Skip to main content

Threat Detection

Pro Feature

Threat detection and automatic blocking are available with the Pro license. Get your Pro license to access this feature.

Sentinel detects and blocks malicious requests automatically using signature-based pattern matching.

How it works​

  1. Request Analysis: Every HTTP request is analyzed before reaching PrestaShop — query string, raw body, form fields (including multipart/form-data submissions) and uploaded file names. Percent-encoding is undone first, so encoding a character does not hide a payload.
  2. Pattern Matching: The request is compared against known threat signatures downloaded from the Sentinel API
  3. Instant Blocking: If a malicious pattern is detected, the request is blocked with HTTP 403
  4. Logging: All detected attacks are logged with details (IP, URI, pattern matched)
Oversized or malformed requests

Pattern matching runs with a backtracking budget set by Sentinel, so behaviour does not depend on your host's PHP configuration. If a request is crafted so that the matching engine gives up before finishing — a known way of slipping a payload past signature-based filters — the request is treated as a threat and blocked, never as clean traffic. A signature that fails to compile is ignored instead, so a faulty pattern cannot block your visitors.

Signature Updates​

Threat detection signatures are managed remotely on the Sentinel API and synchronized automatically:

  • At installation: Signatures are downloaded when the module is installed
  • Daily sync: The back-office automatically checks for updated signatures once every 24 hours
  • Manual download: If signatures are missing, the module configuration page displays a warning with a button to download them manually

This approach ensures your store is always protected with the latest threat signatures without requiring a module update.

Protected Threats​

SQL Injection​

Detects attempts to manipulate your database:

Example: /index.php?id=1' AND SELECT SLEEP(5)--

Sentinel blocks patterns like:

  • SELECT ... SLEEP ...
  • UNION SELECT ...
  • SQL keywords in suspicious contexts

File Operations​

Detects attempts to write malicious files:

Example: file_put_contents('shell.php', '<?php ...')

Blocks attempts to:

  • Write files with file_put_contents
  • Download remote code with wget
  • Modify PHP configuration with ini_set

Command Execution​

Prevents execution of system commands:

Example: system('rm -rf /')

Module Exploits​

Detects known vulnerabilities in popular PrestaShop modules:

  • Product Search module
  • Blog modules (CSBlog, SmartBlog, etc.)
  • Payment modules

Suspicious HTTP Headers​

Detects malicious or suspicious HTTP headers:

  • Security scanners: Blocks requests from known scanning tools (sqlmap, nikto, nmap, dirbuster, etc.)
  • Empty User-Agent: Blocks requests with no User-Agent header (common in automated attacks)
  • Log4Shell: Detects JNDI injection attempts in HTTP headers

When an attack is detected​

  1. Request is blocked with HTTP 403 Forbidden
  2. Custom page is displayed to the attacker
  3. Attack is logged in /var/logs/sentinel-YYYY-MM-DD.log
  4. Context is recorded: IP address, URI, matched pattern, request data

Example of blocked request​

When someone tries:

https://yourstore.com/index.php?search=SELECT SLEEP(10)

They see:

HTTP 403 Forbidden
Access Denied
Your request has been blocked for security reasons.

And Sentinel logs:

{
  "ip": "192.168.1.100",
  "uri": "/index.php?search=SELECT SLEEP(10)",
  "pattern": "(.*)select(.*)sleep(.*)",
  "method": "GET"
}

Next: Security Logs