Access Blocker Support Thread

This is the support thread for the soon-to-be-published Access Blocker plugin. This drop-in plugin provides some captcha-like blocking of accesses to your store's contact_us, create_account and login pages' processing.

Unlike other captcha-type handling, Access Blocker works behind the scenes to determine whether the IP address, email-address and/or contact-us comments should result in an action (e.g. creating a contact-us message or creating an account) being blocked. The plugin can be configured to use the API provided by https://ipdata.co, which provides additional information associated with an IP address (like its country-of-origin and whether it's been previously reported as a threat).

The plugin has been validated on Zen Cart 1.5.5 and 1.5.6 variants, using the built-in notification points for the possibly-blocked pages. I've been using it on my website for the past couple of months, with a significant drop in spam.

I'll update this thread once I've posted the plugin to the Zen Cart plugins for review.

Once reviewed, here's the plugin's Zen Cart download link: https://www.zen-cart.com/downloads.php?do=file&id=2237

You can get a sneak peek by downloading from the plugin's GitHub repository: https://github.com/lat9/access_blocker/releases/tag/v1.0.0

lat9:

Once reviewed, here's the plugin's Zen Cart download link: https://www.zen-cart.com/downloads.php?do=file&id=2237

You can get a sneak peek by downloading from the plugin's GitHub repository: https://github.com/lat9/access_blocker/releases/tag/v1.0.0
That was fast (thanks @swguy!); the plugin is now available for download from its Zen Cart download link.

Will this plugin have any effect on site performance. I installed it and obtained a key. I am not sure though how to know if it is working or not. Is there a way to test it to see if it is actually working

I figured it out

As an example I used https://api.ipdata.co?api-key=XXXXXXXXXXXXX taken from the signup email from ipdata.com.

Though I just installed it and click on my example url it has a count of 450 and rising.

Hmm sees a little too fast if that number is correct.

Well i installed the plugin. 10 minutes later I get a spam email. As mentioned before i obtained the key. Does this module really block spam or is just a means gathering ip's.

I am having a hard time understanding how this plugin is supposed to work

chadlly2003:

Well i installed the plugin. 10 minutes later I get a spam email. As mentioned before i obtained the key. Does this module really block spam or is just a means gathering ip's.

I am having a hard time understanding how this plugin is supposed to work
The plugin, using the ipdata.co information returned, will block ***known ***'threats'. There are additional configuration settings where you can also block the access by country-code (as returned by ipdata.co), an ip-address range ... and more.

The approach I use for my installation of the plugin is, when I receive a rogue email, determine whether to *totally *block the access (via separate edit of the site's .htaccess file) or to simply block the contact-us/create-account/login pages' access by updating the plugin's configuration.

I've just submitted v1.0.1 of Access Blocker for review and will post back when it's available for download.

 This release contains changes associated with the following GitHub issues:

#1: Added missing license.
#3: Correct log, indicating the IP address that was denied.
#4: For site performance, only request the ipData information on pages being filtered.
#5: Modify configuration settings to use a textarea box (allows admins to see what's been previously entered).

v1.0.1 is now available for download.

Thanks for the plugin.
Just wondering if there would be a way to block by the Company name field, in account creation?
Eg. My 1000+ fake accounts all use 'google' as the company name.

mcpisik:

Thanks for the plugin.
Just wondering if there would be a way to block by the Company name field, in account creation?
Eg. My 1000+ fake accounts all use 'google' as the company name.
I've created a GitHub issue (https://github.com/lat9/access_blocker/issues/7) to track your request.

I've just submitted v1.1.0 of the Access Blocker for review by the Zen Cart plugin moderators and will post back when it's available for download.

 This release contains changes associated with the following GitHub issues:

#6: Don't require ipdata.co access if otherwise blocked
#7: Add blocking by company name during the create-account process

lat9:

I've just submitted v1.1.0 of the Access Blocker for review by the Zen Cart plugin moderators and will post back when it's available for download.

 This release contains changes associated with the following GitHub issues:

#6: Don't require ipdata.co access if otherwise blocked
#7: Add blocking by company name during the create-account process
Now available for download: https://www.zen-cart.com/downloads.php?do=file&id=2237

Hi Cindy - thanks for this great plugin - likely a dumb question but can we use the one single API key from ipdata.co for multiple websites?

cheers,
Mike

Thanks, Mike. You'll need to contact ipdata.co regarding the usage of that API key's use on multiple sites.

lat9:

Thanks, Mike. You'll need to contact ipdata.co regarding the usage of that API key's use on multiple sites.

Hi Cindy, ipdata.co say 1 key is fine for multiple sites - quota limit per key (free version) is 1500 daily.

cheers, Mike

Hmm.... not having much luck so far. Entered my API key and turned on Access Blocker, then entered country codes CN,HK (the source of the bad traffic.)

However, there's no downward movement in Who's Online.

Also tried setting the top 2 octets of the IP and even the Organization for good measure, but not seeing any changes. Getting new sessions by the second from the bad guy address.

I may have misunderstood the design intent. If this plugin only blocks access to the create account (etc.) pages, I wonder if it would be possible to extend it to block access to ALL pages based on the configuration.

swguy:

I may have misunderstood the design intent. If this plugin only blocks access to the create account (etc.) pages, I wonder if it would be possible to extend it to block access to ALL pages based on the configuration.
Yes, Access Blocker is a pseudo-recaptcha in that it does all its blocking at the server level (nothing for the script-kiddies to grab on).

What you're looking for, IMO, is an automatic .htaccess generator (dangerous to do on the fly for busy shops).

I quite agree it would be risky to attempt to update the .htaccess file as part of storefront processing (because of the danger of having it done simultaneously by multiple threads). But what if the logic was to add these bad IPs to a table, and have a separate process regenerate the .htaccess from a cron job ?