See who is loading your site and shut out unwanted IPs

Shut out bots and unwanted IPs: traffic monitoring, block and allow lists and a Cloudflare connection, right in your store admin

158

Built in

Already in every Turboshop store — nothing to install or pay for

Cover of the “Store security and protection” add-on

What it gives your business

Your site serves shoppers, not bots

We at Turboshop put IP blocking right into the admin, so you can shut out malicious scanners and bots that load your server without calling a developer.

Decisions based on facts

Monitoring shows which addresses send requests and how many, so you block exactly those causing trouble and leave real shoppers alone.

Your team never gets locked out

An allow list and self-block protection make sure you, your office and contractors don’t lose access to the site because of a mistaken rule.

A fresh site right after updates

If your store runs behind Cloudflare, you can purge its cache with one button in the admin, so shoppers see the new design or prices without waiting.

Features

Block list for IPs and ranges

Denies site access to a single address or a whole subnet in CIDR notation, for both IPv4 and IPv6.

Allow list for trusted addresses

Allow rules take priority over blocks, so your office and contractors get through even under a broad block.

Temporary rules

Set a “Valid until” date on a block or allow rule, and it stops applying on its own after that.

Reason and author

Each rule keeps a comment and who added it, so a month later it is clear why it exists.

Hit counter

See how many times a rule has fired and when it last did, to tell which blocks are still needed.

Self-block protection

The admin won’t save a block that covers your own IP and warns you instead.

1, 5 or 15-minute traffic monitoring

Start a session and get a summary per IP: request count, unique pages, User-Agent, first and last request.

One-click block from monitoring

Block a suspicious address straight from the monitoring table.

Automatic history clean-up

Monitoring records are deleted automatically after 10 days, and you can also clear the history manually.

Cloudflare connection and cache purge

Enter the API token and Zone ID from your own Cloudflare account: they are verified before saving, and then a full cache purge becomes available.

Who it is for

Stores that are regularly visited by bots and scanners.
Owners who have noticed unusual load on their site.
Teams working in the admin from an office and with contractors.
Stores behind Cloudflare that often update their design.

How to connect

1Sign in to your Turboshop dashboard and pick a store.
2Open the add-on and connect it — paid ones are checked out in the dashboard.
3The add-on turns on in your store admin, with settings in its own section.

FAQ

What does a blocked visitor see?

Instead of your store pages, they get a short message saying access from their IP is denied. The rule applies as soon as it is saved, and you can delete it at any time.

Could I block real shoppers by accident?

We recommend running monitoring first and blocking only addresses with clearly suspicious activity, not broad ranges at random. Add your own work IPs to the allow list, which takes priority over blocks.

Do I have to connect Cloudflare?

No, blocking and monitoring work without it. The integration is only for stores already using Cloudflare: you need your own account and an API token with cache purge and zone read permissions.

Does this protect against every attack?

The add-on gives you IP-based access control and visibility into traffic, but it is not full DDoS protection. For large-scale attacks, use network-level protection at the CDN or hosting level.