Cart protection: why bots slowed down your shop, and what the edge does now

Every web shop has links like ?add-to-cart=123, remove_item= and add_to_wishlist=. Bots that crawl your site click all of them. Each click makes your server create a session and a cart and rebuild the page. Hundreds of those clicks per minute slow your shop down for real visitors, while nothing is wrong with your server.

What the edge does

• A request to a cart or wishlist link with no cookie at all and with a bot, script or empty user agent gets a 403 at the edge. Your server doesn't even see it. Real visitors always have cookies and a normal browser, so they notice nothing.
• Each visitor has their own limit on cart actions (by default 30 per minute), separate from the regular page limit.
• The edge also sets the cart, checkout and account pages and those action URLs to Disallow in robots.txt, so well-behaved bots stay away. You set this under Edge › your site › Settings (robots.txt from the edge).

Everything is in the Edge Shield log under shop_bot and shop_rate. On or off and the limit: Edge › Security.

What your hosting provider needs to know

Because your site runs through the edge, all traffic reaches your server from the edge's address, just like with Cloudflare. A firewall that looks at the connecting address sees that as one busy visitor and throttles everything. The fix is on the hosting side: put the edge address on the allowlist, and make the server look at the real visitor address that we send along in X-Forwarded-For and X-Real-IP (Apache mod_remoteip, nginx set_real_ip_from). The addresses are in your portal under Edge › Settings.