Security & Anti-Spam for OpenCart

Overview

Security & Anti-Spam stops spam registrations, fake reviews and contact-form spam without Google, and locks down the OpenCart admin with a login lockout, a secret admin address, an IP allow-list, an authenticator app or passkeys, a file change monitor and a health check.

• Spam check without Google or cookies. A hidden field bots fill in, a time trap and a small proof of work the browser solves while the visitor types. Real people never see a puzzle; nothing is sent to a third party and no cookie is set.
• Own visible check when needed. When the background check fails (no JavaScript, sent faster than a person can type, too many attempts from one address) the form asks for a distorted 5-character code or a simple sum, drawn as an image on your server. The answer is never in the page.
• Optional Cloudflare Turnstile, hCaptcha or Google reCAPTCHA v3 for shops that want them. If the keys are missing or the service does not answer, the built-in check takes over, so forms never lock.
• Every customer form. Registration, guest checkout (OpenCart 3), product reviews, returns, contact and blog comments (OpenCart 4.1) through OpenCart's own captcha pages; customer login and forgotten password by this extension; forms of other extensions through their route.
• Content rules. Disposable e-mail addresses (a bundled list, no external service), links in name fields, too many links in messages, blocked words, text only in Cyrillic or CJK script, and an allow or deny list of countries per form (Cloudflare country header or the GeoIP database of our Bot & Country Blocker).
• Limits per address. Above the limit every submission needs the visible check; at twice the limit the address waits. Customer logins count wrong passwords from one address, on top of OpenCart's own per-e-mail lockout.
• Admin login lockout. After a few wrong passwords from one address or for one user name the admin login locks for the window you set; after two failures it also asks for the image code. OpenCart 4 shows a notification; an e-mail to the store address is optional.
• Admin access key. Without the key, your admin answers like a missing page. You open it once with ?k=your-key; the browser remembers the key for 30 days. A recovery file switches every admin protection off if you lock yourself out.
• Admin IP allow-list with an "add my current address" button and a guard that refuses a list that would lock you out.
• Two-step sign-in for administrators. Authenticator apps (Google Authenticator, Microsoft Authenticator, 1Password, Authy...) and passkeys (fingerprint, face, security key), ten backup codes, trusted browsers, required for all users or for chosen user groups. On OpenCart 4.1 it replaces the e-mail device code for users who set it up.
• File change monitor. A SHA-256 baseline of the code files; a daily scan lists changed, new and removed files. PHP files in image and upload folders and known web shell names are red flags.
• Health check. Install folder, admin folder name, storage location, error display, writable config files, OpenCart and PHP versions, HTTPS, admin users and session settings, with links to OpenCart's own security page.
• Security log and dashboard. Every refused submission and admin event with reason, shortened or hashed address and country; 30-day chart, CSV export and a retention period.

What OpenCart already does and this extension does not repeat: the customer lockout per e-mail address, the OpenCart 4.1 e-mail codes for customers and new admin devices, the OpenCart 4.1 security page (delete the install folder, move storage, rename admin) and the blog word filter. Country and bot blocking for the whole store is the job of our Bot & Country Blocker.

The widget is the same HTML for every visitor and tickets come by AJAX, so page caches keep working. No OCMOD, no core file edits: events and an OpenCart captcha extension. One licence covers OpenCart 4 and 3. Tested on OpenCart 4.1.0.4 and 3.0.5.1 with the default themes; other 4.0.2.x to 4.1.x and 3.0.3.x to 3.0.5.x versions are expected to work but are not tested.

Installation

Requirements: OpenCart 4.0.2.0 - 4.1.x or 3.0.3.x - 3.0.5.x, PHP 7.4 or newer with GD (challenge images) and OpenSSL (two-step sign-in). cURL only if you use Turnstile, hCaptcha or reCAPTCHA.

OpenCart 4

1. Extensions > Installer > Upload kv_security_antispam.ocmod.zip, then click the green Install button in the list.
2. Extensions > Extensions > choose Modules > Security & Anti-Spam > Install (green plus), then Edit. The page is also in the menu under System > Security & Anti-Spam.
3. The install makes Security & Anti-Spam the store captcha (System > Settings > Option > Captcha) on registration, reviews, returns, contact and blog comments. Your previous captcha is remembered and comes back when you uninstall.
4. Open File monitor and click Scan now: the first scan records your current files as the trusted baseline.
5. Open Two-step sign-in and turn on the authenticator app or add a passkey for your own account.

OpenCart 3

1. Extensions > Installer > Upload kv_security_antispam-oc3.ocmod.zip.
2. Extensions > Modifications > Refresh (the package makes no OCMOD changes; the refresh is OpenCart's usual step).
3. Extensions > Extensions > Modules > Security & Anti-Spam > Install, then Edit (also under System > Security & Anti-Spam).
4. Run the first file scan and set up two-step sign-in as above.
5. Add the cron address shown on the File monitor tab to your host's cron (once a day). OpenCart 3 has no built-in cron.

Defaults after the install: built-in check (no third party), every form protected, time trap 3 seconds, visible check as a 5-character image code, 10 submissions per form per address in 15 minutes, disposable e-mail rule on, admin lock after 5 wrong passwords in 15 minutes with the image check after 2, admin access key and IP allow-list off, two-step sign-in available to every administrator (required for nobody), daily file scan, log kept 90 days with shortened addresses.

Behind a proxy or load balancer

Cloudflare is recognised automatically (its CF-Connecting-IP header is trusted only from Cloudflare addresses). Behind another proxy, add its addresses under Spam protection > Trusted proxies so the visitor address is read from X-Forwarded-For. Never list addresses you do not control.

Uninstall

Extensions > Extensions > Modules > Security & Anti-Spam > Uninstall restores your previous store captcha and captcha page list and removes the events, the OpenCart 4 cron job, the settings, the log, the two-step sign-in data and the file baseline. Export the log as CSV first if you need it. Administrators who used two-step sign-in sign in with the password only afterwards.

Licence

Enter the licence key from your Kavio Labs account in the extension settings. The extension works for 14 days without a key. Without a valid key the storefront forms are no longer checked; the admin protections (lockout, access key, IP allow-list, two-step sign-in) keep working, so an expired licence never makes your admin less safe.

Configuration

The page has eight tabs: Dashboard, Spam protection, Content rules, Admin login, Two-step sign-in, File monitor, Health check and Security log. Every tab saves on its own.

Spam protection

• Forms. Each form is Off, Protected (background check, the visible check only when needed) or Always ask the visible check. Registration, guest checkout (OpenCart 3), reviews, returns, contact and blog comments (OpenCart 4.1) are OpenCart captcha pages: switching one off here also removes it from System > Settings > Option > Captcha pages. Customer login, forgotten password and the admin login are checked by this extension.
• Check method. Built-in (default: no third party, no cookies), Cloudflare Turnstile, hCaptcha or Google reCAPTCHA v3 with your site key and secret key; for reCAPTCHA v3 the lowest score that passes (0.5 by default). Without both keys, or when the service does not answer, the built-in check decides.
• Visible check. A distorted 5-character code or a simple sum (7 + 4). Shown only when the background check fails, when an address goes over the limit, or for forms set to always ask.
• Time trap. Seconds between the first use of the form and the submit (default 3). The page waits on its own when a person is faster, so nobody sees an error.
• Background work. Light, Normal (default) or Strong proof of work, or Off for the time trap only.
• Logged-in customers. Skip the check for signed-in customers on reviews, returns and contact (default on).
• Attempts per address. Submissions per form per address in the window (default 10 in 15 minutes). Above the limit the visible check is asked; at twice the limit the address waits until the window ends.
• Never check these addresses. Your office or a monitoring service: IPs, CIDR ranges (198.51.100.0/24) or from - to ranges, one per line.
• Trusted proxies. Only behind your own load balancer or proxy. Cloudflare needs no entry.
• Extra routes. Forms of other extensions: the route their form posts to, one per line (for example extension/acme_form/module/form.send on OpenCart 4 or extension/module/acme_form/send on OpenCart 3). They get the hidden field and the background check; visitors need JavaScript for these forms.

Content rules

• Disposable e-mail addresses. A bundled list of throw-away mail services, checked on registration, guest checkout, contact, reviews, returns and forgotten password. Add domains or allow domains of the list.
• Links in names and links in messages (default: at most 2 links in a review, contact message, return comment or blog comment; -1 for no limit).
• Blocked words. One word or phrase per line, any case; seeded on OpenCart 4.1 from the blog anti-spam list.
• Text only in another script. Refuse messages written only in Cyrillic, only in Chinese/Japanese/Korean, or both. Off by default.
• Countries. Allow only, or refuse, the listed countries on the storefront forms. Needs Cloudflare's country header or the GeoIP database of our Bot & Country Blocker; without either the rule stays inactive.

Admin login

• Admin access key. Turn it on, then bookmark the address shown (https://your-shop/admin/?k=...). Without the key, every admin page answers "Not Found" with status 404; with it once, the browser keeps a 30-day cookie. New key and Turn off are on the same card. The key never applies to the storefront, the OpenCart API, cron jobs or payment callbacks.
• Login lockout. Wrong passwords per address and per user name in the window (default 5 in 15 minutes), the visible check after 2 failures (0 = never), optional e-mail to the store address on a lock (OpenCart 4 also shows a notification).
• IP allow-list. Only the listed addresses can open the admin. The save is refused when your own address is missing.
• Locked out? Create an empty file kv_security_antispam.off in the OpenCart storage folder (the path is shown on the tab; by default system/storage/). While the file exists, the access key, IP allow-list, lockout and two-step sign-in are off. Delete it when you are back in.

Two-step sign-in

• Your account. Scan the QR code with an authenticator app and type the code to turn it on; save the ten backup codes shown once. Add passkeys (fingerprint, face, Windows Hello, a security key); passkeys need the admin on https://.
• Rules for all users. On or off for the shop; required for nobody, every admin user, or users in chosen user groups (they set it up right after their next password sign-in); trusted browsers for 0 - 365 days (default 30).
• Admin users. Who uses which second step. Users who can edit admin users can reset another user (lost phone).
• OpenCart 4.1's own e-mail device check (System > Settings > Option) can stay on: users with an authenticator app or passkey skip the e-mail code; others still get it.

File monitor

• Scan now runs in steps until every file is checked; the first scan records the baseline.
• Daily scan. OpenCart 4: the job "kv_security_antispam" in Extensions > Cron jobs (your server must call the OpenCart cron). OpenCart 3: the cron address with its key shown on the tab.
• Accept one file or Accept all after you updated OpenCart or an extension yourself. Start a new baseline forgets every recorded file.

Security log

Filters by form, outcome, dates and text; CSV export; rows older than the retention (default 90 days) are removed by the daily job. Addresses are stored shortened to /24 (IPv4) or /48 (IPv6), or not at all.

Usage

What your customers see

A small line under each protected form: "Protected by a private spam check, no cookies". When a visitor starts typing, the page fetches a signed ticket and solves a small proof of work in the background (about 0.2 seconds on a phone). If they press Send very quickly, the page waits the remaining second or two and sends the form itself.

The visible check (image code or sum) appears only when it is needed: JavaScript off, a submission faster than the time trap, too many attempts from one network, or a wrong answer. A refresh button draws a new image. Without JavaScript the image is shown right away (OpenCart 3 forms work without JavaScript; OpenCart 4 forms need it anyway).

Rules on content give a clear message: "Please use a permanent e-mail address", "Your message contains too many links", "Too many attempts from your network. Please wait 12 minutes".

What bots get

• Posts without a ticket, with a filled hidden field, a forged or reused ticket, or sent faster than a person: refused or asked for the image.
• Many attempts from one address: the image for every attempt, then a wait.
• Password guessing on the admin: the image after two failures, a lock after five, per address and per user name.
• Scanners looking for /admin/: a plain "Not Found" page when the access key is on.

Dashboard

Spam stopped, visible checks asked, real submissions and refused admin attempts in the last 30 days; a daily chart; the reasons why submissions were stopped; a table per form; a protection checklist with the security score from the health check.

Daily routine

Nothing. Look at the dashboard now and then. When the file monitor reports changes:

1. If you just updated OpenCart, a theme or an extension yourself, click Accept all.
2. If you did not, open each file: a red flag (PHP in image/ or an upload folder, a web shell name) means the shop is probably compromised. Restore the files from a clean backup, change all admin and database passwords and ask your host for help.

After you lock yourself out

1. Create the empty file kv_security_antispam.off in the OpenCart storage folder (FTP or the host's file manager).
2. Sign in with your password only.
3. Fix the setting (new access key, add your address to the allow-list, reset two-step sign-in of the user).
4. Delete the file.

A user who lost the phone can sign in with a backup code; another administrator can also reset the user on the Two-step sign-in tab.

With our other extensions

• Page Speed & Cache Pro: forms on cached pages work; tickets and images are never cached.
• Bot & Country Blocker: blocks bots and countries for the whole store; this extension reads its GeoIP database for the per-form country rule.

FAQ

Do I need Google reCAPTCHA?

No. The built-in check stops form bots without any third party: a hidden field, a time trap and a small proof of work, plus an image check on your own server when needed. Nothing is sent to Google, and the check sets no cookie, so there is nothing to add to your cookie banner. Turnstile, hCaptcha and reCAPTCHA v3 are there if you prefer them.

Will real customers have to solve puzzles?

Almost never. People who type normally pass the background check without seeing anything. The image check appears for submissions without JavaScript, faster than a person can type, or many attempts from one network.

What does OpenCart already do, and what does this add?

OpenCart locks a customer e-mail address after too many wrong passwords, OpenCart 3.0.5 also locks an admin user name, and OpenCart 4.1 can e-mail a code for new admin devices and shows a security page. This extension adds limits per address (bots try many e-mail addresses from one network), checks on every customer form, an admin access key, an IP allow-list, authenticator apps and passkeys, a file change monitor and a health check.

Is the admin access key enough on its own?

It hides the admin from scanners and bots, which removes most password guessing. Use it together with two-step sign-in: a stolen password then opens nothing.

I locked myself out. What now?

Create an empty file kv_security_antispam.off in the OpenCart storage folder over FTP or your host's file manager. Every admin protection is off while it exists; sign in, fix the setting and delete the file.

Does it work with page caches?

Yes. The form widget is the same HTML for every visitor; tickets and images come by AJAX and are never cached. Tested with our Page Speed & Cache Pro.

Does it work behind Cloudflare?

Yes. The visitor address comes from CF-Connecting-IP only when the request really comes from a Cloudflare address, and the country rule can use CF-IPCountry. Behind another proxy, list its addresses as trusted proxies.

Do passkeys work on my shop?

Browsers allow passkeys only on secure pages: your admin must run on https://. Authenticator apps work everywhere.

Will the file monitor slow my shop down?

No. It runs once a day in short steps (OpenCart 4 cron or the cron address on OpenCart 3) and when you click Scan now; visitors never trigger it.

What is stored about visitors?

Refused submissions and admin events: form, reason, address shortened to /24 (IPv4) or /48 (IPv6) or not at all, country when known, a hash of the browser name, time. Kept 90 days by default. Passed submissions are only counted per day.

Does it use OCMOD or change core files?

No. Events and an OpenCart captcha extension; nothing in OpenCart's files is changed.

Does it block countries or bots for the whole store?

No, that is our Bot & Country Blocker. This extension protects forms and the admin; the country rule applies to the storefront forms only.