Shopping Cart
When bots, not customers, fill up your server
More and more PrestaShop shops end up in the same situation: the server suddenly slows down, customers get 500 or 503 errors, and the hosting provider only sees that resources ran out. Behind it are bots that call the filtered category pages and the search en masse, with random filter combinations. Every such request triggers a heavy database query, and caching doesn't help, because every combination is new.
In a real attack whose logs the module is built on, 478,000 filtered requests arrived from 364,000 different IP addresses in a single morning, and about 60% of the requests ended in an error. IP blocking can't stop this, because each address typically sends only one or two requests.
WSC Bot Guard doesn't block IPs; it watches behaviour. Attack requests show a telltale pattern (they pretend to be browsers but arrive without a referer or cookie), while a real customer clicks the filter from the shop's own page. The protection is built on this difference.
Why it's worth it
🛡️ A browser check that lets humans through
A suspicious filtered, search or login request gets a split-second check page of about 1 KB. It sets a signed cookie with JavaScript and reloads the same page with its filters. A human barely notices, but a bot that doesn't run JavaScript gets no further, and the heavy filter query never starts.
✅ Doesn't bother customers or search engines
No check for visitors who have been to the shop before, who arrive from a newsletter, ad or Google result, who click a filter inside the shop, or for Google's and Bing's crawlers. The module doesn't touch normal, unfiltered pages. You can also always allow the IP addresses of your office, price comparison sites or monitoring service.
🧪 Starts in trial mode
After installation the module stops no one; it just counts whom it would have stopped. After a few days the numbers show exactly what it would catch in live mode, and you only switch it on once they've convinced you.
⚡ Server-level protection for big surges
If the surge is so large that even starting PrestaShop overloads the server, one button writes the same filtering into .htaccess. Suspicious requests are then caught by the web server and PHP never starts. The module makes a backup first, checks with three test requests that the shop works, and if any test fails it restores the original file immediately.
📊 See what's happening in your shop
The back office shows, hour by hour, how much traffic is suspicious, search engine, other bot and human, how many requests ended in an error, and how much PHP time they used. You also get the most frequent User-Agents and networks, with samples. So when the shop slows down, you don't have to guess: you see the cause.
🔔 E-mail alerts
If suspicious requests exceed your threshold within 15 minutes, the module sends an e-mail with the details: a table by class, top User-Agents and networks, sample URLs. At least an hour passes between alerts, so your inbox isn't flooded.
🪶 Doesn't weigh down your shop
Each request runs a single fast database operation, and writing happens after the response is sent. During an attack only a sample of the details goes into the database, so the log doesn't fill it up. If anything fails, the request runs unchanged: the module never stops the shop because of its own error.
Full protection with three modules
Bot Guard protects against overload attacks. The free WSC Security Check shows your shop's vulnerabilities, and the Pro version fixes them with one click. If you'd rather leave it to us, we set it up and monitor it as part of the WSC maintenance package.
Good to know
- The module is tuned for ps_facetedsearch filters and the PrestaShop search. Parameters of other filter modules can be added in the settings.
- Server-level rules need Apache or a LiteSpeed server that reads .htaccess. Tested on Apache 2.4; under nginx only the PHP-level protection works.
- For analysis, the module logs the IP address and User-Agent of suspicious requests on your own server, for up to 7 days. It sends no data outside.
- Behind Cloudflare or another proxy, the real IP header must be set in the module.
Technical details
- PrestaShop 1.7.1 – 9.x
- PHP 7.1 or newer
- No overrides, hooks only
- Multistore: statistics per shop and combined
- Hungarian back office
- Updates via the Webstart Updater module
Bots get stuck, customers don't. And your shop stays fast even under attack.