cefyn:
Thank you for your reply. I have had to resort to using under attack mode in Cloudflare, which has pretty well stopped all traffic. I need to make sure now that I have it setup to allow the traffic I do want to come through. I need Googlebot to read the site as a lot of business comes from being found in the Google search for local fancy dress shops.
Re: abnormal visitor numbers
I've been fighting what I believe is the same thing on my own store, and part of what looks like a traffic problem may actually be an identity problem. It's worth checking before you spend more time blocking IPs and countries.
Zen Cart core (1.5.x through current 2.2.x) overwrites $_SERVER['REMOTE_ADDR'] on every storefront page load with the result of zen_get_ip_address() — and that function trusts a set of client-suppliable request headers unconditionally: X-Forwarded-For, Client-IP, X-Forwarded, X-Cluster-Client-IP, Forwarded-For, Forwarded, CF-Connecting-IP. There is no check that a proxy you actually trust sent them. Any bot can put whatever it wants in those headers, and Zen Cart will believe it.
The consequences match your symptoms almost exactly:
-
whos_online inflation. whos_online counts "visitors" by that spoofable IP. A small number of bots rotating forged headers looks like hundreds of distinct visitors sitting on product pages. Your "800 visitors" figure may be a handful of machines wearing 800 masks.
-
IP blocking becomes whack-a-mole. Every IP you block, the bot just forges a new one on the next request. I watched bots on my store impersonate 127.0.0.1 and private ranges — addresses that can't possibly be real clients.
-
Country blocking leaks. Cloudflare's geo-block works on the true edge IP, so it does help — but only for traffic that actually goes through Cloudflare. If your origin server accepts connections from anyone (not just Cloudflare's published IP ranges), bots that have found your origin IP bypass Cloudflare entirely and spoof headers straight at Zen Cart. Given that your resource limits are being breached despite Cloudflare blocking, this is worth ruling out — ask your host whether the origin can be restricted to Cloudflare's ranges.
-
Even through Cloudflare, X-Forwarded-For isn't safe. Cloudflare appends the real client IP to any X-Forwarded-For the client sends — it doesn't replace it. Zen Cart reads XFF and can end up using the forged first value. The only header Cloudflare sets authoritatively is CF-Connecting-IP.
What I did on my server made a dramatic difference: since nothing proxies in front of it, none of those headers have a legitimate sender, so I strip them all at Apache before PHP ever sees them:
```php
<IfModule mod_headers.c>
RequestHeader unset X-Forwarded-For
RequestHeader unset Client-IP
RequestHeader unset X-Forwarded
RequestHeader unset X-Cluster-Client-IP
RequestHeader unset Forwarded-For
RequestHeader unset Forwarded
RequestHeader unset CF-Connecting-IP
</IfModule>
Overnight, my "unique visitor" counts collapsed to something believable, and per-IP blocking started actually sticking.
**Your setup needs one important adjustment:** you're behind Cloudflare, so do NOT strip `CF-Connecting-IP` — that's your real client IP. Strip the other six (this works in `.htaccess` on most shared hosts if mod_headers is enabled), lock your origin to Cloudflare's IP ranges if your host allows it, and make sure your stack derives the client IP from `CF-Connecting-IP` (Cloudflare's mod_remoteip guidance covers this, or your host may already handle it).
None of this reduces raw request volume by itself — Under Attack mode and Cloudflare's bot rules are still the right tool for that, and a WAF rule allowing verified Googlebot (Cloudflare has a built-in "known bots" category) will solve your indexing concern. But until the header trust is fixed, every visitor count, every IP block, and every whos_online report on a Zen Cart store is potentially fiction. I'd argue this deserves attention in core: a spoofed-header problem quietly distorts what every shop owner in this situation is looking at while they try to diagnose it.
