custom parser or particular configuration?