LykanShield protection layer

Bad Bot Filter

Stop known abusive automation before it reaches expensive application logic.

Read integration guide View source on GitHub →

Overview

Fast User-Agent screening

LykanShield compares the incoming User-Agent against a locally cached list of unwanted bot signatures. Matching is case-insensitive, empty rules are ignored, and a positive match is written to the blocked-client log and reported to the network.

Request lifecycle

How it works

  1. 01

    Load locally

    Bot signatures are read from the protected local cache file.

  2. 02

    Match agent

    The request User-Agent is checked case-insensitively against each signature.

  3. 03

    Reject early

    Matches are logged, reported as BLACK_LIST_BOT, and terminated.

Implementation

Technical details

  • Operates before injection detection in the main request pipeline.
  • Uses local cache files to avoid a network request on every page load.
  • Adds timestamp, User-Agent, detection type, and IP to the local block log.
  • Can be toggled independently through filter_active.bad_bots.

Feature toggle

<?php
lykan_config::$config['filter_active']['bad_bots'] = true;
require __DIR__ . '/includes/lykan.class.php';
lykan::run(__DIR__);