0

I recently suffered 2 credit card attacks on my live site with traffic on the first attack coming from Singapore and on the second it came via the USA from someone in Vietnam.

By card attacks I mean someone added the cheapest item on our site to their basket and then submitted hundreds of payment cards through out checkout triyng to find which were valid. The first attack was circa 800 cards attempted and the second was circa 600 before I got alerts and shut the site down.

We don't sell other than in the UK as we run a Butcher's shop so I thought I'd block all traffic excluding EU and UK. We do sometimes get people pre-ordering from outside the UK if they holiday somewhere in the UK but this is rare.

I've added the following to my .htaccess file but now I'm getting Google, Bing and Facebook Catalogue problems and both Facebook catalogue uploads and SEO is being heavily impacted.

GeoIPEnable On

SetEnvIf GEOIP_COUNTRY_CODE UK AllowCountry
SetEnvIf GEOIP_CONTINENT_CODE EU AllowCountry

Deny from all
Allow from env=AllowCountry

I'm not that advanced on how to configure .htaccess and would really appreciate any advice you could offer.

What I'm trying to achieve is to block user traffic but allow services/bots / FB to reach me.

I hope that makes sense.

1

As much as blocking countries appears like a quick win, the main downfall that I found in my experience with this method is that crawlers are sometimes needed to promote the website.

I allow myself to make a small list of possible scenarios to consider:

  • block robots that are visiting to put your site in trouble (scams, DDOS, content harvesting..)
  • genuine crawlers like Google
  • your genuine visitors and some may happen to shop on your site from abroad
  • finally, a hacker can use the UK IP to work around your DIY solution

Having said this, there are solutions out there that are commonly used to address your issue.

  • use of GEOIP I have read it is mentioned to need updating regularly regularly and can give slow loads of your site.
  • enhancing private sales within your site can evade the issue as it can help your site to offer some areas with better user experience. Once the customer is logged in, you can filter the user with more reliable data (email, regular user, payment verified..)

I am in no mean expert in this subject and I read primarily the below to build this answer. I have implemented MaxMind on a busy site at one time and supported store owners selling in private sales type of websites. Hence my suggestions to pursue your task. Good luck

https://www.sitepoint.com/how-to-block-entire-countries-from-accessing-website/ https://www.newcmi.com/blog/tip-of-the-week-spot-a-hacker-by-investigating-their-ip-address

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.