Threat Detection
Threat detection and automatic blocking are available with the Pro license. Get your Pro license to access this feature.
Sentinel detects and blocks malicious requests automatically using signature-based pattern matching.
How it works
- Request Analysis: Every HTTP request is analyzed before reaching PrestaShop — query string, raw body, form fields (including
multipart/form-datasubmissions) and uploaded file names. Percent-encoding is undone first, so encoding a character does not hide a payload. - Pattern Matching: The request is compared against known threat signatures downloaded from the Sentinel API
- Instant Blocking: If a malicious pattern is detected, the request is blocked with HTTP 403
- Logging: All detected attacks are logged with details (IP, URI, pattern matched)
Pattern matching runs with a backtracking budget set by Sentinel, so behaviour does not depend on your host's PHP configuration. If a request is crafted so that the matching engine gives up before finishing — a known way of slipping a payload past signature-based filters — the request is treated as a threat and blocked, never as clean traffic. A signature that fails to compile is ignored instead, so a faulty pattern cannot block your visitors.
One exception: when the engine gives up on a request coming from the back office with a signed-in employee session, the request is not blocked. A very large back-office form can exhaust the budget of a greedy signature without carrying anything hostile, and blocking there would cost your team a page over a check that never reached a conclusion. The event is recorded in the security logs as Detection Skipped, with the signature involved and the reason the check could not be completed. A signature that actually matches still blocks the request, employee session or not.
Signature Updates
Threat detection signatures are managed remotely on the Sentinel API and synchronized automatically:
- At installation: Signatures are downloaded when the module is installed
- Daily sync: The back-office automatically checks for updated signatures once every 24 hours
- Manual download: If signatures are missing, the module configuration page displays a warning with a button to download them manually
This approach ensures your store is always protected with the latest threat signatures without requiring a module update.
Protected Threats
SQL Injection
Detects attempts to manipulate your database:
Example: /index.php?id=1' AND SELECT SLEEP(5)--
Sentinel blocks patterns like:
SELECT ... SLEEP ...UNION SELECT ...- SQL keywords in suspicious contexts
File Operations
Detects attempts to write malicious files:
Example: file_put_contents('shell.php', '<?php ...')
Blocks attempts to:
- Write files with
file_put_contents - Download remote code with
wget - Modify PHP configuration with
ini_set
Command Execution
Prevents execution of system commands:
Example: system('rm -rf /')
Module Exploits
Detects known vulnerabilities in popular PrestaShop modules:
- Product Search module
- Blog modules (CSBlog, SmartBlog, etc.)
- Payment modules
Suspicious HTTP Headers
Detects malicious or suspicious HTTP headers:
- Security scanners: Blocks requests from known scanning tools (sqlmap, nikto, nmap, dirbuster, etc.)
- Empty User-Agent: Blocks requests with no User-Agent header (common in automated attacks)
- Log4Shell: Detects JNDI injection attempts in HTTP headers
When an attack is detected
- Request is blocked with HTTP 403 Forbidden
- Custom page is displayed to the attacker
- Attack is logged in
/var/logs/sentinel-YYYY-MM-DD.log - Context is recorded: IP address, URI, matched pattern, request data
Example of blocked request
When someone tries:
https://yourstore.com/index.php?search=SELECT SLEEP(10)
They see:
HTTP 403 Forbidden
Access Denied
Your request has been blocked for security reasons.
And Sentinel logs:
{
"ip": "192.168.1.100",
"uri": "/index.php?search=SELECT SLEEP(10)",
"pattern": "(.*)select(.*)sleep(.*)",
"method": "GET"
}
Next: Security Logs