Bot & Country Blocker
Add-on ID: kv_bot_country_blocker · Edition: CS-Cart & Multi-Vendor · Latest version: 1.0.1 · Compatible with: CS-Cart & Multi-Vendor 4.17.2 – 4.21.x, PHP 7.4 – 8.3 · Changelog: view
Bot & Country Blocker stops bad bots, AI crawlers, scrapers, vulnerability scanners and unwanted countries before CS-Cart builds a page. Every storefront request is checked right after routing, from a compiled rule file, so a normal visitor costs no extra database query and a blocked bot never reaches the page code.
It starts in learning mode: for the first days every rule only writes “would block” entries to the log, so you can see what would happen before anything is blocked.
Key features
Section titled “Key features”- Countries: block, challenge, redirect or restrict the checkout for selected countries, or for every country except the selected ones. Works out of the box with the GeoLite2 country database that CS-Cart ships; free DB-IP Lite or MaxMind GeoLite2 updates in one click; Cloudflare’s CF-IPCountry header is used when the request comes through Cloudflare.
- IP addresses and networks: IPv4 and IPv6 addresses, CIDR ranges and ranges, public list URLs refreshed daily, AS numbers and a built-in preset of 50+ hosting, cloud and server providers.
- Built-in bot list with one switch per bot: AI training crawlers (GPTBot, ClaudeBot, CCBot, Bytespider, meta-externalagent, Amazonbot and more), AI assistants, SEO crawlers, scripts and HTTP libraries, headless browsers and vulnerability scanners.
- Search engines stay safe: Googlebot, Bingbot, Applebot, YandexBot and Baiduspider are verified by reverse and forward DNS and always allowed; impostors are blocked.
- Rate limits per IP address (token bucket) for the whole store or for expensive pages such as search and filters, with an optional temporary ban.
- Honeypot paths (/wp-login.php, /.env, /xmlrpc.php and others) that ban scanners, and the compare attack fix: “add to comparison / wish list / cart” links called without a session cookie.
- Empty user agents and browser impostors (a browser user agent without the Accept-Language header every browser sends).
- Actions per rule: block (styled, editable 403 page), challenge (a one-second JavaScript proof of work, no captcha and no third-party service), redirect, checkout only, allow, log only.
- Dashboard, log and CSV export: decisions per day, top countries, bots, rules and IP addresses, filters, references on the block page, retention policy.
- AI crawler policy in robots.txt and Cloudflare WAF expressions for the same rules at the edge.
- You cannot lock yourself out: administrator IP addresses are allowed automatically, the admin panel is never checked, and an emergency file switches everything off.
Compatibility
Section titled “Compatibility”- CS-Cart and Multi-Vendor 4.17.2 – 4.21.x (tested on CS-Cart 4.17.2 and Multi-Vendor 4.17.2; Multi-Vendor 4.21.2 auto-tested: unit, HTTP, licence, lifecycle and full page cache runs).
- PHP 7.4 to 8.3, depending on your CS-Cart version.
- Works with any storefront theme: the add-on adds no storefront markup; its block and challenge pages are self-contained.