BotBlocker Bot Blocker for OpenCart

BotBlocker is a practical OpenCart security module designed to protect your store from unwanted traffic, malicious bots, spammers, scrapers, and suspicious visitors by IP address. It automatically checks incoming storefront requests, validates IPs through external anti-abuse services, and based on the result either allows access, blocks the visitor, or shows a Captcha challenge. This helps reduce server load and protect your store’s forms, content, and infrastructure from automated attacks.

What the module is for

BotBlocker is built for store owners who want to stop dangerous connections early and control who is accessing the website. The module is especially useful if your store faces scanning attempts, spam bots, mass requests, fake visits, or suspicious repeated activity from the same IPs.

The module works on the OpenCart catalog side and checks visitors before they fully interact with the website, making protection more effective.

Main features

• automatic visitor IP checking;
• support for Project Honey Pot and AbuseIPDB;
• blocking based on external reputation checks;
• optional Captcha Challenge page instead of immediate denial;
• 403 Forbidden response for blocked requests;
• IP access history storage;
• daily hit statistics logging;
• manual allow, block, and delete actions from the admin panel;
• log filtering by date, bot type, and threat categories;
• multi-store support via store-specific settings;
• automatic OpenCart event registration on install.

What data the module works with

BotBlocker processes not only the IP address itself, but also additional threat indicators that can later be used for analysis and manual access management.

• visitor IP address;
• bot type data;
• suspicious activity indicators;
• harvester and comment spammer signals;
• threat score;
• AbuseIPDB report categories;
• IP usage type;
• domain related to the IP;
• total reports count;
• IP version;
• allow/block status;
• daily request counters.

Supported blocking scenarios

1. Check via Project Honey Pot

In this mode, the module uses DNSBL lookup and determines whether the IP belongs to a search engine bot, suspicious source, harvester, or comment spammer. The administrator can flexibly choose which traffic types should be blocked.

• search engine bots;
• suspicious sources;
• harvester bots;
• comment spammer bots;
• specific search engines by identifier;
• IPs exceeding the allowed threat score;
• IPs with outdated reputation beyond the trusted days limit.

2. Check via AbuseIPDB

If AbuseIPDB is selected, the module queries the service API and retrieves extended IP reputation details. The data is saved into separate database tables, and the administrator can review threat categories and category-based statistics.

1. The module sends the IP for API verification.
2. It receives report details, score, and whitelist status.
3. The result is stored in the database.
4. Threat categories are saved.
5. Access is allowed or blocked depending on the result.

Module advantages

• Automated protection without constant manual checks;
• Flexible configuration for different threat models;
• Convenient analytics for IPs and attack types;
• Lower load from bots and scanners;
• Storefront security for forms and content;
• Manual control over disputed IPs from the admin area;
• Two verification sources to match your protection strategy.

What is available in admin

The admin panel offers not just a few switches, but a full toolkit for access control and traffic analysis.

• enable or disable the module;
• choose a verification service: HoneyPot or AbuseIPDB;
• enable Captcha for disputed or blocked IPs;
• enter API keys for each service;
• set the maximum trusted data age;
• set the maximum threat score threshold;
• select bot types to block;
• select search engines to restrict;
• select AbuseIPDB attack categories;
• view IP access logs;
• charts by bot type and threat category;
• bulk delete records;
• manual Allow and Block actions.

Usage examples

Example 1. If your store is regularly scraped for product data and prices, you can enable HoneyPot and block suspicious bots with a threat score limit.

Example 2. If the site receives mass login attempts, form scans, or SQL injection probes, AbuseIPDB is a strong choice with categories like Brute-Force, SQL Injection, Bad Web Bot, and Web App Attack.

Example 3. If you do not want to lose real visitors because of a disputed IP reputation, enable Captcha Challenge instead of hard blocking. A human visitor can verify access and continue browsing.

Configuration tips

• for a safer start, begin with Captcha instead of full denial;
• if you need a simple anti-bot filter, use Project Honey Pot;
• if you need detailed threat categorization, choose AbuseIPDB;
• review logs and traffic statistics regularly;
• manually check IPs that may have been blocked by mistake;
• for high-traffic stores, analyze daily hit trends;
• after installation, make sure the API key is added and the module is enabled for the required store.

Summary

BotBlocker is a useful OpenCart security module that combines automatic IP verification, integration with external reputation databases, Captcha challenge, visit logs, and manual access management. It helps keep bot traffic under control, reduce attack risks, and maintain stable store performance without extra routine.