XenForo

Platform · this deep dive is built from the official pages of the platform itself and of the tools that support it.

Overview

XenForo is not a social network and not a platform where you create an account. It is a paid forum engine: you buy a licence, install the program on your own server and get a community that you own yourself. The advertising rules, the moderation and the decision about who gets in are yours, not somebody else's.

For a community specialist XenForo is interesting in one scenario: when a brand needs a forum of its own rather than a presence on someone else's. Everything this guide usually calls promotion turns into administration here.

Who's here

XenForo has no audience — it has administrators who bought a licence.

The documentation's language is English. The engine itself is multilingual: the interface is translated through a system of "phrases", and a single installation can hold several languages, with the visitor choosing their own and the administrator setting the default. The developer suggests looking for ready-made translations in its own resource directory.

Getting started

What the server needs

The installation instructions ask you to «ensure that your server meets XenForo's requirements». What follows from the documentation is this:

you need an empty MySQL database and its access details, plus FTP access to the server — those are the first items on the «To install XenForo you will need» list;
the data and internal_data directories must be writable (on Linux — «chmod 0777», on Windows/IIS — «Full Control» for the IUSR_ account);
if the installer complains about something other than permissions then, as the instructions state directly, «your server does not meet XenForo's requirements and your host will need to make changes to their PHP configuration»;
for emoji and full Unicode MySQL version 5.5 or newer and the UTF8mb4 encoding are required;
the "Enhanced Search" add-on requires Elasticsearch 2.0 or newer, and the developer warns that most shared hosting does not have it.

Installation

The order is simple: download the archive from the customer area, unpack it, upload the contents of the upload directory to the server, open an address of the form example.com/community/install/ in a browser and go through the wizard (step by step). There are two ways to avoid doing it by hand: order installation by XenForo staff — at purchase or later through the customer area — or take XenForo Cloud, where installation and updates are automated.

What it costs

The prices are set by the vendor on its own purchase pages — xenforo.com/purchase/ and xenforo.com/pricing/. The product line is visible in the documentation's footer: the forum, media gallery, resource manager, enhanced search and importers.

What you can publish

Content restrictions are set by the forum's owner. The engine provides the frame: threads, posts, attachments and BB code markup. The list of permitted file types is configured with the «Allowed attachment file extensions» option, and the same page holds the attachment manager with filters by type, owner and date, plus a warning that a deleted attachment cannot be restored.

The rules for forum users are yours too. XenForo ships with two documents, «Terms and rules» and «Privacy policy», which the user accepts at registration; their text is edited through the phrase system or replaced with a link to an external page.

How to grow

There is no feed algorithm here that "shows" your content to someone else's audience — this is your site. What there is on the advertising side is a built-in placement system. Ads are added in the Setup > Advertising section: you choose a position from a ready-made list, paste in the advertiser's HTML and, if you wish, restrict display by user group. The documentation suggests a pairing directly: hide the ads from anyone who has bought a paid account upgrade.

Path to monetization

XenForo does not pay authors — your forum pays you. The standard tool is "paid user upgrades": a user buys a move into a group with extended rights, and through those rights you can sell access to any section or feature. First a payment profile is set up, then the upgrade itself: price, duration, automatic renewal.

Payments go through external services. The documentation lists Stripe, PayPal, BrainTree and 2Checkout; the geography of payouts is determined by those services, not by XenForo.

Tools and automation

There is a REST API, and it is official. [It appeared in XenForo 2.1, is available at an address of the form https://example.com/community/api/, is enabled by default and is switched off with the line $config['enableApi'] = false; in src/config.php](https://docs.xenforo.com/manual/reference/rest-api). Responses are JSON, and errors come back with codes in the 400 range.

Keys are created only in the admin panel and only by a super administrator; every super administrator receives an email when a key is created, and the keys themselves come in three types — guest, user and «super user», the last of which can act on behalf of any user and bypass their permissions. There is no unauthenticated access to the API, and ordinary users cannot issue themselves keys. The developer advises creating a separate key for each API client and granting it only the scopes it needs.

The API's coverage is visible from the reference's list of sections: forums, threads, posts, users, attachments, private conversations, the media gallery, the resource manager, search, statistics, OAuth2 and oEmbed. The same place lists scopes of the form alert:read, attachment:write, conversation:read and node:delete — the permissions are sliced fairly finely.

Limits and rules

Discipline inside the forum runs on points: a moderator issues a warning, the points accumulate, and «warning actions» automatically apply restrictions or a ban once a threshold is reached; each warning has its own weight and its own expiry period.

Anti-spam is a separate set of measures: checking registrants against the StopForumSpam database, DNS block lists, a registration timer, "spam phrases" with patterns such as watch * online, and text checking through Akismet with submission to the moderation queue. CAPTCHA is either reCAPTCHA or your own question-and-answer set, but only one of them at a time.

The main legal constraint is obvious, but worth saying out loud: the server, the users' data and compliance with local law are on you. The engine only provides the tools.

Who it's for

XenForo suits a company or a media outlet that needs its own forum under full control and is willing to pay for a licence and maintain a server (or take the cloud version). It does not suit anyone looking for a ready-made audience: by the product's design there is none. Nor does it suit anyone who needs a predictable budget: you will have to plan on figures obtained from the vendor directly.

Verified data

The checked data this deep dive rests on.

About the platform

the platform describes itself as follows: «XenForo is a compelling community forum platform with a premium user experience, reliability, flexibility and security. There is no better platform upon which to grow your community.»

Self-description: this is the platform's claim about itself, not an independent assessment

source, checked 2026-07-28

The only accessible official domain

source, checked 2026-07-28

Getting started

installation requires the customer account details, an FTP client and server access, and an empty MySQL database; the data and internal_data directories must be writable («chmod 0777» on Linux, «Full Control» for IUSR_ on Windows/IIS)

There is no table of PHP and database version requirements on the pages available

source, checked 2026-07-28

full Unicode and emoji support requires MySQL version 5.5 or newer and the UTF8mb4 encoding; existing databases are served by the script php cmd.php xf:convert-utf8mb4

The only confirmed database version requirement

source, checked 2026-07-28

the XenForo Enhanced Search add-on requires Elasticsearch 2.0 or newer; the developer warns that most shared hosting does not have it

An explicit warning in the documentation

source, checked 2026-07-28

Content

the permitted attachment types are set by the «Allowed attachment file extensions» option; the attachment manager allows filtering by type, owner and date; deleted attachments cannot be restored

The «Attachments» section

source, checked 2026-07-28

Advertising

a built-in advertising system: the Setup > Advertising section, choosing a position from a ready-made list, pasting in the advertiser's HTML, restricting display by user group, display order and an active toggle; in templates the positions are marked with the tag <xf:ad position="..." />

The documentation explicitly suggests hiding ads from those who have bought a paid upgrade

source, checked 2026-07-28

How the money works here

the standard monetization route is «paid user upgrades»: a user buys a move into a group with extended rights; the price, duration and automatic renewal are configured; a payment profile is created first

The «User upgrades» section

source, checked 2026-07-28

payments go through Stripe, PayPal, BrainTree and 2Checkout; the profile is configured in Options > Service providers > Payment profiles

The geography of payouts is determined by those services, not by XenForo

source, checked 2026-07-28

Restrictions

discipline runs on points: a moderator issues a warning with a weight and an expiry period, and «warning actions» automatically apply restrictions or a ban once a threshold is reached

The «Warnings» section

source, checked 2026-07-28

anti-spam: checking registrants against the StopForumSpam database, DNS block lists (Tornevall DNSBL, for example), a registration timer, spam phrases with patterns such as «watch * online», and text checking through Akismet with submission to the moderation queue

The «Spam management» section

source, checked 2026-07-28

two CAPTCHA systems are available — reCAPTCHA and your own question-and-answer set — and only one works at a time

The «CAPTCHA» section

source, checked 2026-07-28

Legal

the engine ships with two documents for users — «Terms and rules» and «Privacy policy» — accepted at registration; their text is edited through the phrase system or replaced with a link to an external page

The site's rules are set by the forum's owner, not by XenForo

source, checked 2026-07-28

API access

the home page carries a link to developer documentation: https://docs.xenforo.com/api — the page opens and shows the marks of documentation

CORRECTED the previous version declared any address containing the word api or dev found on the home page to be a developer section. All 57 such records were checked by opening the address: 24 turned out to be documentation. See data/technical/dev-links-verified.tsv and docs/research/S195-догадка-по-адресу.md

source, checked 2026-07-28

the REST API was added in XenForo 2.1, is available at an address of the form <base URL>/api/, is enabled by default and is disabled with the line $config('enableApi') = false; responses are JSON and errors come back with codes in the 400 range

The REST API reference

source, checked 2026-07-28

there is no unauthenticated access to the API and users cannot issue themselves keys; keys are created only by a super administrator, and all super administrators receive an email about the creation; the key types are guest, user and super user (which can act on behalf of any user and bypass their permissions)

The «API keys» and «Key types» sections

source, checked 2026-07-28

the API is sliced into scopes of the form alert:read, alert:write, attachment:delete, conversation:read, media:delete_hard, node:write, profile_post:read; the sections cover forums, threads, posts, users, attachments, conversations, the media gallery, the resource manager, search, statistics, OAuth2 and oEmbed

The endpoint reference and the OAuth2 schema

source, checked 2026-07-28

Languages

the interface language of the home page: en-US

The language is taken from the markup attribute, the versions from hreflang

source, checked 2026-07-28

the entire interface is translated through a system of «phrases»; a single installation can hold several languages, the visitor chooses their own, and the administrator sets the default and can forbid the choice of particular languages

The «User interface text: Language» section

source, checked 2026-07-28

Sources diverge: in facts.tsv the xenforo interface language is recorded as en-US from the address https://xenforo.com/; today that address serves not the site but a Cloudflare check page, which also carries lang="en-US" — the value in the database may relate to a placeholder

The discrepancy is recorded as a separate entry as required by the task

source, checked 2026-07-28

Catalogue section: all similar See also: catalogue index · region: Western Europe · scheduler comparison · find by situation · platform restrictions