📻 Opticweb Intelligent Security & Bot Protection – PrestaShop Integration

A custom micro-tool for high-performance security measures created to address the need for effective protection against ongoing threats, ensuring comprehensive security for our e-commerce shops. An example of a Cloudflare solution that provides an exceptional first layer of protection, the free edition protects from botnets and proxies that attempt to conceal their origin IP from the server.

The integrated module is designed to offer in-app protection precisely where it is needed. It is based on well-known principles of Opticweb’s philosophy: clear codes, minimal overhead, and exceptional functionality.

The Challenge: Bots spam the server, inflating analytics, stealing data (scraping), and flooding forms with spam, thus degrading the performance of the e-shop for legitimate buyers.

The Solution: We implement a system of 10 specific checks that identify and block bad traffic at the entry point of the application. The module automatically recognises the official crawlers (Google, Bing) via Reverse DNS to avoid negatively affecting SEO, while it will either present a JS Challenge or issue an Instant Ban for any bot attempting to exploit vulnerabilities.

Technical Characteristics

• 10-Step Execution Order: The strict filtering mechanism includes (IP Whitelist/Blacklist, Verified Search Bots, Active Bans, Path Scan, Form Protection, Verified Cookie, Rate Limiting, Country Block, Datacenter Detection).

• Path Scan Defense & Honeypots: Automatic, arbitrary bans (Instant Ban) on IPs suspected of trying to scan sensitive paths (e.g. .env, /wp-admin/, .git).

• Automated JS Challenges: Designed to verify traffic through specialized JavaScript challenges for headless scrapers and cURL bots, while easily incorporating CAPTCHA for legitimate users.

• Form Spam Protection: Triple-layer protection for forms (honeytrap field, timing check < 3s, interaction check) which prevents the checkout from being compromised.

• Datacenter IP Detection & Rate Limiting: Identification and limitation of requests from hosting providers (AWS, Hetzner, OVH, etc.) while protecting against DDoS attacks.

• Cloudflare Turnstile Integration: Complete and proactive integration with the invisible API of Cloudflare for maximum security of forms.

• Back Office Control Panel: Complete management of Active Dynamic Bans and Security Logs (up to 100 events with detailed information such as IP, location, user agent, and reasons).

• Zero Server Load: All IP lookups are stored locally for 24 hours to prevent the frequency of external API calls for each request.

The result is a complete system of protection, fast and efficient for PrestaShop installations, with full control and analytics from the Back Office.