Bot & Country Blocker changelog

All notable changes to Bot & Country Blocker (kv_bot_country_blocker) are documented here. The format follows Keep a Changelog and the project uses Semantic Versioning.

[Unreleased]

[1.0.1] - 2026-10-30

Fixed

Full page cache (CS-Cart 4.21): the add-on tables (rate limit buckets, log, statistics, bans, DNS cache, administrator IP addresses, rule hit counters) are ignored as cache tags, so storefront visits no longer purge the page cache.

[1.0.0] - 2026-10-29

Added

Storefront check right after routing from a compiled rule file: no database query for normal visitors.
Rules by country (in / not in the list; CS-Cart’s GeoLite2 database, DB-IP Lite or MaxMind GeoLite2, Cloudflare CF-IPCountry), IP addresses and ranges (IPv4/IPv6, public list URLs refreshed daily), networks (ASN) with a hosting preset, and user agents (text or regular expressions).
Built-in bot list with an action per bot: AI training crawlers, AI assistants and AI search, SEO tools, scripts and headless browsers, vulnerability scanners.
Search engine verification by reverse and forward DNS (Googlebot, Bingbot, Applebot, YandexBot, Baiduspider); fake crawlers are blocked.
Rate limits per IP address (token bucket) for the whole store or listed pages, honeypot paths with temporary bans, the compare attack fix (session-less actions), empty user agents and browser impostors.
Actions: block (styled, editable 403 page), JavaScript proof-of-work challenge, redirect, checkout only, allow, log only.
Learning mode (on after install), dashboard with a daily chart and top lists, log with filters and CSV export, retention.
IP tester with a decision trace, GeoIP database upload and download, Cloudflare WAF expressions, AI crawler group in robots.txt.
Administrator IP addresses allowed automatically; emergency switch file; payment notifications always allowed.
Multi-Vendor (marketplace-wide rules) and CS-Cart Ultimate (rules for all storefronts and per storefront).
Domain-bound license check and self-healing upgrades.