The X-Cart Block Users by IP/Country/User Agent add-on protects your store from bots and fraudulent users by limiting or completely restricting access to it with the help of flexible settings and filters, taking into account the user IP address and behavior.
Follow the Installing Add-ons from the X-Cart App Store guidelines to install the add-on.
After the installation, proceed to the add-on settings page to configure it.
The "Block Users by IP/Country/User Agent" add-on settings page includes three subsections:
Adjust the settings in these subsections according to your needs.
IP-Based Access Control
This section allows a store admin to configure the following settings:
Access control mode: Select the access mode in the dropdown. Your options are:
Allow access from all but blacklisted IP addresses - This option allows access to the store from any IP address except for the blocked ones and will work even if there are no IP addresses on the backlist.
Allow access from IP addresses in the white list - This option allows access to the store only from the permitted IP addresses and will NOT work if there is no safelist with IP addresses.
You have to create a safelist with IP addresses in the Store Setup -> Access Filters section before you can use this mode. See more info about access filters here.
Link to bypass the IP-based access control system: Your store generates this link automatically.
Bot Protection
This section allows a store admin to configure the following settings:
A visitor should be identified as a bot if: Typically, a bot takes much less time to "view" a page than a human does. So we can try to tell whether a user is a bot or a human based on the average time they spend viewing a page. You can use this setting to specify the page viewing speed used for your store site to distinguish bots from humans.
A visitor should be identified as a bot if the length of the period between add to cart action and an attempt to buy is less than X seconds: Typically, compared to a human, a bot takes much less time to attempt to purchase an item after adding it to the shopping cart. We can distinguish bots from humans based on the duration (in seconds) between the two actions by the same user. You can use this setting to specify the minimum amount of seconds between an add to cart action and an attempt to buy for a user to be considered human. Any value less than that will allow the system to identify the user as a bot.
You will have to empirically find the time and number of page values for the above settings as they will differ depending on a particular site, server environment, etc.
Allow bots to make purchases: Toggle the setting off if you want to prevent bots from making purchases at your store.
Detect search engine bots via the user agent: With this option enabled, any visitor found to be a type of "crawler" according to https://browscap.org/ will be blocked automatically. I this option is disabled, the add-on will sort the visitors by the settings "A visitor should be identified as a bot if" and "A visitor should be identified as a bot if the length of the period between add to cart action and an attempt to buy is less than."
Add bot IP addresses to blacklist: Decide whether you want to add bot IP addresses to your backlist automatically or not, and select one of the options.
Important: When making your choice, please keep in mind that any option starting with "Forbid …" will automatically add any bot IP addresses to the blacklist (including both the bad bots programmed to perform a variety of malicious jobs AND the good bots that help in creating the required visibility of websites on the internet). It will also limit access to the store pages from the blocked IPs according to the option you selected. So, for example, if you set the value to "Forbid access to the entire site," your store site will become inaccessible to ANY bots, and, as a result, it will NOT be indexed by any good bots either.
Address-Based Protection
This section allows a store admin to configure the following settings:
Restrict purchases based on buyer address: Specify whether buyers whose billing address is different from their shipping address should be prevented from making purchases at your store.
Restrict purchases based on buyer location: Specify whether buyers whose billing address does not match the IP address they are using should be prevented from making purchases at your store.
Be sure to save your settings by clicking Submit.
Read on: