hryvinskyi / magento2-bot-verification-cloudflare

1.0.0 2026-10-30 18:01 UTC

Requires

• php: >=8.1
• hryvinskyi/magento2-bot-verification: ^1.0
• magento/framework: >=103.0.0

MIT

• Volodymyr Hryvinskyi

Published on Packagist.org on 2026-10-30 21:00 UTC

README

Cloudflare's edge servers as trusted proxies for hryvinskyi/magento2-bot-verification. Install it only on a shop behind Cloudflare. The package is configuration only: one etc/di.xml.

composer require hryvinskyi/magento2-bot-verification-cloudflare
bin/magento module:enable Hryvinskyi_BotVerificationCloudflare
bin/magento setup:upgrade
bin/magento bot-verification:refresh

It declares Cloudflare's published ranges, https://www.cloudflare.com/ips-v4/ and https://www.cloudflare.com/ips-v6/ (plain text, one range per line), as proxy lists. The client-address walk then steps over the Cloudflare edge server that delivered a request and reads the visitor's address just left of it in X-Forwarded-For. It steps over one edge server at most, because Cloudflare's ranges also carry its customers' Workers, which can send a request with any X-Forwarded-For.

If the shop's origin can be reached around Cloudflare, a Worker that calls it directly is taken for the edge server. That lets an impostor through and never refuses a real crawler. Cloudflare's Authenticated Origin Pulls closes it.

The module declares no crawler.

License

MIT