The X-Cart add-on Block Users by IP/Country/User Agent protects your store from bots and fraudulent users by limiting or completely restricting access to it with the help of flexible settings and filters, taking into account the user IP, address and behavior.
To install the add-on, follow the guidelines from the section Installing Add-ons from the X-Cart App Store.
After the add-on has been installed, proceed to the add-on settings page to configure it.
The Block Users by IP/Country/User Agent add-on settings page includes 3 subsections: IP based access control, Bot protection, and Address based protection.
Adjust the settings in these subsections according to your needs.
IP based access control
Access control mode: Select the access mode in the dropdown. Your options are:
1. Allow access from all but blacklisted IP addresses - This option will allow access to the store from any IP address except for the ones that are blacklisted and will work even if there are no IP addresses on the backlist.
2. Allow access from IP addresses in the white list - This option will allow access to the store only from IP addresses that are whitelisted and will NOT work if there is no whitelist with IP addresses. (You have to create a whitelist with IP addresses in the Store setup -> Access filters section before you can use this mode).
Link to bypass the IP based access control system: This link is generated automatically.
A visitor should be identified as a bot if: Typically, a bot takes much less time to “view” a page than a human does. So we can try to tell whether a user is a bot or a human being based on the average time they spend viewing a page. You can use this setting to specify the page viewing speed used for your store site to distinguish bots from humans.
A visitor should be identified as a bot if the length of the period between add to cart action and an attempt to buy is less than X seconds: Typically, compared to a human, a bot takes much less time to attempt to buy an item after adding it to the shopping cart. We can distinguish bots from humans based on the duration of the time period (in seconds) between the two actions by the same user. You can use this setting to specify the minimum amount of seconds between an add to cart action and an attempt to buy for a user to be considered human. Any value less than that will allow the system to identify the user as a bot.
The time and number of pages values for the above settings will have to be found empirically as they will differ depending on a particular site, server environment, etc.
Allow bots to make purchases: Toggle the setting off if you want to prevent bots from making purchases at your store.
Detect search engine bots via the user agent: With this option enabled, any visitor found to be a type of “crawler” according to https://browscap.org/ will be blacklisted automatically. Note that if this option is disabled, the add-on will sort the visitors by the settings “A visitor should be identified as a bot if” and “A visitor should be identified as a bot if the length of the period between add to cart action and an attempt to buy is less than.”
Add bot IP addresses to blacklist: Decide whether you want to add bot IP addresses to your backlist automatically or not, and select one of the options. Important: When making your choice, please keep in mind that any option starting with “Forbid …” will automatically add any bot IP addresses to the blacklist (including both the bad bots programmed to perform a variety of malicious jobs AND the good bots that help in creating the required visibility of websites on the internet); it will also limit access to the store pages from the blacklisted IPs according to the option you selected. For example, if you set the value to “Forbid access to the entire site,” your store site will become inaccessible to ANY bots, and, as a result, it will NOT be indexed by any good bots either.
Address based protection
Restrict purchases based on buyer address: Specify whether buyers whose billing address is different from their shipping address should be prevented from making purchases at your store.
Restrict purchases based on buyer location: Specify whether buyers whose billing address does not match the IP address they are using should be prevented from making purchases at your store.
Be sure to save your settings by clicking Submit.