PHP PrestaShop Firewall – PrestaShop module by Carles Mateo

PHP PrestaShop Firewall protects your shop by blocking abusive visitors as early as possible in the request, before PrestaShop dispatches the controller.

When protection is enabled, every request is checked:

If the visitor IP is already a known offender, it gets a 403 Forbidden.
If the IP matches one of your manual deny rules (single IP, CIDR block or hyphen range, IPv4 or IPv6), it gets a 403.
Otherwise the requested URL is inspected. If it matches a scanner signature, the IP is recorded and the request gets a 403.

Built-in scanner signatures: .env, wp-config.php, .git and a large list of known probes. You can add your own substring patterns too.

Proxy / CDN aware

Choose which header carries the real visitor IP: REMOTE_ADDR, Cloudflare (CF-Connecting-IP), X-Forwarded-For, X-Real-IP, or a custom header — so the module works correctly behind nginx, Varnish, a load balancer or a CDN.

Runs early

When protection is enabled, the deny check runs as the dispatcher resolves the controller, before it executes, so bad requests are rejected while consuming as little CPU and resources as possible.

Exports

CSV of the automatic offenders (optionally including the detection timestamp).
A ufw script, e.g. ufw insert 1 deny from 185.225.69.214 to any.

Does it work behind Cloudflare or a reverse proxy?

Yes. In the settings, choose the header that carries the real client IP for your setup. Only trust a forwarded header if your server genuinely sits behind that proxy, otherwise the value can be spoofed.

What happens when protection is disabled?

Nothing is blocked and no offenders are collected. Your existing rules are kept.

Where is the data stored?

Scalar settings live in PrestaShop's configuration store; the manual deny rules, the automatic offenders and the request log each live in their own custom database table created by the module on install.

Can I export the blocklist to my server firewall?

Yes. Export the automatic offenders as a ufw script or as CSV from the settings page.

Is it fast?

It is very fast and really useful. Every site should have a plugin like this.