Аккаунт в General iT
Войдите или создайте аккаунт для управления услугами в личном кабинете.
Страны не найдены. Попробуйте другое название или код.
MODULE FOR 1C-BITRIX
Good Solutions
The Anti-bot module automatically protects websites from bots, scrapers, and suspicious traffic using a set of rules and a JS Challenge. The system analyzes User-Agent, IP address, GeoIP location, UTM tags, and browser behavior to distinguish between real users and automated scripts.
The Anti-bot module automatically protects websites from bots, scrapers, and suspicious traffic using a set of rules and a JS Challenge. The system analyzes User-Agent, IP address, GeoIP location, UTM tags, and browser behavior to distinguish between real users and automated scripts.
When rules are triggered, the module either blocks the request entirely (returning a 403 status code) or displays an intermediate JS challenge page. This page allows only genuine browsers to pass through without hindering legitimate visitors.
Key functions of the module:
Filtering out basic scrapers and scanners that use suspicious or missing User-Agent headers.
Blocking traffic from unwanted countries (GeoIP blacklist) or, conversely, restricting access to specific regions only.
Protection against brute-force attacks and mass automated traffic targeting public pages and forms.
Preserving the integrity of statistics and SEO metrics by reducing the share of non-targeted visits.
How it works:
The module activates on every request via the early OnPageStart event, retrieving data on IP, User-Agent, country, and UTM tags.
The first step involves checking IP and UTM whitelists; requests from trusted sources are allowed to pass immediately.
The module sequentially checks the User-Agent blacklist and, if necessary, the country-based rule (block_foreign). Requests matching these lists receive a 403 response and do not reach the site.
For borderline cases, a JS-Challenge is used: the module displays a special HTML page that executes a simple script and sets a 'human' flag in the cookie. Bots without JavaScript support cannot proceed further.
All triggered rules are logged with the date, IP address, URL, 'bot/human' flag, and blocking reason.
Flexible traffic configuration. The module supports IP and User-Agent allowlists and blocklists, a GeoIP filter, and configurable UTM tags for SEO bots or internal checks.
Soft protection via JS-Challenge. Instead of a hard 403 rejection, the module can display a lightweight intermediate page that a standard browser passes in a fraction of a second, while bots cannot.
Detailed traffic logging. The admin panel includes a section listing protection triggers, showing the total number of requests, the count of blocked requests, and the number of real users.
General iT can connect “Antibot — website protection from bots and scrapers”, install and configure the module, and make sure the integration works correctly.
UPDATE HISTORY
Version 1.0.9
- Compatibility with the internal page verification of Goodsol Seosite 1.2.5 has been added. It is enabled only by an administrator in Seosite; it is disabled by default.
- The permission applies to a single signed GET/HEAD request for an exact public address, is time-limited, and does not allow reuse. Ordinary visitors, POST requests, service URLs, and requests with cookies or Authorization headers do not receive this exception.
- In the Anti-bot log, internal Seosite reads are highlighted as a separate event. An HTTP marker for the verification page has been added for precise scanner diagnostics.
- The internal response is not saved in Composite and is marked private/no-store. With an invalid signature, missing Seosite, or disabled integration, standard protection rules apply.
- Protection settings, white lists, installation secret, demo mode, and the database are not reset by updates. Rules for external search and AI bots are not automatically changed.
Before publishing, verify on a test Bitrix copy: ordinary visits, forms/AJAX, caching, and module interoperability. The integration does not bypass external CDN/WAF and does not prove public page accessibility.
Version 1.0.8
Security:
- Bypass of mandatory verification via POST, PUT, PATCH, DELETE, OPTIONS, and HEAD methods has been fixed. The request method and AJAX header do not grant exceptions from protection.
- Unconfirmed non-GET requests receive a final 403 response without an HTML challenge, GET redirect, or content delivery. AJAX receives a JSON challenge_required response.
- Reasons for explicit blocks are no longer disclosed to visitors: a single neutral 403 response is returned; details are available only in the log.
- Instead of a simple exchange of a public challenge for a cookie, a one-time computational task is verified. The server checks the signature, expiration, purpose, session, domain, site, and IP; repeated responses are rejected.
- Mouse and scroll movement indicators do not replace mandatory verification. Behavioral data acceptance is available only after visitor confirmation.
- Local redirect target verification and protection against bypass via URL extension, query suffix, X-Requested-With header, and common prefixes /bitrix/ and /local/ are preserved.
Form Compatibility:
- After successful verification, confirmation is stored on the server. For POST, it remains valid for 12 hours within the same session, on the same domain/site and IP; loss of a separate anti-bot cookie does not invalidate an open form.
- Cookies and standard access remain valid for one hour. The first unconfirmed POST, loss of the entire session, IP change, or expiration of the allowance do not result in automatic bypass. In these cases, the form must be reopened and verification repeated.
- POST requests are not converted to GET and are not resent. CAPTCHA, CSRF, and component field verification remain enabled; form data is not transferred to URLs or logs.
- Webhooks, payment notifications, data exchanges, and other server-side POST integrations must be tested on a staging environment: with mandatory protection enabled, they do not receive automatic exceptions. Do not disable signature/authorization checks for their handlers.
- Old tokens are invalid after an update. Before acceptance, refresh the page in the browser and complete verification again.
- A computational task increases the cost of automated requests, but does not guarantee distinguishing a human from a software client and does not replace CAPTCHA/WAF for relevant tasks.
Preloaders:
- 10 autonomous CSS/SVG animations without external libraries or CDN: ring, double orbit, pulse, three dots, wave, radar, stripes, comet, shield scan, progress line.
- Configuration of the main color, tracks for two-color effects, background, and text color in HEX with preview.
- Editable title and description. Ability to completely hide regular text, leaving only the shape or logo. Verification errors remain visible.
- Upload PNG/JPEG/WebP up to 2 MB and 2048 x 2048 pixels, content verification and re-encoding to PNG up to 200 x 200. SVG/GIF are not accepted.
- Logo size 100, 120 or 200 pixels with aspect ratio preservation; centering relative to the screen.
- Logo effects: no effect, pulsation, floating, glow, fade in/out, bottom stripe, swaying. Respect prefers-reduced-motion.
Composite:
- "Composite" tab: "Priority Protection" mode for selected domains. Explicit confirmation of exclusion and clearing only their file-based HTML cache.
- Component cache and composite cache for other domains are preserved. Load on PHP for selected sites increases. When serving HTML via nginx or external cache, separate server configuration is required.
- Visitor tokens are moved from general HTML to a separate non-cached request. Behavior events during an incomplete request are not lost.
- Demo period checks are preserved. Installing an update does not automatically include composite exclusions, does not change protection lists, and does not reset settings.
Settings interface:
- Color fields, labels, and the text display checkbox are aligned; unclear error explanations have been removed.
- Composite instructions open in a popup window: mode purpose, configuration order, result verification, contacting hosting, and reverting to the previous mode.
What's new in version 1.0.7:
Safe export of the log to CSV with filter and sorting support has been added to 'Honest Analytics'.
A separate option to block explicit headless browsers with the User-Agent 'HeadlessChrome' has been added.
The headless browser blocking option is disabled by default to avoid interfering with PF services, Lighthouse, and headless monitoring.
What's new in version 1.0.6:
The 405 response when opening a URL with the service parameter 'gs_antibot_action' has been fixed.
Random GET requests with the service parameter are now redirected to the same URL without that parameter.
The response to a successful JS check ends immediately after returning JSON and no longer triggers page rendering.
The 'gs_antibot_action' parameter has been excluded from pagination, metadata, and the site component cache.
What's new in version 1.0.5:
A blacklist for individual IP addresses and CIDR subnets with support for IPv4 and IPv6 has been added.
A quick command to add IPs to the blacklist has been added to the 'Honest Analytics' log.
Triggering a network rule is now logged with the reason 'BLOCK_IP_RULE' and the exact IP/CIDR rule.
Geolocation has been switched to standard 1C-Bitrix handlers without calling an incompatible external IP-API.
For an undefined country, a safe option has been added: either skip the visitor or show a JS-Challenge.
Validation of IP addresses and CIDR subnets before saving settings has been added.
Compatibility with demo mode and the challenge-token protection mechanism of version 1.0.4 has been preserved.
What's new in version 1.0.4:
Added compatibility with the demo mode of the 1C-Bitrix Marketplace.
Strengthened antibot_token verification: the global salt has been replaced with an individual installation secret, MD5 has been replaced with HMAC-SHA256, hourly rotation and hash_equals() have been added.
Behavioral antibot_behavior is now signed by the server via HMAC and validated by its expiration time. Unsigned client-side JSON is no longer considered trusted.
Retrieval of human- and behavior-tokens is protected by Bitrix sessid and a short-lived server-side challenge bound to the IP address and token purpose.
Search and advertising User-Agents are verified via reverse and forward DNS, so browser string spoofing no longer allows automatic bypass of protection.
UTM exclusions apply only to visitors who have already passed the JS-Challenge.
Removed the non-cryptographic fallback secret generator: if random_bytes() is unavailable, the module safely terminates the operation.
Public protection is correctly disabled after the demo period expires and does not block site traffic.
Clear messages for the expired demo period have been added to the settings and log.
The include.php file has been prepared for obfuscation of the demo version in accordance with Bitrix requirements.
What's new in version 1.0.3:
Enhanced admin journal security: added a whitelist for sort fields and output escaping for user data (IP, URL, User-Agent).
Added a safe fallback for the old database schema: the journal opens without a fatal error even before the migration is executed.
Strengthened IP geolocation validation: IP validation + switching to an HTTPS request to ip-api.
Added a log table structure migration during updates (automatic addition of DECISION_CODE and MATCHED_RULE columns if they are missing).
Added a JS behavioral signal (lightweight fingerprint token: mouse/scroll/keypress/touch + webdriver).
In the suspicious direct traffic branch, a challenge is added if the behavioral signal is missing or invalid.
Added a new setting: "Enable JS behavioral signal".
Safe defaults preserved: advertising bots in the whitelist, Suspicious traffic mode set to monitor by default.
What's new in version 1.0.2:
Added advertising bots to the default whitelist: YaDirectFetcher, AdsBot-Google, AdsBot-Google-Mobile, Google-Read-Aloud.
Added a safe switch "Module active" — stops protection without removing the module.
Added the "Save logs when removing the module" option.
Added rule trigger reasons to the journal and a quick filter "Only blocked advertising bots".
Added heuristic for suspicious direct traffic with modes off / monitor / block (default: monitor).
The update includes a soft migration: new log fields and whitelist UA additions without overwriting client rules.
What's new in version 1.0.1:
Fixed a pagination error and data display in the traffic log table (migration to CAdminResult).
Improved the bot detection algorithm and IP address database checks.
Updated the event handler and settings save logic.
Optimized the performance of the admin logs page.
Added the ability to exclude good bots from statistics.
USER EXPERIENCE
How does this solution work in a real project? Share your experience and help others choose.
There are no reviews of this solution on git.ru yet. Tell us what worked well and what could be improved.
Verified purchaseAdd a key if you wish. A verified review gets a badge, priority placement and more rating weight.
Open to every clientJust sign in to your account. A key is optional; all reviews are moderated.
YOUR PROJECT INFRASTRUCTURE
FROM THE SAME DEVELOPER
Good Solutions
The 'Cookie Disclaimer and Consent under Federal Law No. 152' module by 'Good Solutions' implements two mechanisms on the site for handling personal data. The Cookie banner is a neat bar at the bottom of the screen containing text about cookies, a consent button, and a link to the privacy policy. It remains visible until the user makes a decision.
The module automatically translates website text content in the background, storing the results in the database. Translation is performed using external services connected via API keys from Google Translate or Yandex Cloud through the admin panel. When rendering the page, the stored translation is displayed instead of the original text. Text embedded in images is not processed.
The module automates the population of ALT and TITLE attributes for images, writing data directly into the product's SEO tab. Generation occurs automatically upon saving an element, eliminating the need for manual intervention by content managers. The tool creates unique descriptions by combining static text with dynamic infoblock variables.
MORE FOR YOUR WEBSITE
The module automates image compression on the website in accordance with Google PageSpeed Insights recommendations. It supports integration via CDN OptiPic, allowing optimization without modifying image URLs. The main advantage of CDN integration is the automatic conversion of images to the modern WebP format to minimize file size. Browsers that support WebP receive images in that format.
The module is designed for online stores running on the 1C-Bitrix platform to automate the integration of supplier product catalogs. It is also suitable for news and city portals to facilitate content population. The solution supports data import in Excel, XML, YML, CSV, and RSS formats.
The module is designed for the «1C-Bitrix: Site Management» platform and enables importing infoblock elements, including products, from Excel files. It also supports data loading into Highload blocks.
BEFORE YOU ORDER
