Аккаунт в General iT
Войдите или создайте аккаунт для управления услугами в личном кабинете.
Страны не найдены. Попробуйте другое название или код.
MODULE FOR 1C-BITRIX
Web Heroes
The Anti Bot module for 1C-Bitrix protects the site from bots, spam in forms and orders, parsers, vulnerability scanners, and manipulation of behavioral factors. Legitimate visitors and search robots are not hindered: instead of CAPTCHA, a suspicious visitor sees a simple puzzle that a human solves in a few seconds.
The Anti Bot module for 1C-Bitrix protects the site from bots, spam in forms and orders, parsers, vulnerability scanners, and manipulation of behavioral factors. Legitimate visitors and search robots are not hindered: instead of CAPTCHA, a suspicious visitor sees a simple puzzle that a human solves in a few seconds.
The module evaluates every visitor on a scale from 0 to 1 based on behavior, browser headers, referral source, network, and JavaScript verification. A puzzle is displayed when the score exceeds 0.5. For each request, the triggered indicators are visible. A "monitoring only" mode is available where scores are calculated but no actions are blocked.
The puzzle mechanism applies to users with low scores, as well as traffic from blocked countries, IP addresses, and Autonomous System Numbers (ASN). Users with active VPNs can pass the puzzle without disabling their VPN.
Geoblocking is supported for 249 countries with search and bulk selection capabilities.
White and black IP lists are implemented. The system supports IPv4 and IPv6 addresses and subnets, tags, and bulk addition. The white list is checked before the black list.
Blocking by Autonomous System Number (ASN) is available, allowing the blocking of entire networks belonging to hosting providers, data centers, and VPN services.
Bot management. Traffic is divided into six categories: search engines, social networks, monitoring services, AI agents, SEO services, and scanners. Each category can be individually allowed or blocked. Search engine bots are verified against official addresses, preventing fake Googlebot and YandexBot from passing through. Custom filtering rules based on the User-Agent header are also supported.
Form and order protection. The system analyzes activity during registration, web form submissions, email events (including contact forms), blog comments, forum posts, and order placements. These actions are factored into sender scoring and are visible in the statistics.
Developer blocklist. A curated database of spammer IP addresses and ASNs is maintained and added to the site's blacklists daily. User-defined entries in this list remain unchanged.
Statistics and logs. Detailed information is available regarding traffic sources, countries, User-Agent strings, verdicts, and the history of each IP. The evaluation log includes reasons for decisions, supports filtering, and allows data export to a file. Log retention is set to 7 days.
Performance. Country and provider databases are stored locally on the site server and updated automatically every three days. Country detection results are cached for 24 hours. IP and ASN lists are processed without external requests.
Exemptions. Authenticated users and service addresses starting with /bitrix/ are excluded from checks. The admin login page is protected against scanning.
The module supports multi-site setups and composite sites. Caching is handled via PostgreSQL, Redis, and Memcached through the Bitrix cache system.
System requirements include PHP version 8.0 or higher and the standard OpenSSL extension.
The module operates with external services provided by the developer WBHR at no extra cost. The service geo.solutions.wbhr.ru hosts country and provider databases and determines the country and network if the local database is disabled. The service blocklist.solutions.wbhr.ru contains developer blocklists, addresses of search engine robots and data centers, and a general rating database. Server responses are verified via digital signature.
Data transmitted to WBHR servers includes the site address. When traffic rating is enabled, visitor IP addresses with a rating of 0.6 or higher, their rating, and ASN number are sent every 10 minutes. IP addresses of requests mimicking Yandex, Apple, and Baidu robots are also transmitted for robot authenticity verification. No other visitor data is sent.
If the site operates through an external proxy or CDN (such as Cloudflare or DDoS-Guard), the visitor IP source must be configured in the module settings.
The module does not provide protection against DDoS attacks.
No additional modules or paid subscriptions are required.
The Anti Bot module by Web Heroes protects 1C-Bitrix websites from malicious traffic, spam in forms and orders, as well as from actions by scrapers, vulnerability scanners, and artificial manipulation of behavioral factors. The system does not hinder real users or search engine crawlers: instead of a traditional CAPTCHA, suspicious visitors see a simple puzzle that takes a few seconds to solve.
The traffic evaluation feature assigns each visitor a score from 0 to 1 by analyzing behavior, browser headers, referral source, network parameters, and JavaScript verification results. When the score reaches 0.5, the user is presented with a puzzle. For each request, the system displays the specific triggers that were activated. A 'monitoring only' mode is available, where scoring occurs but no blocking is applied.
The puzzle mechanism activates for visitors with low scores, as well as for traffic originating from blocked countries, IP addresses, and Autonomous Systems. Users with VPN enabled must solve the puzzle without needing to disable the VPN.
Geographic blocking is supported with control over a list of 249 countries, including search and bulk selection capabilities.
White and black IP lists are supported. The system handles IPv4 and IPv6 addresses and subnets, allows adding tags, and supports bulk entry. The white list is checked before the black list.
Blocking by Autonomous System Number (ASN) is implemented, allowing access to be restricted for entire networks of hosting providers, data centers, and VPN services.
Bot management. Traffic is divided into six categories: search engines, social networks, monitoring services, AI agents, SEO services, and scanners. Each category can be individually allowed or blocked. Search engine bots are verified against official addresses, preventing fake Googlebot and YandexBot from passing through. Custom filtering rules based on the User-Agent header are also supported.
Form and order protection. The system analyzes activity during registration, web form submissions, email events (including contact forms), blog comments, forum posts, and order placements. These actions are factored into sender scoring and are visible in the statistics.
Developer blocklist. A curated database of spammer IP addresses and ASNs is maintained and added to the site's blacklists daily. User-defined entries in this list remain unchanged.
Statistics and logs. Detailed information is available regarding traffic sources, countries, User-Agent strings, verdicts, and the history of each IP. The evaluation log includes reasons for decisions, supports filtering, and allows data export to a file. Log retention is set to 7 days.
Performance. Country and provider databases are stored locally on the site server and updated automatically every three days. Country detection results are cached for 24 hours. IP and ASN lists are processed without external requests.
Exemptions. Authenticated users and service addresses starting with /bitrix/ are excluded from checks. The admin login page is protected against scanning.
The module supports multi-site setups and composite sites. Caching is handled via PostgreSQL, Redis, and Memcached through the Bitrix cache system.
System requirements include PHP version 8.0 or higher and the standard OpenSSL extension.
The module operates with external services provided by the developer WBHR at no extra cost. The service geo.solutions.wbhr.ru hosts country and provider databases and determines the country and network if the local database is disabled. The service blocklist.solutions.wbhr.ru contains developer blocklists, addresses of search engine robots and data centers, and a general rating database. Server responses are verified via digital signature.
Data transmitted to WBHR servers includes the site address. When traffic rating is enabled, visitor IP addresses with a rating of 0.6 or higher, their rating, and ASN number are sent every 10 minutes. IP addresses of requests mimicking Yandex, Apple, and Baidu robots are also transmitted for robot authenticity verification. No other visitor data is sent.
If the site operates through an external proxy or CDN (such as Cloudflare or DDoS-Guard), the visitor IP source must be configured in the module settings.
The module does not provide protection against DDoS attacks.
No additional modules or paid subscriptions are required.
When needed, General iT can implement “Anti Bot — website protection (anti-spam) from unwanted traffic, spam, and bots”, configure the module and verify it against the current website setup.
UPDATE HISTORY
Anti Bot 2.0.1
Fixed: in statistics, the check (slide puzzle) was displayed as "Skipped", and request counters did not account for checks. On sites where the module was installed before version 1.3.0, the action column in the statistics table was too short; upon update, it expands, and old records are corrected. On PostgreSQL, such records were previously not saved.
Bitrix "System Check" no longer receives a check: its test requests to the site from the server's own address are skipped.
Bitrix Cloud Security Scanner no longer receives a check or error 403: after the administrator starts scanning on the "Security Scanner" page, the scanner does not receive a check for 3 hours (IP blacklists and blocked User-Agents continue to operate).
Traffic assessment: a new automation feature is the browser language set manually (a computer browser on Chromium has exactly one language with region, e.g., "ru-RU"; a real browser always adds the primary language). When coming from another site, this is not taken into account.
Statistics: visitor rows from the "My Allowed User-Agent" list are labeled with the bot type if known (e.g., AI bot for ClaudeBot).
Anti Bot 2.0.0
Traffic assessment added: each visitor receives a score from 0 to 1 based on behavior, browser headers, referral source, network, and JavaScript check. At a score of 0.5 or higher, a slide puzzle is shown. Enabled on the "Settings" tab, disabled by default; there is an "observation only" mode where the score is calculated and displayed, but nothing is blocked.
Added "Traffic Assessment Log": decisions for each request with score, triggered signals, and request headers (secrets, cookies, and personal data are not saved), filters, and export.
The module participates in the WBHR overall assessment database: when traffic assessment is enabled, visitor IP addresses with a score of 0.6 or higher, their score, and ASN number are sent to blocklist.solutions.wbhr.ru every 10 minutes, and assessments for addresses from other sites are received from there. No other visitor data is transmitted.
Search engine bot authenticity verification: Googlebot, YandexBot, Bingbot, and others from foreign networks no longer pass as search engines. For this verification, the IP addresses of requests presented as bots from Yandex, Apple, and Baidu are checked via reverse DNS through the WBHR server.
Form protection: registration, web forms, email events, comments, and order checkout are considered in sender evaluation.
Payment notifications and webhooks are passed without checks: published notification addresses for YooKassa, YooKassa's verification of the store website, and own webhook addresses (Bots tab).
Statistics: traffic type, verdict for each visitor, referral source, IP request history, Spammer button, statistics and log export (including from the console for large sites).
Slide puzzle: an incorrect attempt immediately replaces the puzzle with a new one; a passed check is remembered for the visitor's network (convenient for mobile and IPv6); separate checks for countries and for blacklists.
IP lists support subnets (CIDR); the whitelist is checked before the blacklist.
The module page in the administrative section updates together with the module.
WBHR server responses (general rating database, search engine bot and data center lists, developer block database) are accepted only with a digital signature (ECDSA, verified via the standard OpenSSL extension). If the signature verification fails, this data is not updated, and a warning appears in the module settings.
Local country and ASN databases are verified by checksum from the signed server response and stored in a directory with a random name.
Debug log removed: the module no longer writes files with visitor IP addresses; the old log is deleted upon update.
Statistics recording is always enabled; a separate switch has been removed.
Security fixes: detection of IP addresses via Cloudflare and local proxies (substitute address in X-Forwarded-For, CF-Connecting-IP, and its own header, requests from Cloudflare Workers), handling of paths with «..» and repeated «/», masking of passwords and tokens in addresses in the log and statistics
Anti Bot 1.2.2
Fixed a JS Challenge (sliding puzzle) error: with an inaccurate first attempt, the one-time verification token was consumed, and all subsequent attempts ended with the error «Try again» regardless of the answer correctness — now the token remains valid until successful completion, and a miss does not prevent trying again with the same puzzle
The limit on the number of verification attempts has been switched to a fixed time window: with continuous traffic from a common IP address (mobile operator, VPN, office network), the window no longer extends indefinitely and does not lead to permanent blocking of legitimate visitors
A verification attempt is now consumed only on failure: successful completion and a random click without dragging the fragment do not reduce the limit
Anti Bot 1.2.1
Local storage of the ASN (provider) database has been added on the server — a separate option in settings, similar to the already existing local country database; when enabled, it is used without external requests and without a 7-day cache, and is updated automatically every 3 days
Local storage of the country and ASN databases is now automatically enabled during installation and module update, with current databases downloaded immediately — without the administrator needing to go to settings
Developer blocklist: IP/ASN entries deactivated on the WBHR side are now automatically removed from client site blacklists during the next synchronization — entries manually added by the administrator are not affected
The «Update now» button report and daily synchronization have been supplemented with the count of removed outdated entries
When updating the local country database (and ASN), the dependent cache is now cleared across all installation sites so that new data is applied immediately rather than waiting for the TTL to expire.
The module now transmits the installation domain to the blocklist server (blocklist.solutions.wbhr.ru) with each request for the current list—a technical tag for activity statistics that does not affect the composition or format of the received lists.
Anti Bot 1.2.0
Added JS Challenge (slide puzzle) as an alternative to hard blocking for the IP blacklist and for blocking by ASN—enabled via separate options in the module settings, independently for each site.
Upon successful completion of the JS Challenge for an IP/ASN on the blacklist, access is granted for 20 minutes, after which the check is requested again.
Added the "Disable JS Challenge" flag for individual entries in the IP and ASN blacklists—enforcing hard blocking for a specific entry even when the JS Challenge option is enabled.
Added bulk actions in the IP and ASN blacklists: deletion of selected entries, enabling/disabling the JS Challenge restriction—selection via checkboxes on entries or via "select all".
Added bulk deletion of entries in the IP whitelist—via checkboxes or via "select all".
Added the setting "Install ASN and IP blocks from developers" (independent for each site)—a curated database of known spammers and bots from WBHR, updated automatically once daily.
Entries from the developer database are marked with the tag "[Black List WBHR]" and never modify or delete entries added manually by the administrator.
Added a manual button to request an update of the developer database "Update Now" with a report on the number of received and added IPs and ASNs.
The built-in allowed User-Agent groups have been updated to include GoogleAssociationService, Schema-Markup-Validator, Instagram, and Telegram—eliminating false blocks and CAPTCHA for real users opening the site via the built-in browsers of Instagram and Telegram, as well as for the schema.org markup validator.
Anti Bot 1.0.1
Fixed a multi-site error: when accessing the module admin panel without an explicit site_id in the address, the "Countries" tab and other settings could display data for the wrong site
Added statistics filter: by date/time range, IP address, ASN, country, action, and User-Agent
Added "Top User-Agent by number of requests" statistics
Strengthened protection for the debug log directory: protected directory, random file name, centralized message sanitization
Anti Bot 2.0.0
Traffic scoring added: each visitor receives a score from 0 to 1 based on behavior, browser headers, referral source, network, and JavaScript verification. A slide puzzle is displayed for scores of 0.5 or higher. This feature is enabled on the Settings tab and is disabled by default; there is also a 'monitoring only' mode where the score is calculated and displayed but nothing is blocked.
Traffic scoring log added: records decisions for each request including the score, triggered signals, and request headers (secrets, cookies, and personal data are not saved), along with filters and export functionality.
The module participates in the WBHR global scoring database: when traffic scoring is enabled, IP addresses of visitors with a score of 0.6 or higher, along with their score and ASN number, are sent to blocklist.solutions.wbhr.ru every 10 minutes, and scores for addresses from other sites are received in return. No other visitor data is transmitted.
Search engine bot authenticity verification: Googlebot, YandexBot, Bingbot, and others from external networks no longer pass as search engines. For this verification, IP addresses of requests claiming to be from Yandex, Apple, and Baidu bots are checked via reverse DNS through the WBHR server.
Form protection: registration, web forms, email events, comments, and checkout processes are considered in the sender's scoring.
Payment notifications and webhooks are passed without checks: published notification addresses for YooKassa, the YooKassa website store verification, and custom webhook addresses (on the Bots tab).
Statistics: traffic type, verdict for each visitor, referral source, IP request history, Spammer button, and export of statistics and logs (including from the console for large sites).
Slide puzzle: an incorrect attempt immediately replaces the puzzle with a new one; a passed check is remembered for the visitor's network (convenient for mobile devices and IPv6), with separate checks for countries and blacklists.
IP lists support subnets (CIDR); the whitelist is checked before the blacklist.
The module page in the administrative section updates along with the module.
WBHR server responses (general rating database, lists of search robots and data centers, developer blocklist) are accepted only with a digital signature (ECDSA, verified via the standard OpenSSL extension). If signature verification fails, this data is not updated, and a warning appears in the module settings.
Local country and ASN databases are verified against the checksum from the signed server response and stored in a directory with a random name.
Debug logging has been removed: the module no longer writes files containing visitor IP addresses; the old log is deleted upon update.
Statistics recording is always enabled; a separate toggle has been removed.
Security fixes: IP detection behind Cloudflare and local proxies (spoofed address in X-Forwarded-For, CF-Connecting-IP, and its own header, requests from Cloudflare Workers), handling of paths with '..' and repeated '/' characters, masking of passwords and tokens in URLs within the log and statistics.
Anti Bot 1.2.2
Fixed a JS Challenge (sliding puzzle) error: on an inaccurate first attempt, the one-time verification token would expire, causing all subsequent attempts to fail with the error 'Try again' regardless of the answer's correctness. Now the token remains valid until successful completion, and a miss does not prevent retrying with the same puzzle.
The attempt limit for verification has been switched to a fixed time window: under continuous traffic from a shared IP address (mobile operator, VPN, office network), the window no longer extends indefinitely, preventing permanent blocking of legitimate visitors.
A verification attempt is now consumed only upon failure: successful completion and random clicks without dragging the fragment do not reduce the limit.
Anti Bot 1.2.1
Added local storage of the ASN (provider) database on the server — a separate option in settings, similar to the existing local country database; when enabled, it operates without external requests and without a 7-day cache, updating automatically every 3 days.
Local storage of country and ASN databases is now enabled automatically upon module installation and updates, with current databases downloaded immediately—without requiring the administrator to visit settings
Developer blocklist: IP/ASN records deactivated on the WBHR side are now automatically removed from client site blacklists during the next synchronization—records manually added by the administrator are not affected
The 'Update Now' button report and daily synchronization have been enhanced to include the count of removed outdated records
When updating the local country (and ASN) database, the dependent cache is now cleared across all sites in the installation—so new data is applied immediately, not waiting for TTL expiration
The module now sends the installation domain to the blocklist server (blocklist.solutions.wbhr.ru) with each request for the current list—a technical tag for activity statistics, which does not affect the composition or format of received lists
Anti Bot 1.2.0
Added JS Challenge (slide puzzle) as an alternative to hard blocking for blacklisted IPs and ASN blocking—enabled via separate options in module settings, independently for each site
Upon successful completion of the JS Challenge for a blacklisted IP/ASN, access is granted for 20 minutes, after which verification is requested again
Added the 'Disable JS Challenge' flag for individual blacklisted IP and ASN records—enforcing hard blocking for specific records even when the JS Challenge option is enabled
Added bulk actions for blacklisted IP and ASN records: deletion of selected records, enabling/disabling JS Challenge restriction—selection via checkboxes on records or via 'select all'
Added bulk deletion of records in the IP whitelist—via checkboxes or via 'select all'
Added the 'Install Developer ASN and IP Blocks' setting (independent for each site)—a curated database of known spammers and bots from WBHR, updated automatically once daily
Records from the developer database are marked with the tag "[Black List WBHR]" and never modify or delete records added manually by the administrator.
A manual "Update Now" button has been added to request an update of the developer database, along with a report on the number of received and added IP addresses and ASNs.
GoogleAssociationService, Schema-Markup-Validator, Instagram, and Telegram have been added to the built-in allowed User-Agent groups, eliminating false blocks and CAPTCHA for live users opening the site via the built-in browsers of Instagram and Telegram, as well as for the schema.org markup validator.
Anti Bot 1.0.1
Fixed a multi-site error: when accessing the module admin panel without an explicit site_id in the address, the "Countries" tab and other settings could display data for the wrong site.
Added a statistics filter: by date/time range, IP address, ASN, country, action, and User-Agent.
Added statistics "Top User-Agent by number of requests".
Strengthened protection for the debug log directory: protected directory, random file name, centralized message sanitization.
Anti Bot 1.2.2
Fixed a JS Challenge (slide puzzle) error: on an inaccurate first attempt, the one-time verification token would expire, causing all subsequent attempts to fail with the error "Try again" regardless of the answer's correctness — now the token remains valid until successful completion, and a miss does not prevent trying the same puzzle again
The attempt limit for verification has been moved to a fixed time window: with continuous traffic from a shared IP address (mobile operator, VPN, office network), the window no longer extends indefinitely and no longer causes permanent blocking of legitimate visitors
A verification attempt is now consumed only on failure: successful completion and a random click without dragging the fragment do not reduce the limit
Anti Bot 1.2.1
Added local storage of the ASN (provider) database on the server — a separate option in settings, similar to the existing local country database; when enabled, it operates without external requests and without a 7-day cache, updating automatically every 3 days
Local storage of the country and ASN databases is now enabled automatically during module installation and updates, with current databases downloaded immediately — without requiring the administrator to visit settings
Developer blocklist: IP/ASN entries deactivated on the WBHR side are now automatically removed from client site blacklists during the next synchronization — manually added administrator entries are not affected
The "Update Now" button report and daily synchronization now include the count of removed outdated entries
When updating the local country (and ASN) database, the dependent cache is now cleared across all sites in the installation so that new data is applied immediately, not after TTL expiration
The module now sends the installation domain to the blocklist server (blocklist.solutions.wbhr.ru) with each request for the current list — a technical tag for activity statistics, which does not affect the composition or format of received lists
Anti Bot 1.2.0
Added JS Challenge (slide puzzle) as an alternative to hard blocking for the IP blacklist and for blocking by ASN — enabled via separate options in the module settings, independently for each site.
Upon successful completion of the JS Challenge for an IP/ASN in the blacklist, access is granted for 20 minutes, after which verification is requested again.
Added the "Disable JS Challenge" flag for individual entries in the IP and ASN blacklists — forces hard blocking of a specific entry even when the JS Challenge option is enabled.
Added bulk actions in the IP and ASN blacklists: delete selected entries, enable/disable the JS Challenge restriction — selection via checkboxes on entries or via "Select All".
Added bulk deletion of entries in the IP whitelist — via checkboxes or via "Select All".
Added the setting "Install ASN and IP blocks from developers" (independent for each site) — a curated database of known spammers and bots from WBHR, automatically updated once daily.
Entries from the developer database are marked with the tag "[Black List WBHR]" and never modify or delete entries added manually by the administrator.
Added a manual button to request an update of the developer database "Update Now" with a report on the number of received and added IPs and ASNs.
Added GoogleAssociationService, Schema-Markup-Validator, Instagram, and Telegram to the built-in allowed User-Agent groups — eliminates false blocks and CAPTCHA for real users opening the site via the built-in browsers of Instagram and Telegram, as well as for the schema.org markup validator.
Anti Bot 1.0.1
Fixed a multisite error: when accessing the module admin panel without an explicit site_id in the URL, the "Countries" tab and other settings could display data for the wrong site.
Added a statistics filter: by date/time range, IP address, ASN, country, action, and User-Agent.
Added statistics "Top User-Agent by number of requests"
Enhanced catalog protection with debug logging: protected directory, random filename, centralized message sanitization
Anti Bot 1.2.1
Local storage of the ASN database (providers) has been added to the server as a separate option in settings, similar to the existing local country database; when enabled, it operates without external requests and without the 7-day cache, and is automatically updated every 3 days.
Local storage for the country and ASN databases is now automatically enabled during module installation and updates, with current databases downloaded immediately, eliminating the need for the administrator to visit settings.
Developer blocklist: IP/ASN records deactivated on the WBHR side are now automatically removed from client site blacklists during the next synchronization; records manually added by an administrator are not affected.
The report for the "Update Now" button and daily synchronization now includes the count of removed outdated records.
When updating the local country (and ASN) database, the dependent cache is now cleared across all sites in the installation so that new data is applied immediately, rather than waiting for TTL expiration.
The module now sends the installation domain to the blocklist server (blocklist.solutions.wbhr.ru) with each request for the current list; this is a technical tag for activity statistics and does not affect the composition or format of the received lists.
Anti Bot 1.2.0
A JS Challenge (sliding puzzle) has been added as an alternative to hard blocking for blacklisted IP addresses and ASN blocking; it can be enabled via separate options in module settings, independently for each site.
Upon successful completion of the JS Challenge for a blacklisted IP/ASN, access is granted for 20 minutes, after which verification is requested again.
A "Disable JS Challenge" flag has been added for individual blacklisted IP and ASN records, enforcing hard blocking for specific records even when the JS Challenge option is enabled.
Bulk actions have been added for IP and ASN blacklists: deletion of selected records, and enabling/disabling the JS Challenge restriction; selection is possible via checkboxes on records or via "select all".
Added bulk deletion of records in the IP whitelist — via checkboxes or using 'Select All'
Added the setting 'Install ASN and IP blocks from developers' (independent for each site) — a curated database of known spammers and bots from WBHR, automatically updated once daily
Records from the developer database are marked with the tag '[Black List WBHR]' and never modify or delete records added manually by the administrator
Added a manual button to request an update of the developer database 'Update Now' with a report on the number of received and added IP and ASN addresses
Added GoogleAssociationService, Schema-Markup-Validator, Instagram, and Telegram to the built-in allowed User-Agent groups — eliminates false blocks and CAPTCHA for real users opening the site via the built-in browsers of Instagram and Telegram, as well as for the schema.org markup validator
Anti Bot 1.0.1
Fixed a multi-site error: when accessing the module admin panel without an explicit site_id in the URL, the 'Countries' tab and other settings could display data for the wrong site
Added statistics filter: by date/time range, IP address, ASN, country, action, and User-Agent
Added statistics 'Top User-Agent by number of requests'
Strengthened protection of the debug log directory: protected directory, random file name, centralized message sanitization
Anti Bot 1.2.0
Added JS Challenge (slide puzzle) as an alternative to strict blocking for the IP blacklist and for blocking by ASN — enabled via separate options in the module settings, independently for each site.
Upon successful completion of the JS Challenge for the IP/ASN blacklist, access is granted for 20 minutes, after which verification is requested again.
Added the "Disable JS Challenge" flag for individual entries in the IP and ASN blacklists — enforces strict blocking for a specific entry even when the JS Challenge option is enabled.
Added bulk actions in the IP and ASN blacklists: delete selected entries, enable/disable the JS Challenge restriction — selection via checkboxes on entries or via "Select All".
Added bulk deletion of entries in the IP whitelist — via checkboxes or via "Select All".
Added the "Install ASN and IP blocks from developers" setting (independent for each site) — a curated database of known spammers and bots from WBHR, automatically updated once daily.
Entries from the developer database are marked with the tag "[Black List WBHR]" and never modify or delete entries added manually by the administrator.
Added a manual button to request an update of the developer database "Update Now" with a report on the number of received and added IP and ASN entries.
Added GoogleAssociationService, Schema-Markup-Validator, Instagram, and Telegram to the built-in allowed User-Agent groups — eliminates false blocks and CAPTCHA for real users opening the site via the built-in browsers of Instagram and Telegram, as well as for the schema.org markup validator.
Anti Bot 1.0.1
Fixed a multisite error: when accessing the module admin panel without an explicit site_id in the URL, the "Countries" tab and other settings could display data for the wrong site.
Added a statistics filter: by date/time range, IP address, ASN, country, action, and User-Agent.
Added statistics "Top User-Agent by number of requests".
Enhanced catalog protection with debug logging: protected directory, random filename, centralized message sanitization
Anti Bot 1.0.1
Fixed the path to the debug log in the settings description: it previously indicated /upload/wbhr_antibot/debug.log; the current path is /bitrix/tmp/wbhr_antibot/debug.log.
Fixed a multi-site error: when accessing the module admin panel without an explicit site_id in the URL, the 'Countries' tab and other settings could display data for the wrong site.
When uninstalling the module, the service option ~bsm_stop_date is now correctly removed, which previously could interfere with reinstallation via the Marketplace.
Added a statistics filter: by date/time range, IP address, ASN, country, action, and User-Agent.
Added 'Top User-Agent by number of requests' statistics.
Top blocked countries and top User-Agents are now displayed in two columns.
Statistics filtering has been accelerated thanks to new indexes in the events table; they are created automatically and are compatible with MySQL and PostgreSQL.
Strengthened protection of the debug log directory (/bitrix/tmp/wbhr_antibot/): added .htaccess to block access and an index.php stub.
The diagnostic log of the geo-database update agent is now written only when debug mode is enabled (previously it was always written, regardless of the setting).
Full request URLs, absolute server paths, and fragments of API response content have been removed from the diagnostic messages of the geo-database update agent.
The debug log filename now contains a random suffix (generated once and stored in the module options) so that the log path cannot be guessed from the outside.
HTTP status codes of geo-service responses in the log are generalized into categories (2xx/4xx/5xx) instead of exact codes.
Added automatic cleanup of rotated debug logs (.old) older than 7 days.
Log message sanitization has been moved to a single point (Logger::sanitize); now URLs and excessively long API responses are automatically truncated for all module log sources, not just where it was done manually.
Raw API response bodies and full JSON dumps of results have been removed from AsnDb and GeoApi logs; only fields significant for diagnostics remain.
Added the setting 'Mask IP addresses in debug log' (disabled by default) — when enabled, the last two octets of IPv4 are replaced with 'x.x'
The hint for the debug mode setting now explicitly warns that visitor IP addresses are logged when enabled
Added a safety cleanup of absolute file system paths from exception texts before writing to the log
USER EXPERIENCE
How does this solution work in a real project? Share your experience and help others choose.
There are no reviews of this solution on git.ru yet. Tell us what worked well and what could be improved.
Verified purchaseAdd a key if you wish. A verified review gets a badge, priority placement and more rating weight.
Open to every clientJust sign in to your account. A key is optional; all reviews are moderated.
YOUR PROJECT INFRASTRUCTURE
MORE FOR YOUR WEBSITE
The module automates image compression on the website in accordance with Google PageSpeed Insights recommendations. It supports integration via CDN OptiPic, allowing optimization without modifying image URLs. The main advantage of CDN integration is the automatic conversion of images to the modern WebP format to minimize file size. Browsers that support WebP receive images in that format.
The module is designed for online stores running on the 1C-Bitrix platform to automate the integration of supplier product catalogs. It is also suitable for news and city portals to facilitate content population. The solution supports data import in Excel, XML, YML, CSV, and RSS formats.
The module is designed for the «1C-Bitrix: Site Management» platform and enables importing infoblock elements, including products, from Excel files. It also supports data loading into Highload blocks.
BEFORE YOU ORDER
