QKits AutoBan Security Suite
Advanced Log Analysis + Search Abuse Protection with Permanent Server-Level IP Blocking
QKits AutoBan Security Suite is a fully integrated Magento 2 security system designed to detect,
analyze, and permanently block malicious traffic at the web server level.
This is not a simple IP blocker.
It converts real traffic data into permanent server-level bans using intelligent log analysis
and multi-category threat detection.
Permanent Server-Level Blocking (.htaccess Enforcement)
When an IP is confirmed abusive, the system writes a deny rule directly into your .htaccess file.
The request is blocked before Magento ever processes it.
- No PHP execution
- No Magento bootstrap
- No database connection
- No wasted server resources
Your server never has to process requests from that IP ever again.
Live Monitoring and Scheduled Scanning
Every 15 minutes (configurable via cron), the Log Analyzer scans your HTTP transfer log for:
- Webshell probes
- WordPress and CMS probes
- Admin panel hunting
- Environment file scanning (.env, .git, backups)
- SQL injection attempts
- XSS attempts
- Path traversal patterns
- Suspicious user agents
- High-frequency error scanners
IPs must meet configurable multi-category thresholds before being automatically banned.
Analyze Historical Log Files and Build a Ban List in Minutes
AutoBan is not limited to live monitoring.
Through the built-in Log Scanner interface in Magento admin, you can scan previous
transfer logs and rotated archives.
- Select one or multiple log files
- Supports daily rotated logs
- Supports zipped archives
- Scans full historical files
- Displays threat categories per IP
- Drill-down view with sample request URLs
- Bulk select and ban detected IPs
Turn weeks or months of historical attack traffic into a permanent ban list within minutes.
Smart Detection Logic
AutoBan uses error-rate analysis to distinguish real visitors from automated scanners.
- Legitimate visitor: high traffic, low error rate — not flagged
- Automated scanner: high error rate and probe patterns — flagged
Whitelisted IPs are never banned.
Suspicious user agents alone do not trigger bans unless configured.
AutoBan Mode
Turn your site on AutoBan — and it will never be faster.
Attack → Detection → Permanent Server Ban.
Fully automated.
CLI Support
The detection engine can also be run from the command line:
bin/magento qkits:searchabuse:scan-logs
bin/magento qkits:searchabuse:scan-logs --dry-run
bin/magento qkits:searchabuse:scan-logs --file=/path/to/transfer.log
Compatibility
- Magento 2.4.7-p8 compatible
- CSP compatible
- Apache and Nginx logs supported
- Nexcess log rotation supported
- Shared hosting compatible
- Requires active cron
Your Logs Already Contain the Evidence.
AutoBan turns that evidence into permanent protection.
Detect. Analyze. Ban. Enforce at the server level.