Bots ban

Bots ban

Bots ban

Some of the robots that crawl an online store give it nothing in return: SEO services collect links and texts for their own databases, scrapers download the catalog page by page. They load the server but bring neither customers nor search rankings.

The add-on closes the storefront to such robots by their User-Agent — the string a browser or a bot introduces itself with on every request. You enter a list of bot names, and on every storefront request the add-on checks the visitor's User-Agent against it. If the User-Agent contains one of the names from the list, the visitor gets a 403 Forbidden response with the text You are forbidden! instead of the page.

  • There is a single setting — the bot list; it already contains well-known SEO crawlers: MJ12bot, SemrushBot, AhrefsBot, DotBot, SEOkicks-Robot, Ezooms.
  • The add-on never checks the admin panel, so a wrong list cannot lock you out of it.
  • The check runs before the page is built, so a blocked bot puts almost no load on the server.
Compatibility

The add-on works on CS-Cart and Multi-Vendor starting from version 4.3.1 and supports the CS-Cart, CS-Cart Ultimate, Multi-Vendor, Multi-Vendor Plus and Multi-Vendor Ultimate editions. Since version 1.3.0 the add-on is compatible with PHP 8.3.

  • CS-Cart Ultimate with several storefronts and Multi-Vendor Ultimate with several storefronts — the bot list is set for each storefront separately (see General settings).
  • Multi-Vendor — there is one list for the whole marketplace; vendors have no access to the add-on page.

The add-on outputs nothing on the storefront, so it does not depend on the theme.

Add-on installation

After success payment, your order will be automatically marked as Paid within a few minutes. Once order changed to Paid status - add-on License activation passed success and you will received an e-mail with confirmation the receipt of payment and a second e-mail with a  download add-on link. You can also download the add-on in our License Management section of our website. To install the add-on on your website, please follow these steps:

  1. Download the latest version of the add-on on our website in the "License Management" section or via the link sent by e-mail.
  2. Go to Add-ons → Manage Add-ons and in the gear button, select Manual Installation.
  3. Select the downloaded file and complete the installation of the add-on.

Add-on installation is completed. To go to the add-on settings page, select the installed add-on in the top menu Add-ons → CS-Commerce add-on

Add-on management

The add-on page is opened in the admin panel via Add-ons → CS-Commerce Addons → Bots ban. The link to the add-on in the Add-ons → Manage add-ons list leads there as well.

The page has a single tab, General settings, with the Bad bots field, and the sidebar on the right holds the Add-on upgrades and Support and rating blocks.

Access to the page is controlled by a separate privilege group, Manage Bots ban: the view privilege lets an administrator open the page, the manage privilege lets them save the list. These are store administrator privileges; Multi-Vendor vendors do not see the page.

General settings

Bad bots

The list of bots that are denied access to the storefront. After installation it contains:

MJ12bot, SemrushBot, mj12bot.com, AhrefsBot, DotBot, SEOkicks-Robot, Ezooms

You can add names to the list and remove them. Changes take effect as soon as you click Save.

How to fill in the list

  • Separator — a comma or a line break, and they can be mixed. The field tooltip mentions only the comma, but since version 1.3.0 every name can also go on a new line.
  • Spaces around a name are dropped: AhrefsBot, AhrefsBot and AhrefsBot, are the same.
  • Empty entries — two commas in a row, a trailing comma, an empty line — are skipped and never match anything.
  • Letter case does not matter: ahrefsbot blocks AhrefsBot too.
  • Partial match. A name from the list is searched for inside the whole User-Agent rather than compared with it as a whole. For example, the User-Agent of the Ahrefs bot looks like Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/) — the name AhrefsBot is enough to block it.
Put a bot's unique name in the list, not common words. The string "bot" matches the User-Agent of Googlebot and YandexBot and closes the store to search engines, and the string "Mozilla" is in the User-Agent of almost every browser — the storefront would be closed to all customers.

A bot's name is usually visible in the web server access log (the User-Agent field) or on the page linked from its User-Agent, like ahrefs.com/robot in the example above.

Several storefronts

In CS-Cart Ultimate and Multi-Vendor Ultimate with several storefronts, the list is stored for each storefront separately. Choose the storefront in the switcher at the top of the page and save the list for it. In the All stores mode (All storefronts in Multi-Vendor Ultimate) the field cannot be edited; to write one value into all storefronts at once, click the icon next to the field, then enter the list and save.

How the add-on blocks requests

The check is built into the CS-Cart storefront startup and runs on every storefront request, AJAX requests included:

  1. The add-on takes the User-Agent header of the request.
  2. It splits the Bad bots list into names by commas and line breaks, dropping spaces and empty entries.
  3. It looks for each name inside the User-Agent, ignoring letter case.
  4. On the first match it responds with 403 Forbidden and the text You are forbidden! and stops processing the request. If nothing matches, the page opens as usual.

Not checked:

  • the admin panel — whatever the list contains;
  • requests without a User-Agent — the add-on lets them through;
  • files the web server serves on its own, without running CS-Cart: images, CSS, JavaScript.
The add-on trusts the name a bot gives. It closes the storefront to bots that honestly state their name — the way the SEO crawlers from the default list behave. A bot that pretends to be a regular browser cannot be told apart by its User-Agent; the Bot Protection add-on, which checks the browser itself, protects against such bots.

The "Add-on upgrades" block

In the sidebar of the add-on page, the Add-on upgrades block shows which version is installed and whether an update is available:

  • Latest version installed — there is nothing to update;
  • Update available — a new version is out and the subscription allows installing it; the Update button opens the CS-Cart Upgrade center with CS-Commerce add-ons;
  • Version … released — a new version exists, but no update is delivered for your installation; the block suggests contacting technical support;
  • Subscription is ending — 30 days or less of the update subscription are left; the Prolongate subscription button appears;
  • Upgrade subscription expired — new versions become available after the subscription is renewed.

The block also shows the end date of the update subscription and a Changelog link to the add-on's version history.

If the block says License error, the add-on could not verify the license for the current domain — check the license details via the link in the message. License server is unreachable means the store cannot connect to api.cs-commerce.com; this does not affect bot blocking, but if the connection has been down for several days, check that outgoing access to this address is not blocked on the server.

The update procedure itself is described in the Upgrade an add-on section.

Troubleshooting

The storefront says "You are forbidden" to everyone

If every visitor sees the You are forbidden! message, not only bots, the cause is almost always the Bad bots list:

  • An add-on version before 1.3.0 on PHP 8. In older versions an empty list entry — a trailing comma, two commas in a row, an empty list — matched any User-Agent, and on PHP 8 the storefront was closed to everyone. Update the add-on to 1.3.0, which skips empty entries. If you cannot update right away, remove the trailing comma and empty entries from the list.
  • A name that is too general. Strings like bot, Mozilla, Windows, Chrome are present in the User-Agent of regular browsers. Replace them with full bot names.

The admin panel stays accessible, so you can fix the list at any time.

The site has disappeared from search

Check whether the list contains a name that matches a search engine robot: Googlebot, YandexBot, bingbot, or the common word bot. Remove it and save the list.

A bot from the list keeps coming

  • Compare the name in the list with the User-Agent from the access log: the name must be contained in the User-Agent in full; extra characters or a typo cause a miss.
  • If the log shows the bot requesting only images, CSS or JavaScript, these are files the web server serves without CS-Cart — the add-on does not check them.
  • On Ultimate with several storefronts, check that the list is saved for the right storefront.
  • If the changes still do not apply, clear the CS-Cart cache.

Upgrade an add-on

In order to have access to add-on upgrades, you must have an active upgrade subscription. If the subscription period has expired, you will only have access to upgrades released before the expiration date of your subscription. You can renew your upgrades subscription in the "License Management" section on our website.

The add-on supports instant upgrades via the CS-Cart Upgrade Center. The built-in CS-Cart Notification Center (bell) will notify you about new versions release of the add-on. Upgrades via Upgrades Center will allow you to switch to a newer version without losing add-on data and settings.

Before start an upgrade process, it is highly recommended to make a full backup of the site (database and files) of your store using the server or hosting methods.

 Upgrade through the Upgrade Center

  1. In the top menu, go to Administration → Upgrade Center;
  2. In the gear menu, click "Refresh available upgrades"
  3. Find and add-on on list of available upgrades and click the Download button and than Install button;
  4. Follow all the instructions that will be shown during the upgrade process;
  5. It is recommended to clear the CS-Cart templates cache after the upgrades are installed by deleting the var/cache folder on your server or adding the ctpl parameter to the address bar (example: https://domain.com/admin.php?ctpl).

Addon Reinstallation by uninstall old and install new:

Reinstalling an add-on means deleting the add-on's settings and data. Reinstallation will allow you to get a clean installation of the latest addon version. To reinstall the add-on with saving the add-on settings and data, please contact us via our Support Center to provide this service.

To completely reinstall an add-on without saving data, follow these steps:

  1. Go to Add-ons → Manage add-ons and find the old installed add-on.
  2. Click the delete button in the gear menu of the add-on.
  3. Download the latest version of the add-on on our website in the "License Management" section.
  4. Go to Add-ons → Manage add-ons and in the gear menu select Manual Installation. Select the previously downloaded file and complete the installation of the add-on.

Technical support

The technical support of the add-on is already included in its price. Before contacting the support center, please make sure you are using the latest released version of the add-on. Old versions of the add-on are not supported by technical support.

To use our technical support, follow these steps:

  1. On our support center site https://helpdesk.cs-commerce.com/, log in with your account;
  2. Click on the "Create ticket" button;
  3. Fill in all the required fields and create ticket (you will receive a confirmation email);
  4. Expect a response from a specialist (a notification will be sent to your e-mail about the response) in accordance with the regulations of the technical support service.

If you have not received an answer within the time frame specified in the regulations, write us a message to the e-mail [email protected] with the subject of the ticket and we will try to resolve your issue as soon as possible.

Technical support via chat on the site, direct phone calls or e-mail letters is not provided. All help discuss goes through the support center. Carefully study the documentation for the add-on and the terms of technical support before creating a ticket.

Limitations and Warnings

We recommend that you familiarize with the general restrictions:

  1. Fragments of code or some files of an add-on may have a private (encoded) part. The coded part does not create problems on add-on customizations;
  2. The add-on will work only on those domains that are specified in the user's license. If you try to use the solution the domains of which are not included in the license, the add-on will be automatically disabled;
  3. Installing on local machines is not allowed by the licensing system. For the add-on to work on an additional domain (alias), specify this alias on the license management page. Up to three aliases are allowed per domain for testing and development purposes. You can change the main license domain yourself on the license management page.
To have possibility to add or change license domains and aliases, the upgrade subscription must be active. To change the license domain of an expired upgrades subscription, you must first renew your subscription.

 

Changelog

Version 1.3.0 of October 14, 2026

  • Added PHP 8.3 compatibility.
  • Fixed visitor blocking: with an empty bot list or a trailing comma in it, the storefront became closed to every visitor with a "You are forbidden" message on recent PHP versions.
  • Bot names can now also be separated by line breaks, and matching is case-insensitive.
  • Updated the add-on core: improved the "Add-on upgrades" block in the settings and made the connection to the update server more reliable.

Version 1.2.1 of May 23, 2025

  • Basic security updates of the add-on.

Version 1.2.0 of December 11, 2023

  • Basic security updates of the add-on.

Version 1.1 of July 22, 2022

  • Added a built-in upgrade center.
  • Basic security update.

Version 1.0 of October 25, 2018

  • The first release of the add-on.