WAF and bot blocking for online stores

A WAF (web application firewall) inspects requests before they reach PrestaShop and blocks those that look like attacks: SQL injection, malicious file uploads, vulnerability scans, brute force against the login.

Where it can sit

• In the CDN (Cloudflare and similar): it filters before reaching your server.
• On the server (ModSecurity, Imunify, hosting rules).
• In PHP: a file loaded before PrestaShop that decides by IP, user agent or URL.

Bots: good and bad

• Good: Googlebot, Bingbot, the Google Merchant bot, those of your integrations.
• Doubtful: SEO and AI crawlers that consume resources without giving you anything. You can limit them.
• Bad: vulnerability scanners, brute-force robots, aggressive price scrapers.

How to avoid blocking the wrong people

• A whitelist for your integrations: ERP, payment gateways (their notifications arrive from their IPs), backup tools.
• Behind a CDN, the PHP WAF sees the CDN's IP: configure the real-IP header or you will block everyone or no one.
• Review the block logs during the first week after enabling it.

And in your copies

A WAF that decides by IP can block your test environment, where all requests arrive from an internal proxy. Disable it in the copies.