ANTI-BOT AND FILTER ABUSE PROTECTION

Is your store slow for no apparent reason?

Many PrestaShop stores are being targeted by a type of attack that slips past standard protections: thousands of requests to product filters (?q=Brand-…), each coming from a different IP address. Every filter combination forces PrestaShop into a heavy database query that is never cached. The result is a slow store, 500 and 504 errors, and an inaccessible back office.

Firewalls, fail2ban and per-IP rate limits are not enough: the requests come from residential proxy networks, with a different IP for each request, and they look like legitimate traffic.

How Bot Guard solves it

Bot Guard analyses every request before PrestaShop starts up, before the database is touched. It recognises abuse by what the request does, not just by the IP:

• Filters on the homepage, which no real customer uses, are blocked immediately.
• Filters with too many values or the same pattern coming from many different IPs are served a challenge.
• Attacks spread across multiple pages trigger a circuit breaker that protects the entire store for the duration of the attack.

The challenge is a Cloudflare-style browser verification: the customer's browser solves a small computation in under a second and proceeds to the requested page. Most bots do not even attempt it, and those that persist are blocked.

Your customers and Google won't notice a thing

• Real customers browse, filter and purchase without ever seeing a challenge.
• Genuine Googlebot, Bingbot and Applebot are verified via DNS and always allowed through. Anyone impersonating them is blocked.
• Payment return URLs, webhooks, cron jobs, web services and the PrestaShop 9 Admin API are automatically excluded.

Full dashboard in the back office

• Real-time store status: no activity, suspicious activity, or attack in progress.
• Charts for the last 60 minutes and last 24 hours, reasons for each block, most active networks and an event log.
• Email alerts when the store is under attack, with a configurable maximum number of emails per hour.
• Whitelist and blacklist (IP and CIDR), adjustable rules and CSV export.
• Log only mode, so you can see what would be blocked before enabling protection.

Install and go

It installs like any other module and configures itself automatically. No server configuration changes are needed, it works on any hosting environment (PHP-FPM or CGI), and if uninstalled, it leaves your store exactly as it was.

Compatibility: PrestaShop 1.7.6 to 9.x, PHP 7.2 to 8.4, multilingual stores, multistore setups and stores in a subfolder.