Stop scanners, price scrapers, spam bots and fake Googlebots with a browser check that runs on your own server. Real customers and good bots pass as usual. No account needed, and no visitor data leaves your store.
Last Update: 18 Oct 2026
Version: 5.0
Compatibility: OpenCart 3.0.3.0 to 3.0.5.1 and 4.0.2.0 to 4.1.0.4 / PHP 7.2 and newer (OpenCart 4: PHP 8.0 and newer)
Upload the file in Extensions > Installer as it is. Do not rename it: OpenCart 4 reads the extension name from the file name.
Why bots matter
Most of the traffic of a typical online store is not people. Vulnerability scanners look for holes in your extensions, scrapers copy your prices and product descriptions, spam bots fill your contact and review forms, and password guessers try your customer and administrator logins. They slow the store down for real customers and put it at risk. BadBot Protection tells them apart from people and from the good bots you want, and stops them before they cost you server time.
What it does
Browser check on your own server. Visitors that do not look like a normal browser get a short check page. The browser solves a small calculation in about a second and gets a pass; bots stay outside. Smart mode checks only suspicious visitors, All visitors mode checks everyone once a day during an attack, and Log only mode shows what would be blocked.
Verified search engines. Google, Bing, Apple, DuckDuckGo, Yandex, Baidu and others are checked against their official address lists or by reverse DNS. Real crawlers pass; scrapers that only pretend to be Googlebot are blocked.
Bot categories. Allow, check or block search engines, link previews, uptime monitors, AI assistants, AI training crawlers, SEO tools, vulnerability scanners, HTTP libraries and unknown bots.
Block AI training crawlers with one click. GPTBot, ClaudeBot, Common Crawl, Bytespider and other training crawlers get blocked, while AI search assistants that send visitors stay allowed.
Traps for scanners. Requests for files no visitor ever opens (.env, .git, copies of config.php, database tools) and a hidden trap link ban the client for the time you choose.
Form protection. Customer login, registration, forgotten password, the contact form, product reviews, affiliate forms and the administrator login accept posts only from a real browser. People notice nothing; spam bots and password guessers are refused. Checkout is never touched.
Allow and block lists. IP addresses (IPv4, IPv6, CIDR), User-Agents, and URLs that never get the check.
Activity and statistics. Charts for 24 hours, 7 and 30 days, the top bots, addresses, pages and reasons, and a log of recent events.
Your check page. Your logo and texts, with a live preview.
Safe for your store. Logged-in customers and administrators are never checked; payment notifications, the OpenCart API and feeds are not touched; SEO URLs are understood; an emergency switch file turns everything off. Optional early protection starts the check before OpenCart loads.
Screenshots
Private by design
Bot detection, the browser check and the statistics all run on your server. The extension does not send visitor data anywhere and needs no account or connection to an outside service.
Full website protection
BadBot Protection stops bad bots. SiteGuarding protects the whole website. Block unwanted bots is part of the SiteGuarding Premium and Business plans, together with:
Website Firewall (WAF): SQL injection, XSS and exploit blocking
Server-side antivirus and daily malware scanning
Hack repair by our experts
DDoS prevention
Brute force and card testing protection
GEO blocking
24/7 monitoring, website backups and an SSL certificate
No. Google, Bing and other search engines are verified by their official addresses and never see the check. If a crawler cannot be verified, it gets a temporary "try later" answer, never a block.
What do real customers see?
In Smart mode almost all of them see nothing. In All visitors mode each new visitor sees the check page for about a second, once per day by default.
Will it affect checkout and payments?
No. Checkout is not a protected form, and payment notifications from payment providers (PayPal, Stripe and others), the OpenCart API and feeds are never checked.
How do I install it?
Download the file for your OpenCart version and upload it in Extensions > Installer without renaming it. Then open Extensions > Extensions, choose Modules and click Install next to BadBot Protection. The protection starts in Smart mode at once; the settings are in the menu under BadBot Protection.
How do I update it?
The extension shows a notice when a new version is out. On OpenCart 3, upload the new file in Extensions > Installer and open the BadBot Protection page once. On OpenCart 4, uninstall the module in Extensions > Modules, uninstall and delete it in Extensions > Installer, then upload the new file. Your settings and the activity log stay.
Does it work with Cloudflare and a page cache?
Yes. Cloudflare is detected automatically, and other proxies can be added in the settings. If a page cache extension serves pages before OpenCart starts, turn on early protection in Settings: the check then runs before the cache.
Does it send data anywhere?
No. Everything runs on your server. Only the BadBot Protection page in your administrator area asks siteguarding.com for the number of the latest version.
I locked myself out. What now?
Create an empty file named sgbb-off.txt in the folder where OpenCart is installed (next to config.php), with FTP or the file manager of your hosting. The protection stops at once. Delete the file to turn it back on.
Changelog
5.0 - First version for OpenCart, on the same core as the WordPress and Joomla editions. - Browser check on your own server, with Smart, All visitors and Log only modes. - Verified search engines by official addresses and reverse DNS; fake crawlers are blocked. - Bot categories, including AI assistants and AI training crawlers. - Traps for scanners, hidden trap link and bans. - Protection for customer login, registration, forgotten password, contact, product reviews, affiliate and administrator login forms, including the AJAX forms of OpenCart 4 and forms behind SEO URLs. - Allow and block lists, excluded URLs, activity charts and log. - Optional early protection through config.php; settings and log are kept when the module is uninstalled. - OpenCart 3.0.3.0 to 3.0.5.1 and 4.0.2.0 to 4.1.0.4.
Our website uses cookies, which help us to improve our site and enables us to deliver the best possible service and customer experience. See our policyAccept
