# Introduction STOPBOT helps websites and applications identify suspicious traffic, reduce bot activity, and make safer access decisions before visitors reach protected content. It is designed for teams that need practical protection against automated traffic, abusive requests, fake visitors, risky IP addresses, suspicious user agents, and unwanted access patterns. STOPBOT can be used on landing pages, login pages, checkout pages, shortlinks, dashboards, admin pages, and other sensitive entry points. ### What STOPBOT Does STOPBOT receives visitor context from your website or application, analyzes the request, and returns a result that your system can apply immediately. Depending on the service you use, STOPBOT can: * allow legitimate visitors to continue * block suspicious visitors * redirect traffic based on your rules * return a custom page response * verify browser activity with JavaScript * identify IP address details * validate email addresses * identify phone number information * display traffic activity and reports in the STOPBOT panel ### Core Services | Service | Purpose | | --------------------- | ------------------------------------------------------------------------- | | Blocker | Detect suspicious visitors and return an allow or block decision | | Blocker V2 | Apply advanced protection rules with custom page responses | | SmartURLs | Protect and manage shortlink traffic with redirect and verification logic | | IP Lookup | Get IP geolocation, ISP, ASN, hostname, and network information | | Email Validation | Check email format, domain, MX, SPF, DMARC, and disposable email status | | Phone Number Identify | Validate and identify phone number type, carrier, country, and location | | Account | Review account package, quota, usage, and expiration status | ### How It Works The basic workflow is simple: ``` Visitor reaches your website -> Your server sends visitor context to STOPBOT -> STOPBOT validates and analyzes the request -> STOPBOT returns a decision or lookup result -> Your website applies the result -> Activity can be reviewed in the STOPBOT panel ``` STOPBOT should be integrated from your server side whenever an API key is required. Do not expose your API key in public frontend JavaScript, mobile app bundles, or public repositories. ### Who This Documentation Is For This documentation is intended for: * developers integrating STOPBOT into websites or applications * security teams reviewing visitor protection workflows * product teams using SmartURLs and traffic reports * support teams helping customers configure STOPBOT services * technical users who need clear API examples and service behavior ### Recommended Starting Points If you are new to STOPBOT, start with: | Page | Use It For | | ---------------------- | ----------------------------------------------- | | Workflow Overview | Understand the full protection flow | | Getting Started | Learn the basic integration steps | | Authentication & Quota | Understand API key usage, quota, and expiration | | Blocker | Add a simple traffic protection decision | | SmartURLs | Protect and control shortlink traffic | | Blocker V2 | Use advanced rules and custom page responses | | Error Codes | Handle failed or invalid requests correctly | ### Production Checklist Before using STOPBOT on a live website, confirm that: * your API key is active * your API key is stored only on the server side * your account has available quota * visitor IP forwarding is correct behind Cloudflare or a reverse proxy * your SmartURLs keynames are registered * your Blocker V2 configuration names are registered * allow, block, redirect, and page response behavior has been tested * traffic logs and reports appear in the STOPBOT panel ### Next Step Continue to the Workflow Overview to understand how STOPBOT processes visitors and returns decisions to your website. # Workflow Overview This page explains the current STOPBOT workflow from the moment a visitor reaches your website until the final decision and panel insights are available. The workflow is designed to help your website make fast security decisions while keeping the result easy to review from the STOPBOT panel. ### Workflow Diagram ```mermaid flowchart TD A[Visitor, Bot, or Crawler] --> B[Your Website, App, or SmartURLs] B --> C[Send Visitor Context] C --> D[STOPBOT] D --> E[Validate Account and Request] E --> F[Analyze Visitor Risk] F --> G{Decision} G -- Safe --> H[Allow Visitor] G -- Suspicious --> I[Block Visitor] G -- Custom Rule --> J[Redirect Visitor] G -- Page Rule --> K[Return Page Response] G -- Browser Check --> L[Run JavaScript Verification] H --> M[Activity Appears in STOPBOT Panel] I --> M J --> M K --> M L --> M ``` ### Traffic Decision Diagram ```mermaid flowchart TD A[Visitor Request] --> B[Validate Integration] B --> C[Load Your Protection Rules] C --> D[Check Visitor Identity] D --> E[Review IP, Location, Device, Browser, and URL] E --> F[Compare With Allowlist and Block Rules] F --> G[Evaluate Threat Signals] G --> H{Final Result} H -- Trusted --> I[Allow Access] H -- Blocked --> J[Block Access] H -- Needs Action --> K[Redirect or Show Custom Response] I --> L[Return Result to Your Website] J --> L K --> L L --> M[Update Panel Insights] ``` ### SmartURLs Verification Diagram ```mermaid sequenceDiagram participant V as Visitor Browser participant S as SmartURLs Website participant A as STOPBOT participant P as STOPBOT Panel V->>S: Open /{keyname} S->>A: Request SmartURLs decision A->>S: Return allow, block, redirect, or verification required alt JavaScript verification required S->>V: Render verification page V->>S: Browser completes verification S->>A: Confirm verification result A->>S: Verification accepted else No JavaScript verification A->>S: Continue without extra browser check end S->>V: Redirect or show the configured response A-->>P: Visitor activity appears in reports ``` ### Blocker V2 Page Response Diagram ```mermaid flowchart TD A[Visitor Opens Protected Page] --> B[Your Website Sends Visitor Context] B --> C[STOPBOT Reviews Configuration] C --> D[STOPBOT Analyzes Risk Signals] D --> E[STOPBOT Returns Decision and Page Response] E --> F{Should Access Be Blocked?} F -- No --> G[Show Normal Page] F -- Yes --> H{Configured Response} H -- Redirect --> I[Send Visitor to Another URL] H -- HTTP Status --> J[Return Custom HTTP Status] H -- Default Block --> K[Show Block Response] ``` ### Panel Insights Diagram ```mermaid flowchart LR A[Protected Traffic] --> B[STOPBOT Decision] B --> C[Activity Processing] C --> D[STOPBOT Panel] D --> E[Dashboard] D --> F[Recent Logs] D --> G[Blocker Reports] D --> H[SmartURLs Reports] D --> I[Blocker V2 Reports] ``` ### Complete System Flow ``` Visitor -> Your website, app, or SmartURLs -> Visitor context is sent to STOPBOT -> STOPBOT validates the request -> STOPBOT analyzes visitor risk -> STOPBOT returns a decision -> Your website applies the decision -> Activity can be reviewed in the STOPBOT panel ``` ### Main Components | Component | Purpose | | ------------------- | ------------------------------------------------------------------------------ | | Visitor | The person, bot, crawler, or automated request visiting your website | | Your website or app | Sends visitor context to STOPBOT before deciding what to do | | SmartURLs | Handles shortlink traffic and redirect decisions | | STOPBOT | Validates the request, analyzes visitor risk, and returns a decision | | Protection rules | Your allowlist, block rules, country rules, device rules, and service settings | | STOPBOT panel | Shows traffic activity, protection results, and service reports | ### 1. Visitor Reaches Your Website A visitor opens a protected page, shortlink, landing page, checkout page, login page, or any other page where STOPBOT protection is enabled. At this point, your website can collect the visitor context needed for analysis: * IP address * user agent * requested URL * optional request parameters * optional request headers The API key should stay on your server. Do not expose it in public frontend JavaScript. ### 2. Your Website Sends A Request To STOPBOT Your server sends the visitor context to the correct STOPBOT service. | Service | Main Purpose | | --------------------- | ----------------------------------------------------------------- | | Account | Check account status, usage, quota, and expiration | | Blocker | Detect and block suspicious traffic before it reaches your page | | SmartURLs | Analyze shortlink visitors and return the correct redirect action | | Blocker V2 | Apply advanced protection rules and custom page responses | | IP Lookup | Return IP, location, ISP, ASN, and network information | | Email Validation | Check email format, domain, MX, SPF, DMARC, and disposable status | | Phone Number Identify | Validate and identify phone number information | ### 3. STOPBOT Validates The Request Before analyzing traffic, STOPBOT checks that the request is allowed to continue. Validation includes: * API key is valid * account is active * quota is available * required parameters are present * service configuration exists * SmartURLs keyname or Blocker V2 configuration belongs to the account If validation fails, STOPBOT returns an error response so your integration can handle it clearly. ### 4. STOPBOT Analyzes Visitor Risk After validation, STOPBOT reviews the visitor using several security signals. Common checks include: * IP reputation * location and country rules * device and browser information * user agent behavior * hostname and network information * URL threat signals * allowlist and blocklist rules * SmartURLs or Blocker V2 configuration The goal is to decide whether the visitor looks safe, suspicious, blocked, or requires an additional browser check. ### 5. STOPBOT Returns A Decision STOPBOT returns a decision that your website can apply immediately. Possible results include: | Result | What Your Website Should Do | | ----------------------- | ------------------------------------------------------------------- | | Allow | Continue loading the normal page | | Block | Stop the visitor from accessing the protected content | | Redirect | Send the visitor to the configured destination | | HTTP status | Return the configured HTTP response code | | JavaScript verification | Ask the visitor browser to complete an additional verification step | | Lookup result | Display or process the returned lookup or validation data | ### 6. Blocker Workflow The Blocker service is used when your website wants a simple allow-or-block decision. ``` Visitor opens page -> Your server sends IP, user agent, and URL -> STOPBOT checks visitor risk and your rules -> STOPBOT returns allow or block result -> Your website continues or blocks the request ``` Use this workflow for pages where suspicious traffic should be stopped before the page is served. ### 7. SmartURLs Workflow SmartURLs is used when a shortlink needs to decide whether a visitor should be redirected, blocked, or verified first. ``` Visitor opens shortlink -> SmartURLs sends visitor context and keyname to STOPBOT -> STOPBOT checks the keyname and visitor risk -> STOPBOT returns redirect, block, or verification result -> SmartURLs applies the result ``` If JavaScript verification is required, the visitor browser completes the verification step before the final redirect. ### 8. Blocker V2 Workflow Blocker V2 is used when your website needs more advanced traffic control and custom page behavior. ``` Visitor opens protected page -> Your server sends visitor context and configuration name -> STOPBOT analyzes IP, browser, URL, parameters, headers, and rules -> STOPBOT returns block status and page response -> Your website shows the normal page, redirects, or returns a custom response ``` Use this workflow when you need more detailed protection logic for important pages. ### 9. Lookup And Validation Workflows Some services return information instead of a traffic decision. | Service | Returned Result | | --------------------- | ----------------------------------------------------------------- | | Account | Account package, quota, usage, and expiration status | | IP Lookup | IP location, network, ISP, ASN, and hostname information | | Email Validation | Email syntax, domain, MX, SPF, DMARC, and disposable email status | | Phone Number Identify | Phone validity, type, carrier, country, and location information | These services are useful for enrichment, verification, and application-side decision-making. ### 10. Panel Insights After protected traffic is processed, results can be reviewed in the STOPBOT panel. Panel insights may include: * total traffic * allowed visitors * blocked visitors * detected bots * countries and devices * SmartURLs activity * Blocker and Blocker V2 reports * API usage This helps you monitor protection performance and understand how visitors are being handled. ### 11. Error Workflow If a request cannot be processed, STOPBOT returns a clear error response. | Situation | Meaning | | ---------------------------------- | ----------------------------------------------------------------------- | | Bad request | Required parameters are missing or invalid | | Unauthorized | API key is invalid or not recognized | | Payment required | Quota is exhausted or the account is expired | | Not found or invalid configuration | The requested keyname or configuration is not available for the account | | Service unavailable | STOPBOT cannot process the request at that moment | Your integration should handle these responses gracefully, especially on production pages. ### 12. Production Checklist Before enabling STOPBOT on a live website, confirm that: * the API key is active * the API key is only used server-side * quota is available * visitor IP forwarding is correct behind Cloudflare or a reverse proxy * SmartURLs keynames are registered * Blocker V2 configuration names are registered * allow, block, redirect, and HTTP status behavior has been tested * logs and reports appear in the STOPBOT panel ### Final Workflow Summary ``` Visitor reaches your website -> Your website sends visitor context to STOPBOT -> STOPBOT validates the request -> STOPBOT analyzes visitor risk -> STOPBOT returns a decision -> Your website applies the result -> STOPBOT panel shows activity and reports ``` This workflow gives your website real-time protection while keeping the result easy to understand, monitor, and improve from the STOPBOT panel. # Summary Use this page as the main V2 documentation index for API references, service integration guides, and panel usage guides. ### V2 API Documentation * [Getting Started](https://docs.stopbot.net/v2/api-v2-documentation/getting-started) * [Authentication](https://docs.stopbot.net/v2/api-v2-documentation/authentication) * [Account](https://docs.stopbot.net/v2/api-v2-documentation/account) * [Blocker](https://docs.stopbot.net/v2/api-v2-documentation/blocker) * [Blocker V2](https://docs.stopbot.net/v2/api-v2-documentation/blocker-v2) * [SmartURLs](https://docs.stopbot.net/v2/api-v2-documentation/smarturls) * [IP Lookup](https://docs.stopbot.net/v2/api-v2-documentation/ip-lookup) * [Email Validation](https://docs.stopbot.net/v2/api-v2-documentation/email-validation) * [Phone Number Identify](https://docs.stopbot.net/v2/api-v2-documentation/phone-number-identify) * [Error Codes](https://docs.stopbot.net/v2/api-v2-documentation/error-codes) * [Migration From V1](https://docs.stopbot.net/v2/api-v2-documentation/migration-from-v1) ### Service Guides * [STOPBOT V2](https://docs.stopbot.net/v2/service-guides/stopbot-v2) * [Blocker](https://docs.stopbot.net/v2/service-guides/stopbot-v2/blocker) * [SmartURLs](https://docs.stopbot.net/v2/service-guides/stopbot-v2/smarturls) * [Blocker V2](https://docs.stopbot.net/v2/service-guides/stopbot-v2/blocker-v2) # Transfer Subcription Use this guide to move your active subscription from the old stopbot.net platform to this panel. Transfer Subscription lets existing stopbot.net customers claim their subscription here instead of starting over. There is no manual review — as soon as you confirm the transfer, the panel checks your stopbot.net account and activates your plan immediately. ### Where To Find This Page Open this link directly: ``` https://panel.stopbot.net/transfer-subscription ``` ### Before You Submit A Request Make sure the following are true before you submit a request: * You have an active, paid package on **stopbot.net** (the old platform). Trial packages do not qualify. * Your remaining quota on stopbot.net is greater than zero and your plan has not expired. * That package was purchased using the **same email address** registered on this panel. The transfer automatically matches your stopbot.net account using this email. * You have not already submitted a migration request. Each account can only submit **one** request. ### Transfer Terms Read these terms carefully. The transfer happens immediately when you confirm, and a successful transfer cannot be reversed. | Term | What It Means | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Plan and expiration | Your package name and expiration date on this panel are updated to match your stopbot.net plan. | | API quota | Only **50%** of your remaining quota on stopbot.net is transferred. For example, 10,000 requests remaining becomes 5,000 requests here, added on top of any quota you already have on this panel. | | Old account | Your stopbot.net account is no longer active after a successful transfer. | | Reversibility | This action is final and cannot be undone. | ### How To Submit A Migration Request 1. Log in to the panel, then open `https://panel.stopbot.net/transfer-subscription` directly (remember, it is not in the sidebar menu). 2. Check that the **Registered Email** shown on the page matches the email you used to purchase your package on stopbot.net. 3. Read the transfer terms shown on the page. 4. Click **Submit Migration Request**. 5. A confirmation dialog appears summarizing the 50% quota rule. Click **Yes, Transfer** to confirm, or **Cancel** to back out. Clicking **Yes, Transfer** immediately checks your stopbot.net account and completes the transfer in the same step — there is no waiting period. ### Possible Outcomes You get one of these results right after confirming: | Outcome | What It Means | What To Do | | ----------------------------------------------- | ------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | | **Migration Approved** | A matching, active, non-Trial stopbot.net subscription was found and transferred. | Go to your dashboard — your plan and quota are ready to use immediately. | | **Migration Rejected** — no account found | No stopbot.net account is linked to your registered email. | Double-check that both accounts use the same email, then contact support if you believe this is a mistake. | | **Migration Rejected** — no active subscription | A stopbot.net account was found, but it has no active, non-Trial plan with remaining quota. | Contact support if you believe this is a mistake. | | **Temporary error** | The panel could not reach the stopbot.net database, or could not save the update to your account. | Try submitting again. Contact support if the error keeps happening. | ### If Your Request Is Rejected The form only allows one submission per account, so once you get a **Migration Rejected** result, you cannot resubmit the form yourself. Contact support through live chat and our team can look into your case manually. ### Summary 1. Make sure your registered email matches an active, non-Trial stopbot.net subscription. 2. Submit the migration request and confirm the 50% quota rule. 3. The transfer completes immediately — there is no review period. 4. Approved: go to your dashboard and use your transferred plan. Rejected or errored: contact support. # API v2 Documentation * [Getting Started](https://docs.stopbot.net/v2/api-v2-documentation/getting-started) * [Authentication](https://docs.stopbot.net/v2/api-v2-documentation/authentication) * [Account](https://docs.stopbot.net/v2/api-v2-documentation/account) * [Blocker](https://docs.stopbot.net/v2/api-v2-documentation/blocker) * [Blocker V2](https://docs.stopbot.net/v2/api-v2-documentation/blocker-v2) * [SmartURLs](https://docs.stopbot.net/v2/api-v2-documentation/smarturls) * [IP Lookup](https://docs.stopbot.net/v2/api-v2-documentation/ip-lookup) * [Email Validation](https://docs.stopbot.net/v2/api-v2-documentation/email-validation) * [Phone Number Identify](https://docs.stopbot.net/v2/api-v2-documentation/phone-number-identify) * [Error Codes](https://docs.stopbot.net/v2/api-v2-documentation/error-codes) * [Migration From V1](https://docs.stopbot.net/v2/api-v2-documentation/migration-from-v1) # Getting Started Use this page as a quick starting point for the STOPBOT api/v2, with links to the setup details, authentication guide, account check, endpoint references, and error handling pages. STOPBOT provides public API services for bot detection, SmartURLs, IP lookup, email validation, phone number identification, and account status checks. ### Quick Start Links | What You Need | Go To | Purpose | | --------------------------- | ------------------ | --------------------------------------------------------------- | | Understand the request flow | Workflow Overview | See how STOPBOT receives visitor context and returns a decision | | Prepare your API key | Authentication | Learn how to send and protect your API key | | Test your API key | Account | Check package, quota, usage, and expiration | | Choose a service | Available Services | Pick the endpoint that matches your use case | | Handle failed requests | Error Codes | Understand common error responses | | Move from the old API | Migration From V1 | Compare legacy and current endpoint behavior | ### Quick Start Path For a new integration, follow this order: 1. Read Authentication. 2. Test your API key with Account. 3. Choose a service from Available Services. 4. Open the selected endpoint page and follow its request example. 5. Review Error Codes before using the integration in production. ### Before You Start Before making your first request, make sure you have: * an active STOPBOT account * an API key from the STOPBOT panel * available quota on the API key * a backend server or server-side application for sending API requests Your API key should stay on the server side. For API key format and security recommendations, see Authentication. ### Base URL Use this base URL for current STOPBOT API integrations: ``` https://api.stopbot.net/services ``` If you are migrating from the legacy API at `https://stopbot.net/api`, see Migration From V1. ### Request Method All public STOPBOT service endpoints use `GET`. ``` GET https://api.stopbot.net/services/{endpoint} ``` Parameters are sent as query parameters. Authentication uses the `apikey` query parameter, which is explained in Authentication. ### Basic Request Pattern Most requests follow this pattern: ``` https://api.stopbot.net/services/{endpoint}?apikey={API_KEY}¶meter=value ``` Your first request should usually be the Account endpoint. ```bash curl "https://api.stopbot.net/services/account?apikey={API_KEY}" ``` If this request succeeds, continue to the service endpoint that matches your use case. ### Available Services | Service | Endpoint | Documentation | | --------------------- | ------------------- | --------------------- | | Account | `/account` | Account | | Blocker | `/blocker` | Blocker | | Blocker V2 | `/blockerv2` | Blocker V2 | | SmartURLs | `/shorterlink` | SmartURLs | | IP Lookup | `/iplookup` | IP Lookup | | Email Validation | `/email-validation` | Email Validation | | Phone Number Identify | `/phonenumber` | Phone Number Identify | ### Response Format STOPBOT returns JSON responses. Each endpoint page explains the exact success and failed response shape for that service. Most successful responses include: ```json { "status": "success", "executionTime": "1.23ms", "timeResponse": "2026-07-07 12:00:00" } ``` Some services also include endpoint-specific decision fields. For example, Blocker V2 uses `blockAccess`, `detectActivity`, `pageResponseType`, and `pageResponseContents`. For failed responses, see Error Codes. ### Next Steps | If You Want To | Read | | ---------------------------------------- | ----------------- | | Learn how the full protection flow works | Workflow Overview | | Understand API key usage | Authentication | | Check quota and expiration | Account | | Add standard visitor protection | Blocker | | Protect shortlink traffic | SmartURLs | | Use advanced page responses | Blocker V2 | | Handle errors correctly | Error Codes | # Authentication Every STOPBOT API request requires an API key. The API key identifies your account and allows STOPBOT to process requests for your services. Authentication is used across all endpoints, including Account, Blocker, Blocker V2, SmartURLs, IP Lookup, Email Validation, and Phone Number Identify. ### API Key Parameter Send your API key using the `apikey` query parameter. ``` apikey={API_KEY} ``` Example: ``` https://api.stopbot.net/services/account?apikey={API_KEY} ``` ### Authenticated Request Examples Account: ```bash curl "https://api.stopbot.net/services/account?apikey={API_KEY}" ``` IP Lookup: ```bash curl "https://api.stopbot.net/services/iplookup?apikey={API_KEY}&ip=1.1.1.1" ``` Blocker: ```bash curl "https://api.stopbot.net/services/blocker?apikey={API_KEY}&ip=1.1.1.1&ua={USER_AGENT}&url={URL}" ``` SmartURLs: ```bash curl "https://api.stopbot.net/services/shorterlink?apikey={API_KEY}&ip=1.1.1.1&keyname={KEYNAME}&ua={USER_AGENT}&url={URL}" ``` ### API Key Format API keys must use alphanumeric characters. ``` A-Z a-z 0-9 ``` Use the full API key exactly as provided in the STOPBOT panel. ### Security Recommendations * Keep your API key on the server side. * Do not expose your API key in browser-only JavaScript. * Do not commit your API key to public repositories. * Do not place your API key in mobile app bundles. * Rotate your API key if it has been exposed. * Use environment variables or server-side configuration for production. ### Common Authentication Errors Invalid API key format: ```json { "errorMessage": "Apikey format is invalid.", "status": "failed" } ``` API key not found: ```json { "status": "failed", "errorMessage": "API key not found. Please check your API key or create a new one." } ``` ### Authenticated Access Errors These errors can appear after an API key is recognized, but the request cannot continue because account access is not available. Subscription expired or quota limit reached: ```json { "status": "failed", "errorMessage": "Please increase your quota or extend the duration of your API key." } ``` ### Next Step After your API key is ready, continue to the endpoint that matches your integration needs. # Account Check API key status, package, quota, usage, and expiration before using protected STOPBOT services. The Account endpoint helps you confirm whether an API key is active, which package is assigned, how much quota is available, how much usage has been consumed, and when the API key expires. ### Endpoint ``` GET https://api.stopbot.net/services/account ``` ### Parameters | Parameter | Required | Description | | --------- | -------- | -------------------- | | `apikey` | Yes | Your STOPBOT API key | ### Example Request ```bash curl "https://api.stopbot.net/services/account?apikey={API_KEY}" ``` ### Successful Response ```json { "Apikey": "abcd************************wxyz", "ExpiredDate": "[UTC-0] 2027-05-12 20:17:18", "Packages": "Custom", "Quota": "250000", "Usage": "100", "executionTime": "4.65ms", "status": "success", "timeResponse": "2026-07-07 12:00:00" } ``` ### Response Fields | Field | Description | | --------------- | ------------------------------ | | `Apikey` | Masked API key | | `Packages` | Current API package name | | `Quota` | Total available quota | | `Usage` | Current usage count | | `ExpiredDate` | API key expiration date in UTC | | `status` | Request status | | `executionTime` | Server execution time | | `timeResponse` | Response timestamp | ### Quota And Usage Use `Quota` and `Usage` to understand how much capacity remains for the API key. ``` Remaining quota = Quota - Usage ``` Important notes: * A normal authenticated request usually uses 1 credit. * Email Validation may use additional credits after a successful validation. * Expired or depleted API keys cannot continue to protected service processing. * Review usage regularly from the Account endpoint and STOPBOT panel. ### Quota Or Expiration Error If the API key has no remaining quota or has expired, STOPBOT may return: ```json { "status": "failed", "errorMessage": "Please increase your quota or extend the duration of your API key." } ``` # IP Lookup Use IP Lookup to retrieve geolocation, network, ASN, ISP, hostname, user type, and connection type information for an IPv4 or IPv6 address. IP Lookup returns IP intelligence data only. It does not run the full Blocker or SmartURLs decision flow. ### Endpoint ``` GET https://api.stopbot.net/services/iplookup ``` ### Parameters | Parameter | Required | Description | | --------- | -------- | ------------------------------- | | `apikey` | Yes | Your STOPBOT API key | | `ip` | Yes | IPv4 or IPv6 address to inspect | ### Parameter Rules | Parameter | Rule | | --------- | ------------------------------------ | | `ip` | Must be a valid IPv4 or IPv6 address | ### Example Request ```bash curl "https://api.stopbot.net/services/iplookup?apikey={API_KEY}&ip=1.1.1.1" ``` ### Example Response ```json { "ip": "1.1.1.1", "hostname": "one.one.one.one", "asn": 13335, "userType": "hosting", "connectionType": "Corporate", "company": "Cloudflare, Inc.", "isp": "Cloudflare, Inc.", "city": "Sydney", "district": "", "region": "New South Wales", "postcode": "1001", "country": "Australia", "countryCode": "AU", "latitude": -33.8688, "longitude": 151.209, "timezone": "Australia/Sydney", "isAnycast": true, "status": "success", "executionTime": "3.55ms", "timeResponse": "2026-07-07 12:00:00" } ``` ### Invalid Input Example If the `ip` parameter is missing or is not a valid IPv4/IPv6 address, IP Lookup returns `400 Bad Request`. ```bash curl "https://api.stopbot.net/services/iplookup?apikey={API_KEY}&ip=not-an-ip" ``` Example response: ```json { "errorMessage": "IP format is invalid.", "status": "failed", "executionTime": "25.07us", "timeResponse": "2026-07-07 12:00:00" } ``` ### Response Fields | Field | Description | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `ip` | Queried IP address from the `ip` request parameter | | `hostname` | Hostname or PTR value resolved for the IP. If no hostname is available, the IP itself may be returned | | `asn` | Autonomous System Number from IP geolocation data | | `userType` | Network user type from IP geolocation data. Current values are `business`, `cellular`, `hosting`, and `residential`. If unavailable, STOPBOT returns `unknown` | | `connectionType` | Network connection type from IP geolocation data. Current values are `Cable/DSL`, `Cellular`, `Corporate`, and `Dialup`. If unavailable, STOPBOT returns `unknown` | | `company` | Autonomous system organization or company name from IP geolocation data. If unavailable, STOPBOT returns `unknown` | | `isp` | Internet service provider name from IP geolocation data. If unavailable, STOPBOT returns `unknown` | | `city` | City name from IP geolocation data. If unavailable, STOPBOT may return `unknown` | | `district` | District or second subdivision from IP geolocation data when available | | `region` | Region or first subdivision from IP geolocation data. If unavailable, STOPBOT may return `unknown` | | `postcode` | Postal code from IP geolocation data when available | | `country` | Country name from IP geolocation data. If unavailable, STOPBOT returns `unknown` | | `countryCode` | Country ISO code from IP geolocation data. If unavailable, STOPBOT returns `NN` | | `latitude` | Latitude from IP geolocation data. If unavailable, the value may be `0` | | `longitude` | Longitude from IP geolocation data. If unavailable, the value may be `0` | | `timezone` | Timezone from IP geolocation data. If unavailable, STOPBOT returns `UTC` | | `isAnycast` | `true` when the IP geolocation data marks the IP as anycast; otherwise `false` | | `status` | API result status. Successful IP Lookup responses return `success` | | `executionTime` | Server-side execution time for the request | | `timeResponse` | Response timestamp in `YYYY-MM-DD HH:mm:ss` format | ### User Type The `userType` field is copied from the IP geolocation data field `traits.user_type`. The current STOPBOT IP geolocation database contains these `userType` values: | Value | Meaning | | ------------- | -------------------------------------- | | `business` | Business or organization network | | `cellular` | Mobile carrier network | | `hosting` | Hosting, cloud, or data center network | | `residential` | Residential ISP network | If the IP geolocation data does not provide a value, STOPBOT returns: ``` unknown ``` ### Connection Type The `connectionType` field is copied from the IP geolocation data field `traits.connection_type`. The current STOPBOT IP geolocation database contains these `connectionType` values: | Value | Meaning | | ----------- | ----------------------------------------------------- | | `Cable/DSL` | Fixed broadband connection | | `Cellular` | Mobile network connection | | `Corporate` | Corporate or organization network connection category | | `Dialup` | Dial-up connection | If the IP geolocation data does not provide a value, STOPBOT returns: ``` unknown ``` ### Error Response Fields Failed IP Lookup responses may include: | Field | Description | | --------------- | -------------------------------------------------- | | `errorMessage` | Human-readable error message | | `status` | Failed requests return `failed` | | `executionTime` | Server-side execution time for the request | | `timeResponse` | Response timestamp in `YYYY-MM-DD HH:mm:ss` format | # Blocker The Blocker endpoint checks whether a visitor should be allowed or blocked based on IP, user agent, URL, user configuration, and Stopbot threat intelligence. ### Endpoint ``` GET https://api.stopbot.net/services/blocker ``` ### Parameters | Parameter | Required | Description | | --------- | -------- | -------------------------- | | `apikey` | Yes | Your Stopbot API key | | `ip` | Yes | Visitor IP address | | `ua` | No | Visitor user agent | | `url` | No | Requested URL or page path | ### Example Request ```bash curl "https://api.stopbot.net/services/blocker?apikey={API_KEY}&ip=1.1.1.1&ua={USER_AGENT}&url=https%3A%2F%2Fexample.com" ``` ### Example Response ```json { "ip": "1.1.1.1", "hostname": "one.one.one.one", "asn": 13335, "userType": "hosting", "connectionType": "Corporate", "company": "Cloudflare, Inc.", "isp": "Cloudflare, Inc.", "city": "Sydney", "district": "", "region": "New South Wales", "postcode": "1001", "country": "Australia", "countryCode": "AU", "latitude": -33.8688, "longitude": 151.209, "timezone": "Australia/Sydney", "isAnycast": true, "device": "Desktop", "ua": "{USER_AGENT}", "isBot": 1, "blockAccess": 1, "threatURL": 0, "detectActivity": "BLOCK BY HOSTNAME DATABASE.", "status": "success", "executionTime": "5.17ms", "timeResponse": "2026-07-07 12:00:00" } ``` ### Invalid Input Example If the `ip` parameter is missing or is not a valid IPv4/IPv6 address, the Blocker endpoint returns `400 Bad Request`. Example request with invalid IP: ```bash curl "https://api.stopbot.net/services/blocker?apikey={API_KEY}&ip=not-an-ip&ua={USER_AGENT}&url=https%3A%2F%2Fexample.com" ``` Example response: ```json { "errorMessage": "IP format is invalid.", "status": "failed", "executionTime": "1.23ms", "timeResponse": "2026-07-07 12:00:00" } ``` ### Response Fields Successful Blocker responses may include the following fields: | Field | Description | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `ip` | Visitor IP address from the `ip` request parameter | | `hostname` | Hostname or PTR value resolved for the visitor IP. If no hostname is available, the IP itself may be returned | | `asn` | Autonomous System Number from IP geolocation data | | `userType` | Network user type from IP geolocation data. Current values are `business`, `cellular`, `hosting`, and `residential`. If unavailable, STOPBOT returns `unknown` | | `connectionType` | Network connection type from IP geolocation data. Current values are `Cable/DSL`, `Cellular`, `Corporate`, and `Dialup`. If unavailable, STOPBOT returns `unknown` | | `company` | Autonomous system organization or company name from IP geolocation data. If unavailable, STOPBOT returns `unknown` | | `isp` | Internet service provider name from IP geolocation data. If unavailable, STOPBOT returns `unknown` | | `city` | City name from IP geolocation data. If unavailable, STOPBOT may return `unknown` | | `district` | District or second subdivision from IP geolocation data when available | | `region` | Region or first subdivision from IP geolocation data. If unavailable, STOPBOT may return `unknown` | | `postcode` | Postal code from IP geolocation data when available | | `country` | Country name from IP geolocation data. If unavailable, STOPBOT returns `unknown` | | `countryCode` | Country ISO code from IP geolocation data. If unavailable, STOPBOT returns `NN` | | `latitude` | Latitude from IP geolocation data. If unavailable, the value may be `0` | | `longitude` | Longitude from IP geolocation data. If unavailable, the value may be `0` | | `timezone` | Timezone from IP geolocation data. If unavailable, STOPBOT returns `UTC` | | `isAnycast` | `true` when the IP geolocation data marks the IP as anycast; otherwise `false` | | `device` | Device classification derived from the `ua` request parameter | | `ua` | User agent value from the request. This field is only included when the `ua` parameter is provided | | `isBot` | Visitor classification signal: `0` visitor/non-bot, `1` detected bot/threat, `2` user list match | | `blockAccess` | `1` means the website should apply the block action; `0` means access can continue or be monitored | | `threatURL` | `1` when the URL is treated as a threat signal; otherwise `0` | | `detectActivity` | Detection reason returned by the Blocker decision flow | | `status` | API result status. Successful Blocker responses return `success` | | `executionTime` | Server-side execution time for the request | | `timeResponse` | Response timestamp in `YYYY-MM-DD HH:mm:ss` format | ### Error Response Fields Failed Blocker responses may include the following fields: | Field | Description | | --------------- | -------------------------------------------------- | | `errorMessage` | Human-readable error message | | `status` | Failed requests return `failed` | | `executionTime` | Server-side execution time for the request | | `timeResponse` | Response timestamp in `YYYY-MM-DD HH:mm:ss` format | ### Decision Fields | Field | Description | | ---------------- | ----------------------------------------------------------------------------- | | `isBot` | Bot classification. `0` visitor, `1` detected bot/threat, `2` user list match | | `blockAccess` | `1` means block action should be applied, `0` means allow/monitor | | `threatURL` | URL threat flag | | `detectActivity` | Human-readable detection reason | | `device` | Detected device type | Use `blockAccess` as the final allow/block decision field. The `isBot` field is a classification signal and should not be used as the final access decision. For the Blocker endpoint, most blocked threat or policy matches also return `isBot=1` or `isBot=2`, but the integration contract remains the same: apply your block action when `blockAccess` is `1`. ### Device Values The `device` field is derived from the `ua` request parameter. | Value | Meaning | | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `Mobile` | The user agent contains a known mobile keyword, such as Android, iPhone, iPad, Windows Phone, BlackBerry, Nokia, Kindle, PlayBook, `mobi`, Silk, Opera Mini, Opera Mobile, UCBrowser, Symbian, Blazer, or WebOS | | `Desktop` | The user agent does not match the mobile keyword list, or no user agent is provided | ### User Type The `userType` field is copied from the IP geolocation data field `traits.user_type`. The current STOPBOT IP geolocation database contains these `userType` values: | Value | Meaning | | ------------- | -------------------------------------- | | `business` | Business or organization network | | `cellular` | Mobile carrier network | | `hosting` | Hosting, cloud, or data center network | | `residential` | Residential ISP network | If the IP geolocation data does not provide a value, STOPBOT returns: ``` unknown ``` ### Connection Type The `connectionType` field is copied from the IP geolocation data field `traits.connection_type`. The current STOPBOT IP geolocation database contains these `connectionType` values: | Value | Meaning | | ----------- | ----------------------------------------------------- | | `Cable/DSL` | Fixed broadband connection | | `Cellular` | Mobile network connection | | `Corporate` | Corporate or organization network connection category | | `Dialup` | Dial-up connection | If the IP geolocation data does not provide a value, STOPBOT returns: ``` unknown ``` ### Common Detection Reasons | Value | Meaning | | ------------------------------------ | ------------------------------------------ | | `Visitor` | No block reason detected | | `BLOCK BY IP DATABASE.` | IP matched Stopbot IP database | | `BLOCK BY MALICIOUS ACTIVITY.` | IP matched malicious activity checks | | `BLOCK BY HOSTNAME DATABASE.` | Hostname matched Stopbot hostname database | | `BLOCK BY PROXY/VPN/TOR.` | Proxy, VPN, or Tor detection | | `BLOCK BY COUNTRY.` | Country is not allowed by configuration | | `BLOCK BY IP NON-ISP.` | Non-ISP network blocked by configuration | | `BLOCK BY SPIDER CRAWLER` | User agent bot/crawler detection | | `BLOCK BY THREAT URL` | URL threat or repeated failed traffic | | `BLOCK BY DEVICE DESKTOP` | Blocked by configured desktop device rule | | `BLOCK BY DEVICE MOBILE` | Blocked by configured mobile device rule | | `BLOCK BY BLACKLIST IP (USER)` | Matched user IP blacklist | | `ALLOW BY WHITELIST IP (USER)` | Matched user IP whitelist | | `BLOCK BY THREAT FEEDS` | Matched Stopbot threat feeds | | `BLOCK BY HOSTNAME (USER)` | Matched user hostname blacklist | | `ALLOW BY SETTING ( SEARCH ENGINE )` | Allowed search engine bot by setting | # Blocker v2 Use Blocker v2 to apply advanced visitor protection with named configurations, request parameter checks, header checks, search engine handling, ad bot detection, and configurable page responses. Blocker v2 returns a flat JSON response with visitor IP information, decision fields, and page response fields at the top level. ### Endpoint ``` GET https://api.stopbot.net/services/blockerv2 ``` ### Parameters | Parameter | Required | Description | | ---------- | -------- | --------------------------------------------------------------------------------- | | `apikey` | Yes | Your STOPBOT API key | | `confname` | Yes | Blocker v2 configuration name from the STOPBOT panel | | `ip` | Yes | Visitor IPv4 or IPv6 address | | `ua` | No | Visitor user agent | | `url` | No | Requested URL. The value is used only when it starts with `http://` or `https://` | | `params` | No | JSON object of request parameters, used when Params rules are enabled | | `headers` | No | JSON object of request headers, used when HTTP Headers rules are enabled | ### Parameter Rules | Parameter | Rule | | ---------- | ----------------------------------------------------------------------------------------------------------- | | `confname` | Must be 1-64 alphanumeric characters: `A-Z`, `a-z`, `0-9` | | `ip` | Must be a valid IPv4 or IPv6 address | | `ua` | Accepted as optional input. Values longer than 1024 characters are truncated | | `url` | Accepted only when it starts with `http://` or `https://`. Values longer than 2048 characters are truncated | | `params` | Must be a JSON object when used. Maximum accepted length is 64 KB and maximum accepted keys are 100 | | `headers` | Must be a JSON object when used. Maximum accepted length is 64 KB and maximum accepted keys are 100 | If Params or HTTP Headers rules are enabled in the configuration and the submitted JSON does not match the configured rules, Blocker v2 returns a blocked decision instead of an invalid input error. ### Example Request ```bash curl "https://api.stopbot.net/services/blockerv2?apikey={API_KEY}&confname={CONFNAME}&ip=1.1.1.1&ua={USER_AGENT}&url=https%3A%2F%2Fexample.com¶ms=%7B%7D&headers=%7B%7D" ``` ### Example Response ```json { "ip": "1.1.1.1", "hostname": "one.one.one.one", "asn": 13335, "userType": "hosting", "connectionType": "Corporate", "company": "Cloudflare, Inc.", "isp": "Cloudflare, Inc.", "city": "Sydney", "district": "", "region": "New South Wales", "postcode": "1001", "country": "Australia", "countryCode": "AU", "latitude": -33.8688, "longitude": 151.209, "timezone": "Australia/Sydney", "isAnycast": true, "userAgent": "{USER_AGENT}", "isBot": 1, "blockAccess": 1, "threatURL": 0, "detectActivity": "[Disallow] - IP Non-ISP", "pageResponseType": "RedirectURL", "pageResponseContents": "https://example.com/blocked", "status": "success", "executionTime": "11.69ms", "timeResponse": "2026-07-07 12:00:00" } ``` ### Invalid Input Examples Invalid configuration name format: ```bash curl "https://api.stopbot.net/services/blockerv2?apikey={API_KEY}&confname=bad-conf&ip=1.1.1.1" ``` Response: ```json { "errorMessage": "Please enter a valid Configuration Name.", "status": "failed", "executionTime": "23.58us", "timeResponse": "2026-07-07 12:00:00" } ``` Invalid IP address: ```bash curl "https://api.stopbot.net/services/blockerv2?apikey={API_KEY}&confname={CONFNAME}&ip=not-an-ip" ``` Response: ```json { "errorMessage": "IP format is invalid.", "status": "failed", "executionTime": "1.23ms", "timeResponse": "2026-07-07 12:00:00" } ``` Configuration name is valid but not registered for the API key: ```json { "errorMessage": "Your Configuration Name is not registered in our database.", "status": "failed", "executionTime": "1.23ms", "timeResponse": "2026-07-07 12:00:00" } ``` ### Response Fields | Field | Description | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------ | | `ip` | Visitor IP address from the `ip` request parameter | | `hostname` | Hostname or PTR value resolved for the visitor IP. If no hostname is available, the IP itself may be returned | | `asn` | Autonomous System Number from IP geolocation data | | `userType` | Network user type from IP geolocation data | | `connectionType` | Network connection type from IP geolocation data | | `company` | Autonomous system organization or company name from IP geolocation data | | `isp` | Internet service provider name from IP geolocation data | | `city` | City name from IP geolocation data | | `district` | District or second subdivision from IP geolocation data when available | | `region` | Region or first subdivision from IP geolocation data | | `postcode` | Postal code from IP geolocation data when available | | `country` | Country name from IP geolocation data | | `countryCode` | Country ISO code from IP geolocation data | | `latitude` | Latitude from IP geolocation data | | `longitude` | Longitude from IP geolocation data | | `timezone` | Timezone from IP geolocation data | | `isAnycast` | `true` when the IP geolocation data marks the IP as anycast; otherwise `false` | | `userAgent` | User agent from the `ua` request parameter. This field is returned when `ua` is provided | | `isBot` | Visitor classification signal: `0` visitor/non-bot, `1` detected bot/threat, `2` user list match | | `blockAccess` | Page action flag. `1` means your website should apply the configured block response; `0` means do not apply the block response | | `threatURL` | Threat-related flag returned by the decision flow. `1` means the request was marked as threat-related | | `detectActivity` | Human-readable decision description | | `pageResponseType` | Page response type configured in the STOPBOT panel | | `pageResponseContents` | Response value for the selected page response type | | `status` | API result status. Successful Blocker V2 responses return `success` | | `executionTime` | Server-side execution time for the request | | `timeResponse` | Response timestamp in `YYYY-MM-DD HH:mm:ss` format | Use `blockAccess` for the final allow/block action. The `detectActivity` field explains the reason, while `isBot` is only a classification signal. `isBot` and `blockAccess` are intentionally separate. A visitor can be human/non-bot but still be blocked by your configuration. For example, a country restriction can return: ```json { "isBot": 0, "blockAccess": 1, "detectActivity": "[Disallow] - Country List" } ``` In this case, the visitor is not classified as a bot, but your website should still apply the configured page response because `blockAccess` is `1`. ### Page Response Types | Type | Meaning | | ---------------- | -------------------------------------------------------------------------- | | `None` | Stay on the current page. `pageResponseContents` may return `Stay On Page` | | `RedirectURL` | Redirect the visitor to the URL in `pageResponseContents` | | `HTTPStatusCode` | Return the HTTP status code stored in `pageResponseContents` | When `blockAccess` is `1`, your integration should apply the configured block response. When `blockAccess` is `0`, your integration should allow the request to continue. ### Device Values The `device` value used by the Blocker V2 decision flow is derived from the `ua` request parameter. | Value | Meaning | | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `Mobile` | The user agent contains a known mobile keyword, such as Android, iPhone, iPad, Windows Phone, BlackBerry, Nokia, Kindle, PlayBook, `mobi`, Silk, Opera Mini, Opera Mobile, UCBrowser, Symbian, Blazer, or WebOS | | `Desktop` | The user agent does not match the mobile keyword list, or no user agent is provided | Blocker V2 does not return `device` as a top-level response field, but it uses this value in the decision flow and activity logs. ### User Type The `userType` field is copied from the IP geolocation data field `traits.user_type`. The current STOPBOT IP geolocation database contains these `userType` values: | Value | Meaning | | ------------- | -------------------------------------- | | `business` | Business or organization network | | `cellular` | Mobile carrier network | | `hosting` | Hosting, cloud, or data center network | | `residential` | Residential ISP network | If the IP geolocation data does not provide a value, STOPBOT returns: ``` unknown ``` ### Connection Type The `connectionType` field is copied from the IP geolocation data field `traits.connection_type`. The current STOPBOT IP geolocation database contains these `connectionType` values: | Value | Meaning | | ----------- | ----------------------------------------------------- | | `Cable/DSL` | Fixed broadband connection | | `Cellular` | Mobile network connection | | `Corporate` | Corporate or organization network connection category | | `Dialup` | Dial-up connection | If the IP geolocation data does not provide a value, STOPBOT returns: ``` unknown ``` ### Decision Descriptions The `detectActivity` value can include: | Value | Meaning | | ------------------------------------------ | -------------------------------------------------------------------- | | `Visitor` | No block reason detected | | `[Disallow] - IP Blacklist` | IP matched STOPBOT IP blacklist or IP range checks | | `[Disallow] - Bad IP (Malicious Activity)` | IP matched malicious activity or DNS blacklist checks | | `[Disallow] - Hostname` | Hostname matched STOPBOT hostname checks | | `[Disallow] - Proxy \| VPN \| Tor` | Proxy, VPN, Tor, or spam-source detection | | `[Disallow] - Country List` | Country is not allowed by configuration | | `[Disallow] - IP Non-ISP` | Non-ISP network blocked by configuration | | `[Disallow] - Spider Crawler` | User agent matched bot or crawler detection | | `[Disallow] - Threat URL` | Request matched threat-related repeated failed traffic logic | | `[Disallow] - Ad Bot Preview ({name})` | Advertising bot preview detected by configured ad bot rules | | `[Disallow] - Device` | Device type does not match the configuration | | `[Disallow] - Params` | Submitted `params` JSON did not match configured Params rules | | `[Disallow] - Headers` | Submitted `headers` JSON did not match configured HTTP Headers rules | | `[Disallow] - Blacklist IP (USER)` | IP matched the user's own IP blacklist | | `[Allow] - Whitelist IP (USER)` | IP matched the user's own IP whitelist | | `[Allow] - SearchEngine ({name})` | Verified search engine visitor matched search engine handling rules | ### Error Response Fields Failed Blocker V2 responses may include: | Field | Description | | --------------- | -------------------------------------------------- | | `errorMessage` | Human-readable error message | | `status` | Failed requests return `failed` | | `executionTime` | Server-side execution time for the request | | `timeResponse` | Response timestamp in `YYYY-MM-DD HH:mm:ss` format | # SmartURLs Use SmartURLs to analyze shortlink visitors and return the correct redirect, block, or JavaScript verification behavior for a registered keyname. SmartURLs combines shortlink configuration with visitor IP, user agent, device, country, hostname, and reputation checks before returning the final redirect decision. ### Endpoint ``` GET https://api.stopbot.net/services/shorterlink ``` ### Parameters | Parameter | Required | Description | | --------- | -------- | ---------------------------------------- | | `apikey` | Yes | Your STOPBOT API key | | `ip` | Yes | Visitor IPv4 or IPv6 address | | `keyname` | Yes | SmartURLs keyname from the STOPBOT panel | | `ua` | No | Visitor user agent | | `url` | No | Current requested URL or path | ### Parameter Rules | Parameter | Rule | | --------- | ------------------------------------------------------------------- | | `ip` | Must be a valid IPv4 or IPv6 address | | `keyname` | Must be 1-64 characters using `A-Z`, `a-z`, `0-9`, `.`, `_`, or `-` | | `ua` | Optional user agent value used for device and bot/crawler detection | | `url` | Optional requested URL or path | If `keyname` is invalid, inactive, removed, or not registered for the API key owner, SmartURLs returns a success response with `detectActivity: BLOCK BY INVALID KEYNAME`. ### Example Request ```bash curl "https://api.stopbot.net/services/shorterlink?apikey={API_KEY}&ip=1.1.1.1&keyname={KEYNAME}&ua={USER_AGENT}&url=https%3A%2F%2Fexample.com" ``` ### Example Response ```json { "ip": "1.1.1.1", "hostname": "one.one.one.one", "asn": 13335, "userType": "hosting", "connectionType": "Corporate", "company": "Cloudflare, Inc.", "isp": "Cloudflare, Inc.", "city": "Sydney", "district": "", "region": "New South Wales", "postcode": "1001", "country": "Australia", "countryCode": "AU", "latitude": -33.8688, "longitude": 151.209, "timezone": "Australia/Sydney", "isAnycast": true, "device": "Desktop", "ua": "{USER_AGENT}", "isBot": 1, "blockAccess": 0, "threatURL": 0, "detectActivity": "BLOCK BY HOSTNAME DATABASE.", "redirectTo": "https://www.google.com", "jsResponse": 1, "uniqueCode": "abc123def4567890", "status": "success", "executionTime": "4.44ms", "timeResponse": "2026-07-07 12:00:00" } ``` ### Invalid Input Example If the `ip` parameter is missing or is not a valid IPv4/IPv6 address, SmartURLs returns `400 Bad Request`. ```bash curl "https://api.stopbot.net/services/shorterlink?apikey={API_KEY}&ip=not-an-ip&keyname={KEYNAME}" ``` Example response: ```json { "status": "error", "errorMessage": "Please enter a valid IP FORMAT.", "executionTime": "9.4us", "timeResponse": "2026-07-07 12:00:00" } ``` ### Invalid Keyname Example Invalid, inactive, removed, or unowned keynames do not return a validation error. They return a normal JSON response with a block decision. ```json { "ip": "1.1.1.1", "hostname": "one.one.one.one", "asn": 13335, "userType": "hosting", "connectionType": "Corporate", "company": "Cloudflare, Inc.", "isp": "Cloudflare, Inc.", "city": "Sydney", "district": "", "region": "New South Wales", "postcode": "1001", "country": "Australia", "countryCode": "AU", "latitude": -33.8688, "longitude": 151.209, "timezone": "Australia/Sydney", "isAnycast": true, "device": "Desktop", "ua": "{USER_AGENT}", "isBot": 1, "blockAccess": 1, "threatURL": 0, "detectActivity": "BLOCK BY INVALID KEYNAME", "status": "success", "executionTime": "3.90ms", "timeResponse": "2026-07-07 12:00:00" } ``` ### Response Fields Successful SmartURLs responses may include the following fields: | Field | Description | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `ip` | Visitor IP address from the `ip` request parameter | | `hostname` | Hostname or PTR value resolved for the visitor IP. If no hostname is available, the IP itself may be returned | | `asn` | Autonomous System Number from IP geolocation data | | `userType` | Network user type from IP geolocation data. Current values are `business`, `cellular`, `hosting`, and `residential`. If unavailable, STOPBOT returns `unknown` | | `connectionType` | Network connection type from IP geolocation data. Current values are `Cable/DSL`, `Cellular`, `Corporate`, and `Dialup`. If unavailable, STOPBOT returns `unknown` | | `company` | Autonomous system organization or company name from IP geolocation data. If unavailable, STOPBOT returns `unknown` | | `isp` | Internet service provider name from IP geolocation data. If unavailable, STOPBOT returns `unknown` | | `city` | City name from IP geolocation data. If unavailable, STOPBOT may return `unknown` | | `district` | District or second subdivision from IP geolocation data when available | | `region` | Region or first subdivision from IP geolocation data. If unavailable, STOPBOT may return `unknown` | | `postcode` | Postal code from IP geolocation data when available | | `country` | Country name from IP geolocation data. If unavailable, STOPBOT returns `unknown` | | `countryCode` | Country ISO code from IP geolocation data. If unavailable, STOPBOT returns `NN` | | `latitude` | Latitude from IP geolocation data. If unavailable, the value may be `0` | | `longitude` | Longitude from IP geolocation data. If unavailable, the value may be `0` | | `timezone` | Timezone from IP geolocation data. If unavailable, STOPBOT returns `UTC` | | `isAnycast` | `true` when the IP geolocation data marks the IP as anycast; otherwise `false` | | `device` | Device classification derived from the `ua` request parameter | | `ua` | User agent value from the request. This field is only included when `ua` is provided | | `isBot` | Visitor classification signal: `0` visitor/non-bot, `1` detected bot/threat, `2` user list match | | `blockAccess` | `1` means blocked redirect behavior should be applied; `0` means normal redirect behavior can be used | | `threatURL` | `1` when the request is treated as threat-related; otherwise `0` | | `detectActivity` | Detection reason returned by the SmartURLs decision flow | | `redirectTo` | Destination URL returned when the keyname configuration is found | | `jsResponse` | JavaScript verification setting from the SmartURLs configuration. `1` means verification is enabled | | `uniqueCode` | Verification token returned when JavaScript verification is enabled | | `status` | API result status | | `executionTime` | Server-side execution time for the request | | `timeResponse` | Response timestamp in `YYYY-MM-DD HH:mm:ss` format | ### Redirect Fields | Field | Description | | ------------- | --------------------------------------------------------------------------------------------------------------- | | `redirectTo` | Destination URL your SmartURLs client should use | | `jsResponse` | JavaScript verification setting from the SmartURLs configuration. `1` means verification is enabled | | `uniqueCode` | Present only when `jsResponse` is `1` and a verification token was generated | | `blockAccess` | `1` means SmartURLs selected the blocked redirect behavior; `0` means SmartURLs selected the normal destination | Use `blockAccess` and `redirectTo` for the final action. The `detectActivity` field explains the detection reason and may still contain a block reason when the configuration is set to monitor or allow the visitor. Do not use `isBot` as the final redirect decision. SmartURLs can block or redirect a human/non-bot visitor based on your keyname configuration. For example, a country restriction can return: ```json { "isBot": 0, "blockAccess": 1, "detectActivity": "BLOCK BY COUNTRY." } ``` In this case, the visitor is not classified as a bot, but the SmartURLs client should still use the blocked `redirectTo` value because `blockAccess` is `1`. ### JavaScript Verification Flow When JavaScript verification is enabled for the keyname, the normal SmartURLs response includes `uniqueCode`. The browser should complete verification before the final redirect. Your SmartURLs client should call the same endpoint again with: ``` apikey={API_KEY} ip={VISITOR_IP} keyname={KEYNAME} js=1 code={uniqueCode} ``` Example: ```bash curl "https://api.stopbot.net/services/shorterlink?apikey={API_KEY}&ip=1.1.1.1&keyname={KEYNAME}&js=1&code={UNIQUE_CODE}" ``` Successful verification response: ```json { "AddVisitorStatus": 1, "status": "success", "executionTime": "3.04ms", "timeResponse": "2026-07-07 12:00:00" } ``` If the verification code does not match a pending SmartURLs visitor record, the response may still return `status: success` without `AddVisitorStatus`. When JavaScript verification is not enabled, `uniqueCode` is not returned. ### JavaScript Verification Response Fields | Field | Description | | ------------------ | --------------------------------------------------------------------------------------------- | | `AddVisitorStatus` | `1` means the pending SmartURLs visitor record was successfully marked as JavaScript verified | | `status` | Verification request status | | `executionTime` | Server-side execution time for the request | | `timeResponse` | Response timestamp in `YYYY-MM-DD HH:mm:ss` format | ### Device Values The `device` field is derived from the `ua` request parameter. | Value | Meaning | | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `Mobile` | The user agent contains a known mobile keyword, such as Android, iPhone, iPad, Windows Phone, BlackBerry, Nokia, Kindle, PlayBook, `mobi`, Silk, Opera Mini, Opera Mobile, UCBrowser, Symbian, Blazer, or WebOS | | `Desktop` | The user agent does not match the mobile keyword list, or no user agent is provided | ### User Type The `userType` field is copied from the IP geolocation data field `traits.user_type`. The current STOPBOT IP geolocation database contains these `userType` values: | Value | Meaning | | ------------- | -------------------------------------- | | `business` | Business or organization network | | `cellular` | Mobile carrier network | | `hosting` | Hosting, cloud, or data center network | | `residential` | Residential ISP network | If the IP geolocation data does not provide a value, STOPBOT returns: ``` unknown ``` ### Connection Type The `connectionType` field is copied from the IP geolocation data field `traits.connection_type`. The current STOPBOT IP geolocation database contains these `connectionType` values: | Value | Meaning | | ----------- | ----------------------------------------------------- | | `Cable/DSL` | Fixed broadband connection | | `Cellular` | Mobile network connection | | `Corporate` | Corporate or organization network connection category | | `Dialup` | Dial-up connection | If the IP geolocation data does not provide a value, STOPBOT returns: ``` unknown ``` ### Common Detection Reasons The `detectActivity` value can include: | Value | Meaning | | ------------------------------ | ------------------------------------------------------------------------------ | | `Visitor` | No block reason detected | | `BLOCK BY IP DATABASE.` | IP matched STOPBOT IP database or IP range checks | | `BLOCK BY MALICIOUS ACTIVITY.` | IP matched malicious activity or DNS blacklist checks | | `BLOCK BY HOSTNAME DATABASE.` | Hostname matched STOPBOT hostname database | | `BLOCK BY PROXY/VPN/TOR.` | Proxy, VPN, Tor, or spam-source detection | | `BLOCK BY COUNTRY.` | Country is not allowed by configuration | | `BLOCK BY IP NON-ISP.` | Non-ISP network blocked by configuration | | `BLOCK BY SPIDER CRAWLER` | User agent matched bot or crawler detection | | `BLOCK BY THREAT URL` | Request matched repeated failed traffic logic | | `BLOCK BY INVALID KEYNAME` | Keyname is invalid, inactive, removed, or not registered for the API key owner | | `BLOCK BY DEVICE DESKTOP` | Blocked by configured desktop device rule | | `BLOCK BY DEVICE MOBILE` | Blocked by configured mobile device rule | | `BLOCK BY BLACKLIST IP (USER)` | IP matched the user's own IP blacklist | | `ALLOW BY WHITELIST IP (USER)` | IP matched the user's own IP whitelist | | `BLOCK BY THREAT FEEDS` | IP matched STOPBOT threat feeds | | `BLOCK BY HOSTNAME (USER)` | Hostname matched the user's own hostname blacklist | ### Error Response Fields Failed SmartURLs responses may include: | Field | Description | | --------------- | ----------------------------------------------------------------------------------- | | `errorMessage` | Human-readable error message | | `status` | Failed validation may return `error` or `failed`, depending on the validation stage | | `executionTime` | Server-side execution time for the request | | `timeResponse` | Response timestamp in `YYYY-MM-DD HH:mm:ss` format | ### V1 Difference Legacy SmartURLs used keyname-based JavaScript tracking. Current SmartURLs uses a `uniqueCode` verification token: ``` js=1&keyname={KEYNAME}&code={uniqueCode} ``` Use `code` for the verification token returned by the current SmartURLs response. # Email Validation Use Email Validation to check email syntax, split the email into user and domain parts, detect disposable email domains, and inspect common DNS records. Email Validation returns validation data only. It does not send an email, verify inbox ownership, or confirm that a mailbox can receive messages. ### Endpoint ``` GET https://api.stopbot.net/services/email-validation ``` ### Parameters | Parameter | Required | Description | | --------- | -------- | ------------------------- | | `apikey` | Yes | Your STOPBOT API key | | `email` | Yes | Email address to validate | ### Parameter Rules | Parameter | Rule | | --------- | ------------------------------------------------- | | `email` | Must use a valid email format accepted by STOPBOT | Accepted email format: * local part must start and end with a lowercase alphanumeric character after normalization * local part may contain lowercase letters, numbers, hyphen, dot, and underscore * domain must start and end with a lowercase alphanumeric character after normalization * domain may contain lowercase letters, numbers, hyphen, and dot * local part length is 3-62 characters * domain length is 3-102 characters STOPBOT validates the email format case-insensitively by normalizing the submitted value to lowercase before checking it. ### Example Request ```bash curl "https://api.stopbot.net/services/email-validation?apikey={API_KEY}&email=test%40gmail.com" ``` ### Valid Email Response ```json { "isEmail": true, "info": { "user": "test", "domain": "gmail.com", "isDisposableEmail": 0, "mx": "configured", "spf": "configured", "dmarc": "configured" }, "status": "success", "executionTime": "11.32ms", "timeResponse": "2026-07-07 12:00:00" } ``` ### Invalid Format Response Invalid email format is not returned as an HTTP error. STOPBOT returns `status: success` with `isEmail: false`. ```bash curl "https://api.stopbot.net/services/email-validation?apikey={API_KEY}&email=not-an-email" ``` Example response: ```json { "isEmail": false, "status": "success", "executionTime": "1.19ms", "timeResponse": "2026-07-07 12:00:00" } ``` ### Disposable Email Example When the domain is listed as disposable, `isDisposableEmail` returns `1`. ```json { "isEmail": true, "info": { "user": "test", "domain": "yopmail.com", "isDisposableEmail": 1, "mx": "configured", "spf": "configured", "dmarc": "configured" }, "status": "success", "executionTime": "146.23ms", "timeResponse": "2026-07-07 12:00:00" } ``` ### Response Fields | Field | Description | | --------------- | ------------------------------------------------------------------------------------- | | `isEmail` | `true` when the submitted value matches the accepted email format; otherwise `false` | | `info` | Email detail object. This field is returned only when `isEmail` is `true` | | `status` | API result status. Format-valid and format-invalid email checks both return `success` | | `executionTime` | Server-side execution time for the request | | `timeResponse` | Response timestamp in `YYYY-MM-DD HH:mm:ss` format | ### Info Fields | Field | Description | | ------------------- | ------------------------------------------------------------------------------------ | | `user` | Local part before `@` | | `domain` | Email domain after `@` | | `isDisposableEmail` | `1` when the domain is listed as disposable; `0` when it is not listed as disposable | | `mx` | MX DNS status. Possible values: `configured`, `not configured` | | `spf` | SPF DNS status. Possible values: `configured`, `not configured` | | `dmarc` | DMARC DNS status. Possible values: `configured`, `not configured` | ### DNS Checks Email Validation checks common DNS records for the domain: | Check | How STOPBOT Reports It | | ----- | -------------------------------------------------------------------------- | | MX | `configured` when the domain has MX records | | SPF | `configured` when the domain has a TXT record containing `v=spf1` | | DMARC | `configured` when `_dmarc.{domain}` has a TXT record containing `v=DMARC1` | If a DNS record is missing or cannot be confirmed during the check, the field returns `not configured`. ### Error Response Fields Failed Email Validation responses may include: | Field | Description | | --------------- | --------------------------------------------------------------- | | `errorMessage` | Human-readable error message | | `status` | Failed authentication, quota, or service errors return `failed` | | `executionTime` | Server-side execution time for the request | | `timeResponse` | Response timestamp in `YYYY-MM-DD HH:mm:ss` format | ### Quota Note A successful format-valid Email Validation request may use additional credits because STOPBOT performs disposable email and DNS checks. # Phone Number Identify Use Phone Number Identify to validate and identify phone numbers, including formatted international number, number type, carrier, location, and country code. Phone Number Identify checks whether a submitted number can be parsed and validated as a real phone number. It does not send SMS, call the number, or verify ownership. ### Endpoint ``` GET https://api.stopbot.net/services/phonenumber ``` ### Parameters | Parameter | Required | Description | | --------- | -------- | ------------------------------------- | | `apikey` | Yes | Your STOPBOT API key | | `number` | Yes | Phone number to validate and identify | ### Parameter Rules | Parameter | Rule | | --------- | --------------------------------------------------------------------------------- | | `number` | Must contain a plus sign or digit as the first character, followed by 6-32 digits | Recommended format: ``` +{country_code}{number} ``` Example: ``` +16595290000 ``` Numbers without `+` are normalized by adding `+` before parsing. ### Example Request ```bash curl "https://api.stopbot.net/services/phonenumber?apikey={API_KEY}&number=%2B16595290000" ``` ### Valid Number Response ```json { "isValid": true, "info": { "phonenumber": "+1 659-529-0000", "type": "FIXED_LINE_OR_MOBILE", "carrier": "FRACTEL", "location": "BESSEMER, AL", "countryCode": "US" }, "status": "success", "executionTime": "53.28ms", "timeResponse": "2026-07-07 12:00:00" } ``` ### Invalid Number Response If the number format is accepted but the number cannot be validated, STOPBOT returns `status: success` with `isValid: false`. ```bash curl "https://api.stopbot.net/services/phonenumber?apikey={API_KEY}&number=1234567" ``` Example response: ```json { "isValid": false, "status": "success", "executionTime": "1.59ms", "timeResponse": "2026-07-07 12:00:00" } ``` ### Invalid Format Response If the `number` parameter does not match the accepted format, Phone Number Identify returns `400 Bad Request`. ```bash curl "https://api.stopbot.net/services/phonenumber?apikey={API_KEY}&number=abc" ``` Example response: ```json { "status": "error", "errorMessage": "Please enter a valid number. (ex: +11231231234)", "executionTime": "1.53ms", "timeResponse": "2026-07-07 12:00:00" } ``` ### Response Fields | Field | Description | | --------------- | ---------------------------------------------------------------------------------- | | `isValid` | `true` when the number can be parsed and validated; otherwise `false` | | `info` | Phone number detail object. This field is returned only when `isValid` is `true` | | `status` | API result status. Valid and possible-format invalid numbers both return `success` | | `executionTime` | Server-side execution time for the request | | `timeResponse` | Response timestamp in `YYYY-MM-DD HH:mm:ss` format | ### Info Fields | Field | Description | | ------------- | -------------------------------------------------------------------------------- | | `phonenumber` | Formatted international phone number | | `type` | Phone number type | | `carrier` | Carrier name in uppercase. If no carrier is detected, STOPBOT returns `UNDETECT` | | `location` | Geocoded number location in uppercase when available | | `countryCode` | ISO country code for the phone number region | ### Number Types The `type` field can include: | Value | Meaning | | ---------------------- | ------------------------------------ | | `FIXED_LINE` | Fixed-line number | | `MOBILE` | Mobile number | | `FIXED_LINE_OR_MOBILE` | Number can be fixed-line or mobile | | `TOLL_FREE` | Toll-free number | | `PREMIUM_RATE` | Premium-rate number | | `SHARED_COST` | Shared-cost number | | `VOIP` | VoIP number | | `PERSONAL_NUMBER` | Personal number | | `PAGER` | Pager number | | `UAN` | Universal access number | | `UNKNOWN` | Number type is not mapped by STOPBOT | ### Error Response Fields Failed Phone Number Identify responses may include: | Field | Description | | --------------- | -------------------------------------------------------------------------------------------- | | `errorMessage` | Human-readable error message | | `status` | Invalid format returns `error`; authentication, quota, or service errors may return `failed` | | `executionTime` | Server-side execution time for the request | | `timeResponse` | Response timestamp in `YYYY-MM-DD HH:mm:ss` format | # Error Codes Use this page to understand common STOPBOT API error responses, HTTP status codes, and service-specific validation outcomes. STOPBOT returns JSON for public API responses. Most request failures use an HTTP error status with `status: failed` or `status: error`. Detection results, blocked visitors, invalid emails, and invalid-but-parseable phone numbers are not always HTTP errors. ### HTTP Status Codes | HTTP Status | Used For | | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | | `200 OK` | Request processed successfully. The result may still indicate a blocked visitor, invalid email, invalid phone number, or invalid SmartURLs keyname | | `204 No Content` | Successful `OPTIONS` preflight response | | `400 Bad Request` | Invalid API key format, invalid input format, invalid Blocker V2 configuration name, or unregistered Blocker V2 configuration | | `401 Unauthorized` | API key was not found | | `402 Payment Required` | API key quota is exceeded or the API key duration has expired | | `405 Method Not Allowed` | Request method is not supported. Public service endpoints accept `GET` and `OPTIONS` | | `503 Service Unavailable` | Temporary service, configuration, account, or lookup failure | ### Common Error Fields | Field | Description | | --------------- | -------------------------------------------------------------------------------------- | | `status` | Error status. Common values are `failed` and `error` | | `errorMessage` | Human-readable error message | | `executionTime` | Server-side execution time. Returned by most endpoint handlers | | `timeResponse` | Response timestamp in `YYYY-MM-DD HH:mm:ss` format. Returned by most endpoint handlers | ### Authentication Errors #### Invalid API Key Format Returned when `apikey` does not match the required API key format. HTTP status: `400 Bad Request` ```json { "errorMessage": "Apikey format is invalid.", "status": "failed" } ``` #### API Key Not Found Returned when the API key format is valid, but the key does not exist. HTTP status: `401 Unauthorized` ```json { "status": "failed", "errorMessage": "API key not found. Please check your API key or create a new one." } ``` #### Quota Or Expiration Error Returned when the API key has no available quota or its active duration has expired. HTTP status: `402 Payment Required` ```json { "status": "failed", "errorMessage": "Please increase your quota or extend the duration of your API key." } ``` ### Method Error #### Method Not Allowed Returned when a public service endpoint receives a method other than `GET` or `OPTIONS`. HTTP status: `405 Method Not Allowed` ```json { "errorMessage": "Method not allowed.", "status": "failed" } ``` ### Service Errors #### Configuration Load Failure Returned when the service cannot load its runtime configuration. HTTP status: `503 Service Unavailable` ```json { "errorMessage": "Failed to load configuration, please wait until the issue is resolved.", "status": "failed" } ``` #### Temporary Service Failure Returned when the service cannot complete the request because a required backend operation is temporarily unavailable. HTTP status: `503 Service Unavailable` ```json { "status": "failed", "errorMessage": "Service temporarily unavailable. Please try again later or contact support at admin@stopbot.com" } ``` #### Account Detail Failure Returned by Account when account details cannot be retrieved after authentication. HTTP status: `503 Service Unavailable` ```json { "status": "failed", "errorMessage": "Failed to retrieve account details." } ``` #### IP Lookup Failure Returned by IP Lookup when IP information cannot be resolved after validation. HTTP status: `503 Service Unavailable` ```json { "status": "failed", "errorMessage": "Failed to lookup IP information." } ``` ### Input Validation Errors #### Invalid IP Format Returned by Blocker, Blocker V2, and IP Lookup when `ip` is not a valid IP address. HTTP status: `400 Bad Request` ```json { "errorMessage": "IP format is invalid.", "status": "failed" } ``` SmartURLs uses an endpoint-specific invalid IP response: HTTP status: `400 Bad Request` ```json { "status": "error", "errorMessage": "Please enter a valid IP FORMAT." } ``` #### Invalid Blocker V2 Configuration Name Returned when `confname` does not match the accepted Blocker V2 configuration name format. HTTP status: `400 Bad Request` ```json { "errorMessage": "Please enter a valid Configuration Name.", "status": "failed" } ``` #### Blocker V2 Configuration Not Registered Returned when `confname` is valid in format, but is not registered for the authenticated account. HTTP status: `400 Bad Request` ```json { "errorMessage": "Your Configuration Name is not registered in our database.", "status": "failed" } ``` #### Invalid Phone Number Format Returned by Phone Number Identify when `number` does not match the accepted phone number format. HTTP status: `400 Bad Request` ```json { "status": "error", "errorMessage": "Please enter a valid number. (ex: +11231231234)" } ``` ### Successful Requests With Negative Results These responses are not HTTP errors. The API successfully processed the request, but the service result is negative or blocked. #### SmartURLs Invalid Keyname Invalid, unknown, inactive, or unowned SmartURLs keynames can return `200 OK` with a blocked decision. ```json { "isBot": 1, "blockAccess": 1, "detectActivity": "BLOCK BY INVALID KEYNAME", "status": "success" } ``` #### Email Validation Invalid Format Email Validation returns `200 OK` with `isEmail: false` when the submitted email does not match the accepted email format. ```json { "isEmail": false, "status": "success" } ``` #### Phone Number Not Valid Phone Number Identify returns `200 OK` with `isValid: false` when the submitted number passes the basic format check but cannot be validated as a real phone number. ```json { "isValid": false, "status": "success" } ``` #### Visitor Blocked By Detection Blocker, Blocker V2, and SmartURLs can return `200 OK` even when the visitor should be blocked. Use the service-specific decision fields instead of treating only HTTP errors as blocked traffic. | Service | Decision Field | | ---------- | -------------- | | Blocker | `blockAccess` | | SmartURLs | `blockAccess` | | Blocker V2 | `status.block` | ### V1 Difference Legacy V1 often returned HTTP `200 OK` with: ```json { "status": "error", "message": "..." } ``` For V2 integrations, use the HTTP status code together with the JSON `status`, `apiStatus`, and service-specific decision fields. # Migration From V1 This guide explains the main differences between the legacy V1 API and the newer V2 API. ### Base URLs | Version | Base URL | | ------- | ---------------------------------- | | V1 | `https://stopbot.net/api` | | V2 | `https://api.stopbot.net/services` | ### Endpoint Mapping | Service | V1 | V2 | | --------------------- | ----------------------- | ---------------------------- | | Account | `/api/account` | `/services/account` | | Blocker | `/api/blocker` | `/services/blocker` | | Blocker V2 | `/api/v2/blockerv2` | `/services/v2/blockerv2` | | SmartURLs | `/api/shorterlink` | `/services/shorterlink` | | IP Lookup | `/api/iplookup` | `/services/iplookup` | | Email Validation | `/api/email-validation` | `/services/email-validation` | | Phone Number Identify | `/api/phone` | `/services/phonenumber` | ### Response Shape Differences V1 Blocker and SmartURLs commonly returned nested fields: ```json { "IPInfo": {}, "IPStatus": { "isBot": 1, "BlockAccess": 1, "ThreatURL": 0, "DetectActivity": "BLOCK BY HOSTNAME DATABASE." } } ``` V2 Blocker returns many fields flat: ```json { "isBot": 1, "blockAccess": 1, "threatURL": 0, "detectActivity": "BLOCK BY HOSTNAME DATABASE." } ``` V2 Blocker V2 returns nested sections: ```json { "ipInfo": {}, "status": { "bot": 1, "block": 1, "threatURL": 0, "desc": "[Disallow] - IP Blacklist" }, "pageResponse": { "type": "RedirectURL", "contents": "https://example.com" } } ``` ### SmartURLs JS Flow V1 JavaScript verification: ``` /api/shorterlink?apikey=...&ip=...&keyname=...&js=1 ``` V2 JavaScript verification: ``` /services/shorterlink?apikey=...&ip=...&keyname=...&js=1&code={uniqueCode} ``` V2 returns `uniqueCode` in the first SmartURLs response when JavaScript verification is required. ### Phone Endpoint Rename V1: ``` /api/phone ``` V2: ``` /services/phonenumber ``` ### Error Handling V1 often returned HTTP 200 with: ```json { "status": "error", "message": "..." } ``` V2 uses HTTP status codes more directly, such as: * `400` invalid input * `401` API key not found * `402` quota exceeded or expired * `405` method not allowed * `503` service unavailable ### Migration Checklist * Replace base URL from `https://stopbot.net/api` to `https://api.stopbot.net/services`. * Update endpoint paths. * Update response parsing for changed field names. * Update SmartURLs JS verification to use `uniqueCode` and `code`. * Update phone endpoint from `phone` to `phonenumber`. * Handle V2 HTTP status codes. * Test each endpoint with a demo API key before switching production traffic. # Service Guides * [Blocker](https://docs.stopbot.net/v2/service-guides/stopbot-v2/blocker) * [SmartURLs](https://docs.stopbot.net/v2/service-guides/stopbot-v2/smarturls) * [Blocker V2](https://docs.stopbot.net/v2/service-guides/stopbot-v2/blocker-v2) # Stopbot v2 Here is a guide to integrating STOPBOT's product into your server: * Blocker () * BlockerV2 () * BlockerV2-WP-Plugins () * Smart URLs () # Blocker This guide shows how to add STOPBOT v2/Blocker to server-side applications in PHP, Node.js, Python, and Go. The Blocker service helps identify whether a website visitor is a real user, bot, crawler, proxy, VPN, Tor exit node, suspicious hostname, or visitor matching your own allow/block rules. ### Endpoint Used ``` GET https://api.stopbot.net/services/blocker ``` ### How It Works 1. Your application receives a visitor request. 2. The integration sends the visitor IP, user agent, and current URL to STOPBOT V2. 3. STOPBOT returns a decision. 4. Your application allows the visitor, redirects the visitor, or returns an HTTP error page. ### Required Parameters | Parameter | Description | | --------- | --------------------- | | `apikey` | Your STOPBOT API key | | `ip` | Visitor IP address | | `ua` | Visitor user agent | | `url` | Current requested URL | > **Security note:** Keep your API key on the backend server. Do not publish it in browser-only JavaScript, mobile apps, or public repositories. > **Proxy note:** Only trust `CF-Connecting-IP` or `X-Forwarded-For` when your application is behind a trusted proxy such as Cloudflare or your own reverse proxy. ### Decision Field This guide uses the V2 response field: ``` blockAccess ``` If `blockAccess` is `1`, the integration applies the configured block action. Always use `blockAccess` as the allow/block decision field. Do not use `isBot` as the final access decision. `isBot` is a visitor classification signal, while `blockAccess` tells your integration whether the block action should be applied. ### Common Actions | Action | Behavior | | ------------------------------- | -------------------------------------------------------------------------- | | Monitor only | Send requests to STOPBOT and allow the visitor regardless of `blockAccess` | | Redirect blocked visitors | Redirect when `blockAccess` is `1` | | Return 404 for blocked visitors | Return an HTTP `404` response when `blockAccess` is `1` | ### Environment Variables The examples use these environment variables: | Variable | Required | Description | | ---------------------- | -------- | -------------------------------------------------------------------------- | | `STOPBOT_API_KEY` | Yes | Your STOPBOT API key | | `STOPBOT_PROTECTION` | No | Set to `0` for monitor-only mode. Any other value enables the block action | | `STOPBOT_REDIRECT_URL` | No | Redirect target for blocked visitors. Leave empty to return `404` | ### cURL Test Use this request to test the endpoint before adding it to your application: ```bash curl "https://api.stopbot.net/services/blocker?apikey={API_KEY}&ip=1.1.1.1&ua=Mozilla%2F5.0&url=https%3A%2F%2Fexample.com%2F" ``` ### PHP Create a file named: ``` stopbot-blocker.php ``` Paste this code: ```php $apiKey, "ip" => stopbot_client_ip(), "ua" => $_SERVER["HTTP_USER_AGENT"] ?? "", "url" => stopbot_current_url(), ]); $ch = curl_init($endpoint . "?" . $query); curl_setopt_array($ch, [ CURLOPT_RETURNTRANSFER => true, CURLOPT_CUSTOMREQUEST => "GET", CURLOPT_ENCODING => "gzip, deflate", CURLOPT_CONNECTTIMEOUT => 5, CURLOPT_TIMEOUT => 10, CURLOPT_HTTPHEADER => ["Accept: application/json"], ]); $response = curl_exec($ch); $curlError = curl_error($ch); $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE); curl_close($ch); if ($response === false || $httpCode < 200 || $httpCode >= 300) { error_log("[STOPBOT V2] Blocker request failed. HTTP {$httpCode}. {$curlError}"); return null; } $json = json_decode($response, true); return is_array($json) ? $json : null; } $stopbotResponse = stopbot_blocker_request($StopbotApiKey); if (($stopbotResponse["status"] ?? "") === "success") { $shouldBlock = (int)($stopbotResponse["blockAccess"] ?? 0) === 1; if ($StopbotProtection === 1 && $shouldBlock) { if (!empty($StopbotRedirectURL)) { header("Location: " . $StopbotRedirectURL, true, 302); exit; } http_response_code(404); exit; } } ``` Add it to the top of your main PHP entry file: ```php ``` ### Node.js This example uses Express and the built-in `fetch` available in modern Node.js versions. Create a file named: ``` stopbot-blocker.js ``` Paste this code: ```js const STOPBOT_API_KEY = process.env.STOPBOT_API_KEY || ""; const STOPBOT_REDIRECT_URL = process.env.STOPBOT_REDIRECT_URL || ""; const STOPBOT_PROTECTION = process.env.STOPBOT_PROTECTION || "1"; const STOPBOT_ENDPOINT = "https://api.stopbot.net/services/blocker"; function clientIp(req) { const cfIp = req.headers["cf-connecting-ip"]; if (typeof cfIp === "string" && cfIp.length > 0) { return cfIp; } const forwardedFor = req.headers["x-forwarded-for"]; if (typeof forwardedFor === "string" && forwardedFor.length > 0) { return forwardedFor.split(",")[0].trim(); } return (req.socket.remoteAddress || "0.0.0.0").replace(/^::ffff:/, ""); } function currentUrl(req) { const host = req.get("host") || ""; const protocol = req.protocol || "http"; return `${protocol}://${host}${req.originalUrl || req.url || "/"}`; } async function stopbotBlockerRequest(req) { const params = new URLSearchParams({ apikey: STOPBOT_API_KEY, ip: clientIp(req), ua: req.get("user-agent") || "", url: currentUrl(req), }); const response = await fetch(`${STOPBOT_ENDPOINT}?${params.toString()}`, { method: "GET", headers: { Accept: "application/json" }, signal: AbortSignal.timeout(10000), }); if (!response.ok) { console.error(`[STOPBOT V2] Blocker request failed. HTTP ${response.status}`); return null; } return response.json(); } async function stopbotBlocker(req, res, next) { if (!STOPBOT_API_KEY) { return next(); } try { const result = await stopbotBlockerRequest(req); const shouldBlock = result?.status === "success" && Number(result.blockAccess || 0) === 1; if (STOPBOT_PROTECTION === "1" && shouldBlock) { if (STOPBOT_REDIRECT_URL) { return res.redirect(302, STOPBOT_REDIRECT_URL); } return res.sendStatus(404); } } catch (error) { console.error("[STOPBOT V2] Blocker request failed.", error); } return next(); } module.exports = stopbotBlocker; ``` Call it as the first middleware in your main file: ```js const express = require("express"); const stopbotBlocker = require("./stopbot-blocker"); const app = express(); app.use(stopbotBlocker); app.get("/", (req, res) => { res.send("Protected by STOPBOT V2 Blocker"); }); app.listen(3000); ``` ### Python This example uses Flask and Python standard library HTTP utilities. Create a file named: ``` stopbot_blocker.py ``` Paste this code: ```python import json import os import urllib.parse import urllib.request from flask import abort, current_app, redirect, request STOPBOT_API_KEY = os.environ.get("STOPBOT_API_KEY", "") STOPBOT_REDIRECT_URL = os.environ.get("STOPBOT_REDIRECT_URL", "") STOPBOT_PROTECTION = os.environ.get("STOPBOT_PROTECTION", "1") STOPBOT_ENDPOINT = "https://api.stopbot.net/services/blocker" def client_ip(): cf_ip = request.headers.get("CF-Connecting-IP") if cf_ip: return cf_ip forwarded_for = request.headers.get("X-Forwarded-For") if forwarded_for: return forwarded_for.split(",")[0].strip() return request.remote_addr or "0.0.0.0" def current_url(): return request.url def stopbot_blocker_request(): params = urllib.parse.urlencode({ "apikey": STOPBOT_API_KEY, "ip": client_ip(), "ua": request.headers.get("User-Agent", ""), "url": current_url(), }) api_request = urllib.request.Request( f"{STOPBOT_ENDPOINT}?{params}", headers={"Accept": "application/json"}, method="GET", ) try: with urllib.request.urlopen(api_request, timeout=10) as response: if response.status < 200 or response.status >= 300: current_app.logger.warning("STOPBOT V2 request failed. HTTP %s", response.status) return None return json.loads(response.read().decode("utf-8")) except Exception as error: current_app.logger.warning("STOPBOT V2 request failed: %s", error) return None def register_stopbot_blocker(app): @app.before_request def stopbot_blocker_guard(): if not STOPBOT_API_KEY: return None result = stopbot_blocker_request() should_block = ( result and result.get("status") == "success" and int(result.get("blockAccess", 0)) == 1 ) if STOPBOT_PROTECTION == "1" and should_block: if STOPBOT_REDIRECT_URL: return redirect(STOPBOT_REDIRECT_URL, code=302) abort(404) return None ``` Call it near the top of your main Flask file before defining routes: ```python from flask import Flask from stopbot_blocker import register_stopbot_blocker app = Flask(__name__) register_stopbot_blocker(app) @app.route("/") def index(): return "Protected by STOPBOT V2 Blocker" ``` ### Go This example uses the standard `net/http` package. The middleware is registered once when the server starts, but it runs on every incoming visitor request. The reusable `stopbotHTTPClient` below is only the server-side HTTP client used to call the STOPBOT API. Create a file named: ``` stopbot_blocker.go ``` Paste this code: ```go package main import ( "context" "encoding/json" "fmt" "log" "net" "net/http" "net/url" "os" "strings" "time" ) const stopbotEndpoint = "https://api.stopbot.net/services/blocker" var stopbotHTTPClient = &http.Client{Timeout: 10 * time.Second} type blockerResponse struct { Status string `json:"status"` BlockAccess int `json:"blockAccess"` } func visitorIP(r *http.Request) string { if ip := r.Header.Get("CF-Connecting-IP"); net.ParseIP(ip) != nil { return ip } if forwardedFor := r.Header.Get("X-Forwarded-For"); forwardedFor != "" { first := strings.TrimSpace(strings.Split(forwardedFor, ",")[0]) if net.ParseIP(first) != nil { return first } } host, _, err := net.SplitHostPort(r.RemoteAddr) if err == nil && net.ParseIP(host) != nil { return host } return "0.0.0.0" } func currentURL(r *http.Request) string { scheme := "http" if r.TLS != nil || r.Header.Get("X-Forwarded-Proto") == "https" { scheme = "https" } return scheme + "://" + r.Host + r.URL.RequestURI() } func stopbotBlockerRequest(ctx context.Context, apiKey string, r *http.Request) (*blockerResponse, error) { values := url.Values{} values.Set("apikey", apiKey) values.Set("ip", visitorIP(r)) values.Set("ua", r.UserAgent()) values.Set("url", currentURL(r)) req, err := http.NewRequestWithContext(ctx, http.MethodGet, stopbotEndpoint+"?"+values.Encode(), nil) if err != nil { return nil, err } req.Header.Set("Accept", "application/json") resp, err := stopbotHTTPClient.Do(req) if err != nil { return nil, err } defer resp.Body.Close() if resp.StatusCode < 200 || resp.StatusCode >= 300 { return nil, fmt.Errorf("STOPBOT V2 request failed with HTTP %d", resp.StatusCode) } var result blockerResponse if err := json.NewDecoder(resp.Body).Decode(&result); err != nil { return nil, err } return &result, nil } func StopbotBlocker(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { apiKey := os.Getenv("STOPBOT_API_KEY") if apiKey == "" { next.ServeHTTP(w, r) return } result, err := stopbotBlockerRequest(r.Context(), apiKey, r) if err != nil { log.Printf("[STOPBOT V2] %v", err) next.ServeHTTP(w, r) return } shouldBlock := result.Status == "success" && result.BlockAccess == 1 if os.Getenv("STOPBOT_PROTECTION") != "0" && shouldBlock { if redirectURL := os.Getenv("STOPBOT_REDIRECT_URL"); redirectURL != "" { http.Redirect(w, r, redirectURL, http.StatusFound) return } http.NotFound(w, r) return } next.ServeHTTP(w, r) }) } ``` Call it in your `main.go` before starting the server: ```go package main import ( "log" "net/http" ) func main() { mux := http.NewServeMux() mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { _, _ = w.Write([]byte("Protected by STOPBOT V2 Blocker")) }) log.Fatal(http.ListenAndServe(":8080", StopbotBlocker(mux))) } ``` ### Test The Integration 1. Set `STOPBOT_API_KEY` in your server environment. 2. Start your application. 3. Open your website in a browser. 4. Confirm the page still loads normally. 5. Check your application logs for STOPBOT connection errors. 6. Open the STOPBOT panel and confirm visitor statistics are being recorded. ### Recommended Failure Behavior The examples above allow the visitor when the STOPBOT API request fails. This keeps your website available during temporary network or service issues. If your security policy requires blocking on API failure, change the error branch carefully and test it in staging first. ### Response Fields Used | Field | Usage | | ---------------- | ------------------------------------------------------------------------------------------- | | `status` | Confirms the API request was processed successfully | | `blockAccess` | Main allow/block decision field | | `isBot` | Visitor classification signal only. Do not use this field as the final allow/block decision | | `detectActivity` | Optional reason field for logs or debugging | ### V1 Difference Legacy V1 examples use: ``` IPStatus.BlockAccess ``` V2 uses: ``` blockAccess ``` # Blocker v2 This guide shows how to add STOPBOT v2/Blocker v2 to server-side applications in PHP, Node.js, Python, and Go. Blocker v2 is designed for advanced traffic filtering. It supports multiple configurations, request parameter checks, header checks, advertising bot detection, search engine handling, and configurable page responses. ### Endpoint Used ``` GET https://api.stopbot.net/services/blockerv2 ``` ### How It Works 1. Your application receives a visitor request. 2. The integration sends the visitor IP, user agent, current URL, request parameters, request headers, and `confname` to STOPBOT v2. 3. STOPBOT returns a flat decision response. 4. Your application applies `pageResponseType` and `pageResponseContents` when `blockAccess` is `1`. ### Required Parameters | Parameter | Description | | ---------- | ---------------------------------------------------- | | `apikey` | Your STOPBOT API key | | `confname` | Blocker v2 configuration name from the STOPBOT panel | | `ip` | Visitor IP address | | `ua` | Visitor user agent | | `url` | Current requested URL | | `params` | JSON object of request parameters | | `headers` | JSON object of request headers | > **Security note:** Keep your API key on the backend server. Do not publish it in browser-only JavaScript, mobile apps, or public repositories. > **Proxy note:** Only trust `CF-Connecting-IP` or `X-Forwarded-For` when your application is behind a trusted proxy such as Cloudflare or your own reverse proxy. ### Decision Fields This guide uses these v2 response fields: ``` status blockAccess pageResponseType pageResponseContents ``` If `status` is `success` and `blockAccess` is `1`, the integration applies the configured page response. Always use `blockAccess` as the allow/block decision field. Do not use `isBot` as the final access decision. `isBot` only describes visitor classification, while `blockAccess` describes whether your configured page response must be applied. For example, a normal human visitor can still be blocked by your configuration: ```json { "isBot": 0, "blockAccess": 1, "detectActivity": "[Disallow] - Country List" } ``` ### Page Response Types | Type | Action | | ---------------- | ------------------------------------------------------- | | `None` | Stay on the current page | | `RedirectURL` | Redirect the visitor to `pageResponseContents` | | `HTTPStatusCode` | Return the HTTP status code from `pageResponseContents` | ### Environment Variables The examples use these environment variables: | Variable | Required | Description | | ---------------------------- | -------- | ---------------------------------------------------------------------------------- | | `STOPBOT_API_KEY` | Yes | Your STOPBOT API key | | `STOPBOT_BLOCKERV2_CONFNAME` | Yes | Blocker v2 configuration name from the STOPBOT panel | | `STOPBOT_PROTECTION` | No | Set to `0` for monitor-only mode. Any other value enables the page response action | ### cURL Test Use this request to test the endpoint before adding it to your application: ```bash curl "https://api.stopbot.net/services/blockerv2?apikey={API_KEY}&confname={CONFNAME}&ip=1.1.1.1&ua=Mozilla%2F5.0&url=https%3A%2F%2Fexample.com%2F¶ms=%7B%7D&headers=%7B%7D" ``` ### PHP Create a file named: ``` stopbot-blockerv2.php ``` Paste this code: ```php $value) { if (substr($name, 0, 5) === "HTTP_") { $header = str_replace(" ", "-", ucwords(strtolower(str_replace("_", " ", substr($name, 5))))); $headers[$header] = $value; } } return $headers; } function stopbot_v2_request(string $apiKey, string $configName): ?array { $endpoint = "https://api.stopbot.net/services/blockerv2"; $query = http_build_query([ "apikey" => $apiKey, "confname" => $configName, "ip" => stopbot_v2_client_ip(), "ua" => $_SERVER["HTTP_USER_AGENT"] ?? "", "url" => stopbot_v2_current_url(), "params" => json_encode($_GET), "headers" => json_encode(stopbot_v2_headers()), ]); $ch = curl_init($endpoint . "?" . $query); curl_setopt_array($ch, [ CURLOPT_RETURNTRANSFER => true, CURLOPT_CUSTOMREQUEST => "GET", CURLOPT_ENCODING => "gzip, deflate", CURLOPT_CONNECTTIMEOUT => 5, CURLOPT_TIMEOUT => 10, CURLOPT_HTTPHEADER => ["Accept: application/json"], ]); $response = curl_exec($ch); $curlError = curl_error($ch); $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE); curl_close($ch); if ($response === false || $httpCode < 200 || $httpCode >= 300) { error_log("[STOPBOT V2] Blocker V2 request failed. HTTP {$httpCode}. {$curlError}"); return null; } $json = json_decode($response, true); return is_array($json) ? $json : null; } function stopbot_v2_apply_page_response(array $response): void { $type = $response["pageResponseType"] ?? "None"; $contents = $response["pageResponseContents"] ?? ""; if ($type === "RedirectURL" && !empty($contents)) { header("Location: " . $contents, true, 302); exit; } if ($type === "HTTPStatusCode" && preg_match('/^[0-9]{3}$/', (string)$contents)) { http_response_code((int)$contents); exit; } } $stopbotResponse = stopbot_v2_request($StopbotApiKey, $StopbotConfigName); if ($StopbotProtection === 1 && ($stopbotResponse["status"] ?? "") === "success") { $shouldBlock = (int)($stopbotResponse["blockAccess"] ?? 0) === 1; if ($shouldBlock) { stopbot_v2_apply_page_response($stopbotResponse); } } ``` Add it to the top of your main PHP entry file: ```php ``` ### Node.js This example uses Express and the built-in `fetch` available in modern Node.js versions. Create a file named: ``` stopbot-blockerv2.js ``` Paste this code: ```js const STOPBOT_API_KEY = process.env.STOPBOT_API_KEY || ""; const STOPBOT_CONFNAME = process.env.STOPBOT_BLOCKERV2_CONFNAME || ""; const STOPBOT_PROTECTION = process.env.STOPBOT_PROTECTION || "1"; const STOPBOT_ENDPOINT = "https://api.stopbot.net/services/blockerv2"; function visitorIp(req) { const cfIp = req.headers["cf-connecting-ip"]; if (typeof cfIp === "string" && cfIp.length > 0) { return cfIp; } const forwardedFor = req.headers["x-forwarded-for"]; if (typeof forwardedFor === "string" && forwardedFor.length > 0) { return forwardedFor.split(",")[0].trim(); } return (req.socket.remoteAddress || "0.0.0.0").replace(/^::ffff:/, ""); } function currentUrl(req) { const host = req.get("host") || ""; const protocol = req.protocol || "http"; return `${protocol}://${host}${req.originalUrl || req.url || "/"}`; } async function stopbotBlockerV2Request(req) { const params = new URLSearchParams({ apikey: STOPBOT_API_KEY, confname: STOPBOT_CONFNAME, ip: visitorIp(req), ua: req.get("user-agent") || "", url: currentUrl(req), params: JSON.stringify(req.query || {}), headers: JSON.stringify(req.headers || {}), }); const response = await fetch(`${STOPBOT_ENDPOINT}?${params.toString()}`, { method: "GET", headers: { Accept: "application/json" }, signal: AbortSignal.timeout(10000), }); if (!response.ok) { console.error(`[STOPBOT V2] Blocker V2 request failed. HTTP ${response.status}`); return null; } return response.json(); } function applyPageResponse(result, res) { const type = result?.pageResponseType || "None"; const contents = result?.pageResponseContents || ""; if (type === "RedirectURL" && contents) { res.redirect(302, contents); return true; } if (type === "HTTPStatusCode" && /^[0-9]{3}$/.test(String(contents))) { res.sendStatus(Number(contents)); return true; } return false; } async function stopbotBlockerV2(req, res, next) { if (!STOPBOT_API_KEY || !STOPBOT_CONFNAME) { return next(); } try { const result = await stopbotBlockerV2Request(req); const shouldBlock = result?.status === "success" && Number(result.blockAccess || 0) === 1; if (STOPBOT_PROTECTION !== "0" && shouldBlock && applyPageResponse(result, res)) { return; } } catch (error) { console.error("[STOPBOT V2] Blocker V2 request failed.", error); } return next(); } module.exports = stopbotBlockerV2; ``` Call it as the first middleware in your main file: ```js const express = require("express"); const stopbotBlockerV2 = require("./stopbot-blockerv2"); const app = express(); app.use(stopbotBlockerV2); app.get("/", (req, res) => { res.send("Protected by STOPBOT V2 Blocker V2"); }); app.listen(3000); ``` ### Python This example uses Flask and Python standard library HTTP utilities. Create a file named: ``` stopbot_blockerv2.py ``` Paste this code: ```python import json import os import urllib.parse import urllib.request from flask import current_app, redirect, request STOPBOT_API_KEY = os.environ.get("STOPBOT_API_KEY", "") STOPBOT_CONFNAME = os.environ.get("STOPBOT_BLOCKERV2_CONFNAME", "") STOPBOT_PROTECTION = os.environ.get("STOPBOT_PROTECTION", "1") STOPBOT_ENDPOINT = "https://api.stopbot.net/services/blockerv2" def visitor_ip(): cf_ip = request.headers.get("CF-Connecting-IP") if cf_ip: return cf_ip forwarded_for = request.headers.get("X-Forwarded-For") if forwarded_for: return forwarded_for.split(",")[0].strip() return request.remote_addr or "0.0.0.0" def current_url(): return request.url def stopbot_blockerv2_request(): params = urllib.parse.urlencode({ "apikey": STOPBOT_API_KEY, "confname": STOPBOT_CONFNAME, "ip": visitor_ip(), "ua": request.headers.get("User-Agent", ""), "url": current_url(), "params": json.dumps(request.args.to_dict(flat=True)), "headers": json.dumps(dict(request.headers)), }) api_request = urllib.request.Request( f"{STOPBOT_ENDPOINT}?{params}", headers={"Accept": "application/json"}, method="GET", ) try: with urllib.request.urlopen(api_request, timeout=10) as response: if response.status < 200 or response.status >= 300: current_app.logger.warning("STOPBOT V2 Blocker V2 failed. HTTP %s", response.status) return None return json.loads(response.read().decode("utf-8")) except Exception as error: current_app.logger.warning("STOPBOT V2 Blocker V2 failed: %s", error) return None def apply_page_response(result): response_type = result.get("pageResponseType", "None") contents = str(result.get("pageResponseContents", "")) if response_type == "RedirectURL" and contents: return redirect(contents, code=302) if response_type == "HTTPStatusCode" and contents.isdigit() and len(contents) == 3: return ("", int(contents)) return None def register_stopbot_blockerv2(app): @app.before_request def stopbot_blockerv2_guard(): if not STOPBOT_API_KEY or not STOPBOT_CONFNAME: return None result = stopbot_blockerv2_request() should_block = ( result and result.get("status") == "success" and int(result.get("blockAccess", 0)) == 1 ) if STOPBOT_PROTECTION != "0" and should_block: return apply_page_response(result) return None ``` Call it near the top of your main Flask file before defining routes: ```python from flask import Flask from stopbot_blockerv2 import register_stopbot_blockerv2 app = Flask(__name__) register_stopbot_blockerv2(app) @app.route("/") def index(): return "Protected by STOPBOT V2 Blocker V2" ``` ### Go This example uses the standard `net/http` package. The middleware is registered once when the server starts, but it runs on every incoming visitor request. The reusable `stopbotV2HTTPClient` below is only the server-side HTTP client used to call the STOPBOT API. Create a file named: ``` stopbot_blockerv2.go ``` Paste this code: ```go package main import ( "context" "encoding/json" "fmt" "log" "net" "net/http" "net/url" "os" "strconv" "strings" "time" ) const stopbotV2Endpoint = "https://api.stopbot.net/services/blockerv2" var stopbotV2HTTPClient = &http.Client{Timeout: 10 * time.Second} type stopbotBlockerV2Response struct { Status string `json:"status"` BlockAccess int `json:"blockAccess"` PageResponseType string `json:"pageResponseType"` PageResponseContents string `json:"pageResponseContents"` } func stopbotV2VisitorIP(r *http.Request) string { if ip := r.Header.Get("CF-Connecting-IP"); net.ParseIP(ip) != nil { return ip } if forwardedFor := r.Header.Get("X-Forwarded-For"); forwardedFor != "" { first := strings.TrimSpace(strings.Split(forwardedFor, ",")[0]) if net.ParseIP(first) != nil { return first } } host, _, err := net.SplitHostPort(r.RemoteAddr) if err == nil && net.ParseIP(host) != nil { return host } return "0.0.0.0" } func stopbotV2CurrentURL(r *http.Request) string { scheme := "http" if r.TLS != nil || r.Header.Get("X-Forwarded-Proto") == "https" { scheme = "https" } return scheme + "://" + r.Host + r.URL.RequestURI() } func stopbotV2Request(ctx context.Context, apiKey string, confname string, r *http.Request) (*stopbotBlockerV2Response, error) { paramsJSON, _ := json.Marshal(r.URL.Query()) headersJSON, _ := json.Marshal(r.Header) values := url.Values{} values.Set("apikey", apiKey) values.Set("confname", confname) values.Set("ip", stopbotV2VisitorIP(r)) values.Set("ua", r.UserAgent()) values.Set("url", stopbotV2CurrentURL(r)) values.Set("params", string(paramsJSON)) values.Set("headers", string(headersJSON)) req, err := http.NewRequestWithContext(ctx, http.MethodGet, stopbotV2Endpoint+"?"+values.Encode(), nil) if err != nil { return nil, err } req.Header.Set("Accept", "application/json") resp, err := stopbotV2HTTPClient.Do(req) if err != nil { return nil, err } defer resp.Body.Close() if resp.StatusCode < 200 || resp.StatusCode >= 300 { return nil, fmt.Errorf("STOPBOT V2 Blocker V2 failed with HTTP %d", resp.StatusCode) } var result stopbotBlockerV2Response if err := json.NewDecoder(resp.Body).Decode(&result); err != nil { return nil, err } return &result, nil } func stopbotV2ApplyPageResponse(w http.ResponseWriter, r *http.Request, result *stopbotBlockerV2Response) bool { switch result.PageResponseType { case "RedirectURL": if result.PageResponseContents != "" { http.Redirect(w, r, result.PageResponseContents, http.StatusFound) return true } case "HTTPStatusCode": code, err := strconv.Atoi(result.PageResponseContents) if err == nil && code >= 100 && code <= 999 { w.WriteHeader(code) return true } } return false } func StopbotBlockerV2(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { apiKey := os.Getenv("STOPBOT_API_KEY") confname := os.Getenv("STOPBOT_BLOCKERV2_CONFNAME") if apiKey == "" || confname == "" { next.ServeHTTP(w, r) return } result, err := stopbotV2Request(r.Context(), apiKey, confname, r) if err != nil { log.Printf("[STOPBOT V2] %v", err) next.ServeHTTP(w, r) return } shouldBlock := result.Status == "success" && result.BlockAccess == 1 if os.Getenv("STOPBOT_PROTECTION") != "0" && shouldBlock { if stopbotV2ApplyPageResponse(w, r, result) { return } } next.ServeHTTP(w, r) }) } ``` Call it in your `main.go` before starting the server: ```go package main import ( "log" "net/http" ) func main() { mux := http.NewServeMux() mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { _, _ = w.Write([]byte("Protected by STOPBOT V2 Blocker V2")) }) log.Fatal(http.ListenAndServe(":8080", StopbotBlockerV2(mux))) } ``` ### Test The Integration 1. Set `STOPBOT_API_KEY` in your server environment. 2. Set `STOPBOT_BLOCKERV2_CONFNAME` to a configuration name that exists in your STOPBOT panel. 3. Start your application. 4. Open your website in a browser. 5. Confirm the page response behavior matches your Blocker V2 configuration. 6. Check visitor logs in the STOPBOT panel. ### Recommended Failure Behavior The examples above allow the visitor when the STOPBOT API request fails. This keeps your website available during temporary network or service issues. If your security policy requires blocking on API failure, change the error branch carefully and test it in staging first. ### Response Fields Used | Field | Usage | | ---------------------- | ------------------------------------------------------------------------------------------- | | `status` | Confirms the API request was processed successfully | | `blockAccess` | Main allow/block decision field | | `isBot` | Visitor classification signal only. Do not use this field as the final allow/block decision | | `detectActivity` | Optional reason field for logs or debugging | | `pageResponseType` | Page response action type | | `pageResponseContents` | Page response value | ### V1 Difference Legacy V1 Blocker V2 examples use: ``` PageResponse.Type PageResponse.Contents ``` V2 uses flat fields: ``` pageResponseType pageResponseContents ``` # WP Plugins This guide explains how to install the plugin, connect it to a Blocker V2 configuration, test the connection, enable protection, and review visitor logs. Use the Stopbot WordPress plugin to protect public WordPress frontend page requests with the Blocker V2 endpoint, without adding custom code to your theme or plugin files. ### Endpoint Used ``` GET https://api.stopbot.net/services/blockerv2 ``` The plugin only uses the Blocker V2 endpoint. ### How It Works 1. A visitor opens a public WordPress frontend page. 2. WordPress runs the Stopbot plugin before rendering the page. 3. The plugin sends the visitor IP, user agent, current URL, and enabled request data to Stopbot. 4. Stopbot returns the Blocker V2 decision. 5. The plugin follows the response when `blockAccess` is `1`. The plugin does not check WordPress admin, login, AJAX, cron, REST, XML-RPC, or static asset requests. This helps reduce lockout risk and prevents checks from being triggered by images, CSS, JavaScript, and favicon requests. ### Requirements | Requirement | Description | | ------------------------ | ------------------------------------------------- | | WordPress | Version 5.8 or newer | | PHP | Version 7.4 or newer | | Stopbot API key | A valid API key from your Stopbot account | | Blocker V2 configuration | A configuration name created in the Stopbot panel | ### Before You Install Prepare these values first: | Value | Where To Get It | | ------------------ | ----------------------------------- | | API key | Stopbot panel account/API key page | | Configuration Name | Stopbot panel, Services, Blocker V2 | The configuration name must match the Blocker V2 configuration exactly. If the name is different, the API will not be able to load the intended rules. ### Installation Official plugin download: ``` https://panel.stopbot.net/stopbot.zip ``` Source code: ``` https://github.com/stopbot-net/Stopbot-Wordpress-Plugin ``` Install the plugin using one of these methods: | Method | Steps | | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | Official zip upload | Download `https://panel.stopbot.net/stopbot.zip`, open WordPress Admin, go to Plugins, Add New, Upload Plugin, choose the `.zip`, then activate it | | GitHub source | Open `https://github.com/stopbot-net/Stopbot-Wordpress-Plugin`, download or clone the source, package it as a `stopbot` folder, then upload it to WordPress | | WordPress admin upload | Upload a Stopbot plugin `.zip` from a trusted source, then activate it | | Manual upload | Upload the `stopbot` folder to `/wp-content/plugins/`, then activate `Stopbot` from WordPress Admin | | WordPress Plugin Directory | Search for `Stopbot` from Plugins, Add New, then install and activate it when the listing is available | After activation, open: ``` Settings > Stopbot ``` ### Setup Wizard The setup wizard helps complete the first configuration. | Step | Action | | ------------------------------- | -------------------------------------------------------------- | | Create Blocker V2 Configuration | Create or open a Blocker V2 configuration in the Stopbot panel | | Connect API Key | Paste your Stopbot API key into the plugin | | Test Connection | Confirm WordPress can reach the Blocker V2 endpoint | | Enable Protection | Turn on protection after the connection test succeeds | The connection test uses one Blocker V2 API request. ### Main Settings Open the Main tab and configure: | Setting | Description | | ------------------- | ------------------------------------------------------------------------------- | | Enable Protection | Turns frontend checking on or off | | API Key | Your Stopbot API key | | Configuration Name | The exact Blocker V2 `confname` from the Stopbot panel | | Trust Proxy Headers | Uses proxy visitor IP headers when the site is behind a trusted proxy | | Request Data | Sends safe request parameters and headers for Blocker V2 parameter/header rules | | Path Rules | Controls which frontend paths are checked | Click **Save & Test Connection** first. Enable protection only after the test succeeds. ### Path Rules Use Path Rules when you want to control which WordPress frontend paths are checked. | Mode | Behavior | | ----------------------- | ------------------------------------------------- | | Exclude listed paths | Checks all frontend pages except the listed paths | | Only check listed paths | Checks only the listed paths | Use one path per line. Example: ``` /thank-you/ /checkout/order-received/ /landing/safe-page/ ``` Path Rules are also useful when a Blocker V2 redirect target points back to a WordPress page that should not be checked. ### Redirect Loop Protection When Stopbot returns `pageResponseType: RedirectURL`, the plugin redirects the visitor to `pageResponseContents`. To help prevent `ERR_TOO_MANY_REDIRECTS`, the plugin skips the redirect action when the redirect target points to the same page as the current request. It compares the page without query strings, normalizes repeated or trailing slashes, and treats HTTP and HTTPS as the same page for this check. For pages that should never run protection, add them to Path Rules with Exclude mode. ### Admin Tab Use the Admin tab to control logged-in user bypass. | Setting | Description | | --------------- | -------------------------------------------------- | | Logged-In Users | Bypass checks for logged-in WordPress users | | Role | Bypass only selected roles when roles are selected | By default, logged-in WordPress users are bypassed to reduce administrator lockout risk. To test the plugin as a visitor, open the website in an incognito/private browser window, log out first, or temporarily disable logged-in user bypass. ### Visitor Log The Visitor Log tab shows recent Stopbot checks from a local WordPress database table. Available columns: | Column | Description | | ----------- | --------------------------------------------- | | Date & Time | Time the check was recorded | | IP Address | Visitor IP used for the check | | Country | Country returned by Stopbot | | ISP | ISP returned by Stopbot | | Hostname | Hostname returned by Stopbot | | Device | Device detected from the user agent | | OS | Operating system detected from the user agent | | Browser | Browser detected from the user agent | | Desc | Stopbot `detectActivity` result | | Accepted | `Yes` when `blockAccess` is `0` | | Threat | Stopbot `threatURL` result | | Status | API connection status and HTTP response code | Visitor Log supports: * 10, 25, 50, or 100 results per page. * Sorting by Date & Time. * Sorting by IP Address. * Filters for Device, OS, Browser, Country, ISP, and Desc. * Automatic refresh every 60 seconds while the settings page is open. * Statistics by Device, OS, Country, and Browser. * A graph for blocked, accepted, and total checks. The plugin creates a dedicated WordPress table for visitor logs during activation and removes it when the plugin is uninstalled. It does not store API keys or full page URLs in the visitor log. ### Diagnostic Log Use the Log tab only when debugging. Diagnostic Log can help identify connection issues, invalid JSON responses, blocked requests, or configuration problems. API keys are not written to the diagnostic log. For busy production sites, keep Diagnostic Log off unless you are actively troubleshooting. ### Proxy Headers Only enable proxy headers when the site is always behind a trusted proxy, such as: * Cloudflare * Nginx reverse proxy * Apache reverse proxy * Caddy reverse proxy * Load balancer Set this option to `"Off"` for normal hosting or when you are not sure. If proxy headers are enabled on a public origin without a trusted proxy, visitors may spoof their IP address using headers such as `X-Forwarded-For`. Use this simple rule: | Site Setup | Proxy Headers | | ------------------------------------------------------------------- | ------------- | | Cloudflare is active and the origin only accepts Cloudflare traffic | Enable | | A trusted reverse proxy controls the real visitor IP header | Enable | | Normal hosting or unsure | `"Off"` | ### Response Handling The plugin follows the Blocker V2 response. | Response Field | Behavior | | -------------------------------------- | ------------------------------------------------- | | `blockAccess: 0` | Visitor is accepted | | `blockAccess: 1` with `RedirectURL` | Visitor is redirected to `pageResponseContents` | | `blockAccess: 1` with `HTTPStatusCode` | WordPress returns the configured HTTP status code | Always use `blockAccess` as the final access decision. Do not use `isBot` as the final block decision. `isBot` describes visitor classification, while `blockAccess` tells the integration whether the configured page response must be applied. ### Testing Checklist After setup: 1. Save the API key and Configuration Name. 2. Click **Save & Test Connection**. 3. Enable protection only after the test succeeds. 4. Purge WordPress, server, and CDN cache once. 5. Open the website from an incognito/private browser window. 6. Confirm the visitor appears in Visitor Log. 7. Confirm the Stopbot panel also records the visitor. 8. Test an allowed visitor and a blocked condition. ### Troubleshooting | Problem | What To Check | | ------------------------------ | --------------------------------------------------------------------------------------------------------- | | Nothing appears in Visitor Log | Make sure Enable Protection is on, test from a logged-out/incognito browser, and purge page cache | | Admin user is not checked | Logged-in users are bypassed by default | | Wrong visitor IP is shown | Check Trust Proxy Headers and confirm the origin only accepts traffic from the trusted proxy | | `ERR_TOO_MANY_REDIRECTS` | Exclude the redirect target path, or make sure Blocker V2 does not redirect to the same checked page | | API test fails | Confirm API key, Configuration Name, hosting firewall, and outbound HTTPS access to `api.stopbot.net` | | Static assets appear in logs | Update to the latest plugin version and confirm the request is a frontend page request, not an asset path | ### Data Sent To Stopbot When protection is enabled, the plugin sends only the data needed for Blocker V2 checks: | Data | Purpose | | ----------------------- | ---------------------------------------------- | | API key | Authenticate the request | | Configuration Name | Load the correct Blocker V2 rules | | Visitor IP address | IP, ASN, ISP, hostname, geo, and threat checks | | User agent | Bot, browser, OS, and device classification | | Current page URL | URL threat and rule evaluation | | Safe request parameters | Optional Params rules | | Safe request headers | Optional HTTP Headers rules | Keep your API key private. Do not publish it in browser-only JavaScript, public repositories, screenshots, or support messages. # SmartURLs Run a SmartURLs redirect domain with the official Go or PHP client, including redirect handling, JavaScript verification, reverse proxy setup, and security requirements. SmartURLs lets you run short, trackable redirect URLs that can apply STOPBOT visitor analysis before sending a visitor to the final destination. Use this guide when you want to host your own SmartURLs redirect domain, for example: ``` https://links.example.com/swWV8j ``` The public visitor URL uses your own domain and the SmartURLs `keyname`. Your server-side SmartURLs client then sends the visitor context to STOPBOT V2. ### Recommended Integration Use one of the official SmartURLs V2 clients: | Client | Recommended for | Repository | | ---------- | --------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | | Go client | Production servers, VPS, reverse proxy deployments, high traffic redirect domains | [Stopbot-SmartURLs-V2-Go](https://github.com/stopbot-net/Stopbot-SmartURLs-V2-Go) | | PHP client | Shared hosting, Apache/PHP hosting, existing PHP environments | [Stopbot-SmartURLs-V2-PHP](https://github.com/stopbot-net/Stopbot-SmartURLs-V2-PHP) | The Go client is recommended for most production deployments. ### Endpoint Used By The Clients Both clients call: ``` GET https://api.stopbot.net/services/shorterlink ``` You normally do not need to call this endpoint directly from frontend code. Keep the STOPBOT API key on your server. ### How SmartURLs Works 1. Create a SmartURLs `keyname` in the STOPBOT panel. 2. Deploy the Go or PHP SmartURLs client on your redirect domain. 3. A visitor opens `https://your-domain.example/{keyname}`. 4. The client sends the visitor IP, user agent, URL, and `keyname` to STOPBOT V2. 5. STOPBOT returns a redirect decision. 6. The client redirects the visitor, shows a local error page, or runs JavaScript browser verification first. ### Create A SmartURLs Keyname 1. Sign in to [panel.stopbot.net](https://panel.stopbot.net). 2. Open the SmartURLs or Shortlink section. 3. Create a new SmartURLs key, or open an existing one. 4. Configure the destination URL and protection rules. 5. Copy the SmartURLs `keyname`. If the panel shows: ``` https://panel.stopbot.net/shortlink-swWV8j ``` the `keyname` is: ``` swWV8j ``` Your public visitor URL becomes: ``` https://your-domain.example/swWV8j ``` Allowed `keyname` characters: ``` A-Z a-z 0-9 . _ - ``` The maximum length is 64 characters. ### Go Client Setup Clone the Go client: ```bash git clone https://github.com/stopbot-net/Stopbot-SmartURLs-V2-Go.git cd Stopbot-SmartURLs-V2-Go ``` Copy the environment example: ```bash cp .env.example .env ``` Configure `.env`: ```env STOPBOT_API_KEY=your_api_key SMARTURLS_ADDR=127.0.0.1:8080 STOPBOT_API_ENDPOINT=https://api.stopbot.net/services/shorterlink SMARTURLS_SIGNING_KEY=change_this_to_a_long_random_secret_value SMARTURLS_TRUST_PROXY_HEADERS=true ``` `SMARTURLS_SIGNING_KEY` is a private local secret used to protect browser verification tokens. It is not your STOPBOT API key and does not need to be configured in the STOPBOT panel. Recommended signing key characters: ``` A-Z a-z 0-9 _ - . @ # % ``` Use at least 32 characters. Avoid spaces and quotes. Build and run: ```bash go test ./... go build -o smarturls . ./smarturls ``` On Windows: ```powershell go test ./... go build -o smarturls.exe . .\smarturls.exe ``` The Go binary embeds the local message template. Rebuild the binary after editing `template/message.html`. ### Go Client With Nginx Nginx is the recommended reverse proxy for the Go client. Example Nginx server block: ```nginx server { listen 80; server_name your-domain.example; location / { proxy_pass http://127.0.0.1:8080; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } ``` Use: ```env SMARTURLS_TRUST_PROXY_HEADERS=true ``` only when the Go application is always behind a trusted reverse proxy and cannot be accessed directly from the internet. ### PHP Client Setup Clone or download the PHP client: ```bash git clone https://github.com/stopbot-net/Stopbot-SmartURLs-V2-PHP.git ``` Upload the PHP client files to your SmartURLs domain. Set the API key through an environment variable: ```bash STOPBOT_API_KEY=your_api_key ``` Or create `config.local.php` next to `config.php`: ```php IP Address](https://docs.stopbot.net/v2/panel-guides/settings/blacklist/ip-address) | Block specific IP addresses, wildcard IPs, ranges, or CIDR-style networks | | [Blacklist > Hostname](https://docs.stopbot.net/v2/panel-guides/settings/blacklist/hostname) | Block specific hostnames or wildcard hostname patterns | | [Blacklist > Useragent](https://docs.stopbot.net/v2/panel-guides/settings/blacklist/useragent) | Block exact user agent strings or user agent keywords | | [Whitelist > IP Address](https://docs.stopbot.net/v2/panel-guides/settings/whitelist/ip-address) | Allow trusted IP addresses, wildcard IPs, ranges, or CIDR-style networks | | [Whitelist > Hostname](https://docs.stopbot.net/v2/panel-guides/settings/whitelist/hostname) | Allow trusted hostnames or wildcard hostname patterns | ### Recommended Setup Flow 1. Configure the main service from [Services](https://docs.stopbot.net/v2/panel-guides/services). 2. Test the service from your website or integration. 3. Review visitor logs and detection results. 4. Add blacklist rules only for traffic you are confident should be blocked. 5. Add whitelist rules only for trusted traffic that must remain allowed. 6. Use BOT Redirect when you need reusable redirect destinations. 7. Test again after each rule change. ### Choosing The Right Setting | Goal | Recommended Page | | -------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | Send blocked bots to a reusable destination | [BOT Redirect](https://docs.stopbot.net/v2/panel-guides/settings/bot-redirect) | | Block one IP or a known network | [Blacklist IP Address](https://docs.stopbot.net/v2/panel-guides/settings/blacklist/ip-address) | | Block traffic from a known reverse DNS hostname | [Blacklist Hostname](https://docs.stopbot.net/v2/panel-guides/settings/blacklist/hostname) | | Block repeated automation using the same user agent | [Blacklist Useragent](https://docs.stopbot.net/v2/panel-guides/settings/blacklist/useragent) | | Keep your office, server, monitor, or partner IP allowed | [Whitelist IP Address](https://docs.stopbot.net/v2/panel-guides/settings/whitelist/ip-address) | | Keep a trusted hostname allowed | [Whitelist Hostname](https://docs.stopbot.net/v2/panel-guides/settings/whitelist/hostname) | ### Rule Safety Custom rules can immediately affect production traffic. Use precise values whenever possible. | Rule Type | Safety Note | | ------------ | ----------------------------------------------------------------------------------- | | IP Address | Avoid broad ranges unless you understand the network being matched | | Hostname | Wildcard hostname rules can match many hosts | | Useragent | Broad keywords such as `Mozilla`, `Chrome`, or `Safari` can match normal browsers | | Whitelist | Only allow traffic you trust because whitelist entries can affect blocking behavior | | BOT Redirect | Use HTTPS destinations and avoid internal or sensitive URLs | ### Related Pages | Page | Purpose | | -------------------------------------------------------------------------- | -------------------------------------------- | | [Blocker](https://docs.stopbot.net/v2/panel-guides/services/blocker) | Configure standard visitor filtering | | [Blocker V2](https://docs.stopbot.net/v2/panel-guides/services/blocker-v2) | Configure advanced named protection profiles | | [Smart URLs](https://docs.stopbot.net/v2/panel-guides/services/smart-urls) | Configure protected shortlinks | | [API V2 Documentation](https://docs.stopbot.net/v2/api-v2-documentation) | Review API request and response behavior | # BOT Redirect Use BOT Redirect to create reusable redirect destinations for bot or blocked traffic. These redirect destinations can be selected from service configuration pages such as Smart URLs and other protection features that support custom bot redirection. ### Marked Screenshot
| Marker | Control | What It Does | | ------ | ---------------- | ------------------------------------- | | 1 | Guide | Open the related service guide. | | 2 | Clear All | Button action for this panel section. | | 3 | Redirect Name | Name for the bot redirect preset. | | 4 | Redirect Name | Name for the bot redirect preset. | | 5 | Add Bot Redirect | Create the bot redirect preset. | ### Add Bot Redirect The Add Bot Redirect form includes: | Field | Description | | ------------ | ----------------------------------------------- | | Name | Friendly name for the redirect destination | | URL / Domain | Destination URL or domain used for the redirect | Use a clear name so the destination is easy to recognize later from service configuration pages. ### Complete Examples | Use Case | Name Example | URL / Domain Example | Notes | | ---------------------------------------------- | ---------------------- | ------------------------------ | ----------------------------------------------------------- | | Redirect blocked bots to a public landing page | `Blocked Traffic Page` | `https://example.com/blocked` | Good for a simple explanation page | | Redirect bots to the main website | `Main Website` | `https://example.com/` | Useful when you do not want to show a block page | | Redirect bots to a neutral search page | `Search Fallback` | `https://www.google.com/` | Useful when blocked traffic should leave the protected site | | Redirect to a campaign or offer page | `Campaign Redirect` | `https://example.com/campaign` | Use only when the destination is safe for blocked traffic | | Redirect using a domain-style value | `Example Domain` | `example.com` | Use a full HTTPS URL when possible for clearer behavior | ### Service Usage Examples | Service | Example Use | | ---------- | ---------------------------------------------------------------------------------------------------------- | | Smart URLs | Select a saved BOT Redirect destination for visitors that should not reach the final shortlink destination | | Blocker | Use a redirect destination when detected bot traffic should be sent away from the protected page | | Blocker V2 | Use a redirect destination as part of a page response configuration for blocked bot traffic | ### Create A Redirect Destination 1. Open Settings > BOT Redirect. 2. Enter a name. 3. Enter the redirect URL or domain. 4. Click Add. 5. Return to the relevant service page and select the saved redirect destination. ### Bot Redirect List The list shows redirect destinations already created under the account. | Column | Description | | ------------ | ---------------------------------------- | | Date Time | Time when the redirect entry was created | | Name | Friendly redirect name | | URL / Domain | Redirect destination | | Action | Edit or remove the entry | ### Edit Or Remove Use Edit when the destination URL changes. Use Remove when the redirect destination is no longer used. Before removing an entry, check whether it is still selected in Smart URLs, Blocker, or Blocker V2 configurations. ### Best Practices * Use HTTPS redirect destinations when possible. * Avoid redirecting blocked traffic to sensitive internal pages. * Keep names short and descriptive. * Review redirect destinations after changing service rules. ### Related Pages | Page | Purpose | | ---------------------------------------------------------------------------------------------- | ------------------------------------------- | | [Smart URLs](https://docs.stopbot.net/v2/panel-guides/services/smart-urls) | Select bot redirect behavior for shortlinks | | [Blocker V2](https://docs.stopbot.net/v2/panel-guides/services/blocker-v2) | Configure advanced bot page responses | | [Blacklist IP Address](https://docs.stopbot.net/v2/panel-guides/settings/blacklist/ip-address) | Block custom IP addresses | # Blacklist Use Blacklist to add custom deny rules for traffic that should be blocked by your STOPBOT-protected services. Blacklist rules are useful when you already know a specific IP address, hostname, or user agent pattern is unwanted. Keep rules as specific as possible to avoid blocking legitimate visitors. ### Blacklist Menu | Page | Use It For | | ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------- | | [IP Address](https://docs.stopbot.net/v2/panel-guides/settings/blacklist/ip-address) | Block a single IP address, wildcard IP pattern, IP range, or CIDR-style network | | [Hostname](https://docs.stopbot.net/v2/panel-guides/settings/blacklist/hostname) | Block a specific hostname or wildcard hostname pattern | | [Useragent](https://docs.stopbot.net/v2/panel-guides/settings/blacklist/useragent) | Block an exact user agent string or a user agent keyword | ### When To Use Each Rule | Situation | Recommended Rule | | -------------------------------------------------- | ---------------------------------- | | One visitor IP repeatedly sends unwanted traffic | IP Address, SINGLE IP | | A known network repeatedly sends unwanted traffic | IP Address, IP RANGES or LENGTH IP | | Traffic comes from a repeated reverse DNS hostname | Hostname, SINGLE or WILDCARD | | A tool or script uses the same user agent string | Useragent, SINGLE | | A bot family has a clear user agent keyword | Useragent, KEYWORD | ### Add A Blacklist Rule 1. Open Settings > Blacklist. 2. Choose IP Address, Hostname, or Useragent. 3. Select the rule type. 4. Enter the value. 5. Click Add. 6. Confirm the new entry appears in the list. 7. Test the protected service and review logs. ### Best Practices * Use blacklist rules for confirmed unwanted traffic. * Prefer exact matches before wildcard or range rules. * Avoid broad user agent keywords that may match normal browsers. * Review blacklist entries regularly. * Remove rules that are no longer needed. ### Related Pages | Page | Purpose | | -------------------------------------------------------------------------- | ------------------------------------------- | | [Settings Guide](https://docs.stopbot.net/v2/panel-guides/settings) | Return to the Settings overview | | [Whitelist](https://docs.stopbot.net/v2/panel-guides/settings/whitelist) | Manage trusted allow rules | | [Blocker](https://docs.stopbot.net/v2/panel-guides/services/blocker) | Review how standard Blocker handles traffic | | [Blocker V2](https://docs.stopbot.net/v2/panel-guides/services/blocker-v2) | Review advanced protection behavior | # IP Address This page is for custom block rules controlled by your account. Use Blacklist IP Address to block specific IP addresses, wildcard IP patterns, IP ranges, or CIDR-style ranges from your STOPBOT-protected services. ### Marked Screenshot
| Marker | Control | What It Does | | ------ | -------------- | --------------------------------------------------- | | 1 | IP Address | Enter one or more IP values. | | 2 | Hostname | Enter the hostname value. | | 3 | Useragent | Open or control this panel item. | | 4 | Guide | Open the related service guide. | | 5 | IP Type | Select single IP, wildcard, range, or CIDR type. | | 6 | IP Address | Enter one or more IP values. | | 7 | Add IP Address | Add the IP rule to the list. | | 8 | Remove All | Remove all records in this list after confirmation. | ### Add Blacklist IP The Add Blacklist IP form includes: | Field | Description | | ---------- | ---------------------------------------------- | | Type | IP rule type | | IP Address | IP value, range, wildcard, or CIDR-style value | ### Supported Types And Examples | Type | Single Example | Bulk Example | Use It For | | ----------- | ---------------------------- | -------------------------------------------------------- | ------------------------------------------------------- | | SINGLE IP | `203.0.113.10` | `203.0.113.10,203.0.113.11` | Blocking one or more exact IP addresses | | WILDCARD IP | `203.0.113.*` | `203.0.113.*,198.51.100.*` | Blocking repeated traffic from a predictable IP pattern | | LENGTH IP | `203.0.113.10-203.0.113.250` | `203.0.113.10-203.0.113.250,198.51.100.10-198.51.100.50` | Blocking an IP range with a start and end IP | | IP RANGES | `203.0.113.0/24` | `203.0.113.0/24,198.51.100.0/24` | Blocking a CIDR-style network | The panel also supports multi-entry input for bulk submission, with comma-separated values. ### Example Scenarios | Scenario | Type | Value Example | | --------------------------------------- | ----------- | ---------------------------- | | Block one abusive IP | SINGLE IP | `203.0.113.10` | | Block two known abusive IPs at once | SINGLE IP | `203.0.113.10,203.0.113.11` | | Block a repeated subnet pattern | WILDCARD IP | `203.0.113.*` | | Block a specific start-to-end range | LENGTH IP | `203.0.113.10-203.0.113.250` | | Block an entire documented test network | IP RANGES | `203.0.113.0/24` | ### How To Add 1. Open Settings > Blacklist > IP Address. 2. Select the rule type. 3. Enter the IP value. 4. Click Add. 5. Check the Blacklist IP List to confirm the entry was created. ### Blacklist IP List | Column | Description | | --------- | ------------------------------ | | Date Time | Time when the rule was created | | Type | Rule type | | IP | Blocked IP value | | Action | Edit or remove the rule | ### Remove All Use Remove All only when you want to clear all blacklist IP entries for the account. This can immediately change how your services handle traffic, so review the list before clearing it. ### Best Practices * Prefer specific IP rules when possible. * Use wildcard or range rules carefully because they can block large networks. * Add trusted traffic to Whitelist IP Address instead of removing important blacklist entries. * Test traffic after adding a new rule. ### Related Pages | Page | Purpose | | ---------------------------------------------------------------------------------------------- | ------------------------------------------ | | [Whitelist IP Address](https://docs.stopbot.net/v2/panel-guides/settings/whitelist/ip-address) | Allow trusted IP addresses | | [Blocker](https://docs.stopbot.net/v2/panel-guides/services/blocker) | Review how Blocker handles visitor traffic | | [Blocker V2](https://docs.stopbot.net/v2/panel-guides/services/blocker-v2) | Review advanced traffic filtering | # Hostname Use Blacklist Hostname to block traffic from specific hostnames or wildcard hostname patterns. Hostname rules are useful when unwanted traffic repeatedly comes from a known host, cloud provider hostname pattern, or suspicious reverse DNS value. ### Marked Screenshot
| Marker | Control | What It Does | | ------ | ------------- | --------------------------------------------------- | | 1 | IP Address | Enter one or more IP values. | | 2 | Hostname | Enter the hostname value. | | 3 | Useragent | Open or control this panel item. | | 4 | Guide | Open the related service guide. | | 5 | Hostname Type | Select exact hostname or wildcard hostname type. | | 6 | Hostname | Enter the hostname value. | | 7 | Add Hostname | Add the hostname rule to the list. | | 8 | Remove All | Remove all records in this list after confirmation. | ### Add Blacklist Hostname The Add Blacklist Hostname form includes: | Field | Description | | -------- | ------------------------------------- | | Type | Hostname rule type | | Hostname | Hostname or wildcard hostname pattern | ### Supported Types And Examples | Type | Single Example | Bulk Example | Use It For | | -------- | ---------------------- | ------------------------------------------ | ------------------------------------------------------- | | SINGLE | `bad-host.example.com` | `bad-host.example.com,scanner.example.net` | Blocking exact hostnames | | WILDCARD | `*.example.com` | `*.example.com,*.example.net` | Blocking every hostname under a matching domain pattern | The panel supports comma-separated multi-entry input for adding multiple hostnames at once. ### Example Scenarios | Scenario | Type | Value Example | | -------------------------------------------- | -------- | ------------------------------------------ | | Block one exact hostname | SINGLE | `bad-host.example.com` | | Block two exact hostnames at once | SINGLE | `bad-host.example.com,scanner.example.net` | | Block all subdomains from a hostname pattern | WILDCARD | `*.example.com` | | Block multiple wildcard hostname patterns | WILDCARD | `*.example.com,*.example.net` | ### How To Add 1. Open Settings > Blacklist > Hostname. 2. Choose SINGLE or WILDCARD. 3. Enter the hostname value. 4. Click Add. 5. Review the Blacklist Hostname List. ### Blacklist Hostname List | Column | Description | | --------- | ------------------------------ | | Date Time | Time when the rule was created | | Type | Rule type | | Hostname | Blocked hostname value | | Action | Edit or remove the rule | ### Notes * Hostname checks depend on hostname data available for the visitor IP. * Use wildcard entries carefully because they can match many hosts. * If you want to explicitly allow a host, use Whitelist Hostname. ### Related Pages | Page | Purpose | | ---------------------------------------------------------------------------------------------- | ------------------------------------------- | | [Whitelist Hostname](https://docs.stopbot.net/v2/panel-guides/settings/whitelist/hostname) | Allow trusted hostnames | | [Blacklist IP Address](https://docs.stopbot.net/v2/panel-guides/settings/blacklist/ip-address) | Block traffic by IP | | [Blocker V2](https://docs.stopbot.net/v2/panel-guides/services/blocker-v2) | Use hostname rules with advanced protection | # Useragent This page is useful when unwanted clients use a repeated user agent string or a recognizable keyword in the user agent. Use Blacklist Useragent to block traffic by exact user agent value or keyword pattern. ### Marked Screenshot
| Marker | Control | What It Does | | ------ | ---------------- | --------------------------------------------------- | | 1 | IP Address | Enter one or more IP values. | | 2 | Hostname | Enter the hostname value. | | 3 | Useragent | Open or control this panel item. | | 4 | Guide | Open the related service guide. | | 5 | User-Agent Type | Select exact user-agent or keyword mode. | | 6 | User-Agent Value | Enter the user-agent or keyword value. | | 7 | Add User-Agent | Add the user-agent rule to the list. | | 8 | Remove All | Remove all records in this list after confirmation. | ### Add Blacklist Useragent The Add Blacklist Useragent form includes: | Field | Description | | ------------------- | ---------------------------------------- | | Type | User agent rule type | | User-Agent or Value | Exact user agent string or keyword value | ### Supported Types And Examples | Type | Single Example | Bulk Example | Use It For | | ------- | ----------------- | -------------------------- | ---------------------------------------------------- | | SINGLE | `curl/8.5.0` | `curl/8.5.0,Wget/1.21.4` | Blocking exact user agent values | | KEYWORD | `python-requests` | `python-requests,headless` | Blocking user agents that contain a specific keyword | Example SINGLE value: ``` curl/8.5.0 ``` Example KEYWORD value: ``` python-requests ``` Use KEYWORD only when the keyword is specific enough to avoid blocking normal browsers. ### Example Scenarios | Scenario | Type | Value Example | | ---------------------------------------------- | ------- | -------------------------- | | Block one exact automation user agent | SINGLE | `curl/8.5.0` | | Block two exact automation user agents at once | SINGLE | `curl/8.5.0,Wget/1.21.4` | | Block clients containing a clear library name | KEYWORD | `python-requests` | | Block multiple automation keywords at once | KEYWORD | `python-requests,headless` | ### How To Add 1. Open Settings > Blacklist > Useragent. 2. Choose SINGLE or KEYWORD. 3. Enter the user agent value or keyword. 4. Click Add. 5. Review the Blacklist Useragent List. ### Blacklist Useragent List | Column | Description | | --------- | ----------------------------------- | | Date Time | Time when the rule was created | | Type | Rule type | | Value | Blocked user agent value or keyword | | Action | Edit or remove the rule | ### Best Practices * Prefer SINGLE for precise blocking. * Use KEYWORD only for clear automation signatures. * Avoid broad keywords such as `Mozilla`, `Chrome`, or `Safari` because they can match normal browsers. * Review visitor logs after adding a user agent rule. ### Related Pages | Page | Purpose | | --------------------------------------------------------------------------- | ------------------------------------------------ | | [Blocker](https://docs.stopbot.net/v2/panel-guides/services/blocker) | Review visitor user agents in logs | | [Blocker V2](https://docs.stopbot.net/v2/panel-guides/services/blocker-v2) | Use advanced filtering with user agent decisions | | [Recent Logs](https://docs.stopbot.net/v2/panel-guides/account/recent-logs) | Review recent user agent activity | # Whitelist Use Whitelist to add trusted allow rules for traffic that should remain allowed by your STOPBOT-protected services. Whitelist rules are intended for trusted sources such as your own server, office network, monitoring service, partner network, or another known visitor source that should not be blocked by custom rules. ### Whitelist Menu | Page | Use It For | | ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------- | | [IP Address](https://docs.stopbot.net/v2/panel-guides/settings/whitelist/ip-address) | Allow a single IP address, wildcard IP pattern, IP range, or CIDR-style network | | [Hostname](https://docs.stopbot.net/v2/panel-guides/settings/whitelist/hostname) | Allow a specific hostname or wildcard hostname pattern | ### When To Use Each Rule | Situation | Recommended Rule | | ----------------------------------------------- | ---------------------------------- | | Your own server or office has a fixed public IP | IP Address, SINGLE IP | | A trusted network uses a known IP range | IP Address, IP RANGES or LENGTH IP | | A monitoring provider uses a known hostname | Hostname, SINGLE or WILDCARD | | A trusted partner has stable reverse DNS | Hostname, SINGLE | ### Add A Whitelist Rule 1. Open Settings > Whitelist. 2. Choose IP Address or Hostname. 3. Select the rule type. 4. Enter the trusted value. 5. Click Add. 6. Confirm the new entry appears in the list. 7. Test the protected service and review logs. ### Best Practices * Only whitelist traffic you trust. * Prefer exact IP addresses or exact hostnames when possible. * Avoid broad wildcard or range rules unless the whole range is trusted. * Review whitelist entries regularly. * Remove old entries when a server, office network, or provider changes. ### Related Pages | Page | Purpose | | -------------------------------------------------------------------------- | ------------------------------------ | | [Settings Guide](https://docs.stopbot.net/v2/panel-guides/settings) | Return to the Settings overview | | [Blacklist](https://docs.stopbot.net/v2/panel-guides/settings/blacklist) | Manage custom deny rules | | [Blocker](https://docs.stopbot.net/v2/panel-guides/services/blocker) | Review standard traffic decisions | | [Blocker V2](https://docs.stopbot.net/v2/panel-guides/services/blocker-v2) | Review advanced protection decisions | # IP Address Use Whitelist IP Address to explicitly allow trusted IP addresses, wildcard IP patterns, IP ranges, or CIDR-style ranges. Whitelist IP rules are useful for your own servers, trusted monitoring systems, business networks, or known partners that should not be blocked by custom block rules. ### Marked Screenshot
| Marker | Control | What It Does | | ------ | -------------- | --------------------------------------------------- | | 1 | IP Address | Enter one or more IP values. | | 2 | Hostname | Enter the hostname value. | | 3 | Guide | Open the related service guide. | | 4 | IP Type | Select single IP, wildcard, range, or CIDR type. | | 5 | IP Address | Enter one or more IP values. | | 6 | Add IP Address | Add the IP rule to the list. | | 7 | Remove All | Remove all records in this list after confirmation. | ### Add Whitelist IP The Add Whitelist IP form includes: | Field | Description | | ----- | ------------------------------------------------------ | | Type | IP rule type | | IP | Trusted IP value, range, wildcard, or CIDR-style value | ### Supported Types And Examples | Type | Single Example | Bulk Example | Use It For | | ----------- | ---------------------------- | -------------------------------------------------------- | ------------------------------------------------------ | | SINGLE IP | `203.0.113.10` | `203.0.113.10,203.0.113.11` | Allowing one or more trusted exact IP addresses | | WILDCARD IP | `203.0.113.*` | `203.0.113.*,198.51.100.*` | Allowing trusted traffic from a predictable IP pattern | | LENGTH IP | `203.0.113.10-203.0.113.250` | `203.0.113.10-203.0.113.250,198.51.100.10-198.51.100.50` | Allowing a trusted IP range with a start and end IP | | IP RANGES | `203.0.113.0/24` | `203.0.113.0/24,198.51.100.0/24` | Allowing a trusted CIDR-style network | The panel supports comma-separated multi-entry input for adding multiple whitelist entries at once. ### Example Scenarios | Scenario | Type | Value Example | | ---------------------------------- | ----------- | ---------------------------- | | Allow one office IP | SINGLE IP | `203.0.113.10` | | Allow two trusted IPs at once | SINGLE IP | `203.0.113.10,203.0.113.11` | | Allow a trusted wildcard pattern | WILDCARD IP | `203.0.113.*` | | Allow a trusted start-to-end range | LENGTH IP | `203.0.113.10-203.0.113.250` | | Allow a trusted network | IP RANGES | `203.0.113.0/24` | ### How To Add 1. Open Settings > Whitelist > IP Address. 2. Select the rule type. 3. Enter the trusted IP value. 4. Click Add. 5. Confirm the entry appears in the Whitelist IP List. ### Whitelist IP List | Column | Description | | --------- | ------------------------------ | | Date Time | Time when the rule was created | | Type | Rule type | | IP | Allowed IP value | | Action | Edit or remove the rule | ### Important Notes * Whitelist entries can bypass blocklist rules for matching traffic. * Use whitelist rules only for traffic you trust. * Avoid broad wildcard or range rules unless you understand the network being allowed. * Remove entries that are no longer needed. ### Related Pages | Page | Purpose | | ---------------------------------------------------------------------------------------------- | ------------------------- | | [Blacklist IP Address](https://docs.stopbot.net/v2/panel-guides/settings/blacklist/ip-address) | Block known unwanted IPs | | [Blocker](https://docs.stopbot.net/v2/panel-guides/services/blocker) | Review traffic decisions | | [Recent Logs](https://docs.stopbot.net/v2/panel-guides/account/recent-logs) | Review recent IP activity | # Hostname Use Whitelist Hostname to explicitly allow traffic from trusted hostnames or wildcard hostname patterns. Whitelist hostname rules are useful when a trusted service is repeatedly matched by other filtering rules but should still be allowed. ### Marked Screenshot
| Marker | Control | What It Does | | ------ | ------------- | --------------------------------------------------- | | 1 | IP Address | Enter one or more IP values. | | 2 | Hostname | Enter the hostname value. | | 3 | Guide | Open the related service guide. | | 4 | Hostname Type | Select exact hostname or wildcard hostname type. | | 5 | Hostname | Enter the hostname value. | | 6 | Add Hostname | Add the hostname rule to the list. | | 7 | Remove All | Remove all records in this list after confirmation. | ### Add Whitelist Hostname The Add Whitelist Hostname form includes: | Field | Description | | -------- | --------------------------------------------- | | Type | Hostname rule type | | Hostname | Trusted hostname or wildcard hostname pattern | ### Supported Types And Examples | Type | Single Example | Bulk Example | Use It For | | -------- | --------------------- | ----------------------------------------- | ------------------------------------------------------ | | SINGLE | `trusted.example.com` | `trusted.example.com,monitor.example.net` | Allowing exact trusted hostnames | | WILDCARD | `*.example.com` | `*.example.com,*.example.net` | Allowing every hostname under a trusted domain pattern | The panel supports comma-separated multi-entry input for adding multiple hostnames at once. ### Example Scenarios | Scenario | Type | Value Example | | ------------------------------------------- | -------- | ----------------------------------------- | | Allow one exact trusted hostname | SINGLE | `trusted.example.com` | | Allow two exact trusted hostnames at once | SINGLE | `trusted.example.com,monitor.example.net` | | Allow all subdomains from a trusted pattern | WILDCARD | `*.example.com` | | Allow multiple wildcard hostname patterns | WILDCARD | `*.example.com,*.example.net` | ### How To Add 1. Open Settings > Whitelist > Hostname. 2. Choose SINGLE or WILDCARD. 3. Enter the trusted hostname value. 4. Click Add. 5. Confirm the entry appears in the Whitelist Hostname List. ### Whitelist Hostname List | Column | Description | | --------- | ------------------------------ | | Date Time | Time when the rule was created | | Type | Rule type | | Hostname | Allowed hostname value | | Action | Edit or remove the rule | ### Important Notes * Hostname allow rules depend on hostname data available for the visitor IP. * Wildcard hostname entries can match many hosts. * Only whitelist hostnames that you trust. * Review whitelist entries regularly to avoid keeping old exceptions. ### Related Pages | Page | Purpose | | ------------------------------------------------------------------------------------------ | ------------------------------------------ | | [Blacklist Hostname](https://docs.stopbot.net/v2/panel-guides/settings/blacklist/hostname) | Block unwanted hostnames | | [Blocker](https://docs.stopbot.net/v2/panel-guides/services/blocker) | Review hostname decisions | | [Blocker V2](https://docs.stopbot.net/v2/panel-guides/services/blocker-v2) | Use advanced filtering with hostname rules | # PANEL GUIDES The panel is the control center for STOPBOT. Use it to configure services first, then connect those settings to your website or application through the API and service integrations. ### Choose The Right Panel Guide | If You Want To | Open This Guide | | --------------------------------------------------- | ----------------------------------------------------------------------------------------------- | | Understand the panel layout | [Panel Overview](https://docs.stopbot.net/v2/panel-guides/panel-overview) | | Review traffic summaries and charts | [Dashboard](https://docs.stopbot.net/v2/panel-guides/dashboard) | | Manage profile and login information | [My Account](https://docs.stopbot.net/v2/panel-guides/account/my-account) | | View account, login, payment, or service activity | [Recent Logs](https://docs.stopbot.net/v2/panel-guides/account/recent-logs) | | Review invoices or completed payments | [Payments](https://docs.stopbot.net/v2/panel-guides/account/payments) | | Manage referral or affiliate information | [Affiliate](https://docs.stopbot.net/v2/panel-guides/account/affiliate) | | Move an existing subscription from the old platform | [Transfer Subscription](https://docs.stopbot.net/v2/panel-guides/account/transfer-subscription) | | Buy, renew, or upgrade a package | [Plans & Pricing](https://docs.stopbot.net/v2/panel-guides/plans-and-pricing) | | Complete a package payment | [Payment](https://docs.stopbot.net/v2/panel-guides/plans-and-pricing/payment) | | Configure standard visitor filtering | [Blocker](https://docs.stopbot.net/v2/panel-guides/services/blocker) | | Configure advanced filtering and page responses | [Blocker V2](https://docs.stopbot.net/v2/panel-guides/services/blocker-v2) | | Create protected shortlinks | [Smart URLs](https://docs.stopbot.net/v2/panel-guides/services/smart-urls) | | Configure bot redirect destinations | [BOT Redirect](https://docs.stopbot.net/v2/panel-guides/settings/bot-redirect) | | Block specific IP addresses | [Blacklist IP Address](https://docs.stopbot.net/v2/panel-guides/settings/blacklist/ip-address) | | Block specific hostnames | [Blacklist Hostname](https://docs.stopbot.net/v2/panel-guides/settings/blacklist/hostname) | | Block specific user agents | [Blacklist Useragent](https://docs.stopbot.net/v2/panel-guides/settings/blacklist/useragent) | | Allow trusted IP addresses | [Whitelist IP Address](https://docs.stopbot.net/v2/panel-guides/settings/whitelist/ip-address) | | Allow trusted hostnames | [Whitelist Hostname](https://docs.stopbot.net/v2/panel-guides/settings/whitelist/hostname) | | Copy or regenerate your API key | [Apikey](https://docs.stopbot.net/v2/panel-guides/apikey) | # Panel Overview ## Panel Overview Use Panel Overview to understand how the STOPBOT panel is organized, where each major feature is located, and which sidebar page to open for common account, billing, service, and settings tasks. The panel is used to configure STOPBOT services, monitor traffic activity, manage your subscription, and access the API key used by your server-side integrations. ### Marked Screenshot
This screenshot marks the shared header and sidebar controls used across the STOPBOT panel. | Marker | Control | What It Does | | ------ | ----------------- | --------------------------------------- | | 1 | Brand/Home | Open the panel home area. | | 2 | Collapse sidebar | Collapse or expand the left navigation. | | 3 | Theme toggle | Switch light or dark mode. | | 4 | Billing shortcut | Open billing or wallet shortcut. | | 5 | Profile menu | Open the account/profile menu. | | 6 | Dashboard | Open the dashboard overview. | | 7 | Account | Open account-related pages. | | 8 | Plans and Pricing | Open package and pricing area. | | 9 | Blocker | Open Blocker service settings. | | 10 | Blocker V2 | Open Blocker V2 configurations. | | 11 | Smart URLs | Open SmartURLs settings. | | 12 | BOT Redirect | Open bot redirect presets. | | 13 | Blacklist | Open blacklist submenu. | | 14 | Whitelist | Open whitelist submenu. | | 15 | Apikey | Open API key and endpoint examples. | | 16 | Documentation | Open documentation. | | 17 | Live Chat | Open live support chat. | | 18 | Discord Channel | Open the Discord support channel. | | 19 | Email | Open email contact. | ### Where To Open ``` https://panel.stopbot.net ``` Sign in before opening any panel page. If your session expires, the panel redirects you back to the sign-in page. ### Main Navigation Areas | Area | Use It For | | --------------- | ------------------------------------------------------------------------------------------------------------ | | Dashboard | View traffic totals, bot totals, real visitor totals, SmartURLs totals, and service charts | | Account | Manage account details, view recent logs, review payments, manage affiliate data, and transfer subscriptions | | Plans & Pricing | Choose a package, renew access, or upgrade your subscription | | Services | Configure Blocker, Blocker V2, and Smart URLs | | Settings | Configure BOT Redirect, Blacklist, and Whitelist rules | | Apikey | Copy or regenerate your API key | ### Recommended Setup Path 1. Open Dashboard and confirm your account status. 2. Open Plans & Pricing if you need to activate or renew a package. 3. Open Apikey and copy the API key for your backend integration. 4. Configure the service you want to use from Services. 5. Add optional Blacklist, Whitelist, or BOT Redirect rules from Settings. 6. Install the matching integration from the Service Guides. 7. Return to the panel to review statistics and logs. ### Folder Pages Some sidebar entries are folders. They organize the menu but are not the main pages users normally need to read. | Folder | Open A Child Page Instead | | --------- | ------------------------------------------------------------------- | | Account | My Account, Recent Logs, Payments, Affiliate, Transfer Subscription | | Services | Blocker, Blocker V2, Smart URLs | | Settings | BOT Redirect, Blacklist child pages, Whitelist child pages | | Blacklist | IP Address, Hostname, Useragent | | Whitelist | IP Address, Hostname | ### Important Notes * Keep your API key private. * Configure services from the panel before using them in API requests. * Use the Service Guides when you need code-level integration steps. * Review Dashboard and Recent Logs after deploying an integration. ### Related Pages | Page | Purpose | | -------------------------------------------------------------------------- | ------------------------------------ | | [Dashboard](https://docs.stopbot.net/v2/panel-guides/dashboard) | View account and traffic activity | | [Apikey](https://docs.stopbot.net/v2/panel-guides/apikey) | Copy or regenerate your API key | | [Blocker](https://docs.stopbot.net/v2/panel-guides/services/blocker) | Configure standard visitor filtering | | [Blocker V2](https://docs.stopbot.net/v2/panel-guides/services/blocker-v2) | Configure advanced visitor filtering | | [Smart URLs](https://docs.stopbot.net/v2/panel-guides/services/smart-urls) | Manage protected shortlinks | # Dashboard Use Dashboard to review your STOPBOT account activity, visitor totals, bot totals, real visitor totals, SmartURLs count, service charts, subscription notices, and product update information. Dashboard is the first page shown after sign-in and is the fastest place to confirm whether your services are receiving traffic. ### Marked Screenshot Common header and main sidebar controls are documented in [Panel Overview](https://docs.stopbot.net/v2/panel-guides/panel-overview).
| Marker | Control | What It Does | | ------ | ------------------------ | ----------------------------------------------------------------- | | 1 | Support banner | Shortcut to Discord support and its close button. | | 2 | Visitor totals | Shows total visitor, bot traffic, audience, and SmartURLs counts. | | 3 | Visitor statistics chart | Compares Blocker, SmartURLs, Blocker V2, and total activity. | | 4 | Changelog | Shows recent service and panel update notes. | | 5 | Welcome/help panel | Gives onboarding and support context for new users. | | 6 | Discord chat bubble | Opens floating Discord support widget. | | 7 | button:button | Button action for this panel section. | ### What You Can See | Area | Description | | ---------------------- | -------------------------------------------------------- | | Total Visitor | Combined visitor activity recorded by supported services | | Total Bot | Visitors detected or treated as bot/suspicious traffic | | Total Real Visitor | Visitors treated as real or allowed traffic | | Smart URLs | Number of SmartURLs configurations under the account | | All Visitor Statistics | Traffic chart for Blocker, Smart URLs, and Blocker V2 | | Update Information | Product and API update notes shown in the panel | ### How To Read The Dashboard Use the dashboard as a high-level health check: 1. Confirm visitor totals increase after your website sends traffic to STOPBOT. 2. Compare bot and real visitor totals to understand current traffic quality. 3. Review the service chart to see whether activity comes from Blocker, Smart URLs, or Blocker V2. 4. Check subscription warnings if the panel shows an expired or restricted package notice. ### Common Checks | Situation | What To Review | | --------------------------- | -------------------------------------------------------------------------- | | No traffic appears | Confirm the website integration is installed and using the correct API key | | Bot totals are high | Review service logs and check which detection rules are blocking traffic | | SmartURLs count is zero | Create a Smart URLs key from the Smart URLs service page | | Subscription notice appears | Open Plans & Pricing or Payments to review package status | ### After Installing A Service After you deploy Blocker, Blocker V2, or SmartURLs: 1. Send a test request from your website. 2. Refresh Dashboard. 3. Confirm the related service chart or totals update. 4. Open the matching service page for detailed logs. ### Related Pages | Page | Purpose | | --------------------------------------------------------------------------- | -------------------------------------------- | | [Recent Logs](https://docs.stopbot.net/v2/panel-guides/account/recent-logs) | Review recent account or service activity | | [Blocker](https://docs.stopbot.net/v2/panel-guides/services/blocker) | Review Blocker traffic logs | | [Blocker V2](https://docs.stopbot.net/v2/panel-guides/services/blocker-v2) | Review Blocker V2 configurations and traffic | | [Smart URLs](https://docs.stopbot.net/v2/panel-guides/services/smart-urls) | Review SmartURLs keys and statistics | # Account # My Account # Recent Logs # Payments # Affiliate # Transfer Subscription # Plans & Pricing # Payment # Services # Blocker # Blocker V2 # Smart URLs # Settings # BOT Redirect # Blacklist # IP Address # Hostname # Useragent # Whitelist # IP Address # Hostname # Apikey # Getting Started Welcome to our API Documentation! To use this API, please follow the instructions below. ### Obtain your API key To get started, you need to register on our website and create an account. Once registered, you will receive a unique API key to use in your API requests. [Click here](https://stopbot.net/apikey) to access your API.

Here is an example API key you will receive after joining us.

## ## Read the documentation We provide comprehensive documentation on how to use our API. Please read it carefully to understand all the features, endpoints, parameters, and example requests and responses. ## Authenticate Before using the API, make sure to authenticate yourself by using the provided API key. Every request should include your API key in the header or as a parameter in the request. ## Build your request To use the API, you need to construct the HTTP request correctly. Make sure to use the appropriate HTTP method (GET, POST, PUT, DELETE) according to the action you want to perform. Also, check the correct endpoint and include any required parameters. ## Handle the response After sending the request, you will receive a response from our API. The response may contain the requested data or error messages if any issues occur. Make sure to handle the response properly and handle all possible scenarios. ## Maintain security Always keep your API key secure. Never share it with anyone and ensure that you send requests over a secure protocol (HTTPS) to prevent data theft. Thank you for using our API! If you have any further questions, feel free to contact our support team." # Account Here is an example API documentation for the endpoint used for checking account's package status. ## REQUEST ### Endpoint ```url https://stopbot.net/api/account?apikey={APIKEY} ``` ### HTTP Method ``` GET ``` ### **Description** This endpoint is used to check the status of a package account using the provided API key. The request should be made using the GET method and include the API key as a parameter. ### **Parameter(s)** * `apikey` (string, required): The API key provided to the user. ### **Example Request** ```bash CURL "https://stopbot.net/api/account?apikey=9ca6f45b2e9821b3a964c0f79cb67dc3" ``` ## **Example Response** ### Success Response If the HTTP response is 200 (success response), it will generate the following response: ```json { "status": "success", "Apikey": "9ca6f45b2e9821b3a964c0f79cb67dc3", "Packages": "Silver Plan", "Quota": "65000", "Usage": "100", "ExpiredDate": "[UTC-0] 2023-06-23 03:51:32", "timeResponse": "2023-06-8 23:00" } ``` ### Description on successful response * `status`: Response Status: The value is "success" if the request is successful. * `token`: Account token sent in the response. * `Packages`: Name of the active account package. * `Quota`: Amount of available quota in the account package. * `Usage`: Current usage amount. * `ExpiredDate`: Date and time when the package will expire. * `timeResponse`: Date and time when the response was sent. ### Failed Response If the HTTP response is 400 or 401 (failed response), it will generate the following response: ```json { "status": "failed", "timeResponse": "2023-06-8 23:00" } ``` ### Description on failed response: * `status`: Response Status: The value is "failed" if the request fails. * `timeResponse`: Date and time when the response was sent. ## Notes * Please make sure to replace `apikey` with a valid API key. * Check the value of the HTTP response to determine the appropriate response. * Please note the date and time format used in the response. # Blocker Here is an example API documentation for the endpoint used for checking visitors status. ## REQUEST ### Endpoint ```url https://stopbot.net/api/blocker?apikey={APIKEY}&ip={IP}&ua={url-encode-useragent}&url={url-encode-url} ``` ### Method ``` GET ``` ### Parameters * `apikey` (string, required): The API key provided to the user. * `ip` (string, required): The IP address of the visitor. * `ua` (string, required): The useragent used by the visitor. * `url` (string, required): The URL opened by the visitor, REQUEST\_URI from your website or APP). ### Example Request ```bash curl "https://stopbot.net/api/blocker?apikey=9ca6f45b2e9821b3a964c0f79cb67dc3&ip=1.1.1.1&ua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F113.0.0.0%20Safari%2F537.36&url=some_script.php%3Fid%3D1" ``` ## **Example Response** ### Success Response If the HTTP response is 200 (success response), it will generate the following response: ```json { "IP": "1.1.1.1", "IPInfo": { "hostname": "", "asn": 13335, "company": "Cloudflare, Inc.", "isp": "Cloudflare, Inc.", "city": "Marble Bar", "district": "East Pilbara", "region": "Western Australia", "postcode": "", "country": "AU", "latitude": -20.5, "longitude": 120.15, "timezone": "Australia\/Perth" }, "IPStatus": { "isBot": 1, "BlockAccess": 1, "ThreatURL": 0, "DetectActivity": "BLOCKED BY IP DATABASE." }, "UA": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/113.0.0.0 Safari\/537.36", "status": "success", "timeResponse": "2023-07-21 03:59:24" } ``` ### Description on successful response * `IP`: The visitor's IP address. * `IPInfo`: Information about the visitor's IP. * `hostname`: The visitor's hostname. * `asn`: The Autonomous System Number (ASN) that identifies the internet service provider. * `company`: The company associated with the visitor's IP. * `isp`: The Internet Service Provider (ISP) name. * `city`: The city where the visitor is located. * `district`: The district or area associated with the IP address. * `region`: The region where the visitor is located. * `postcode`: The postal code associated with the IP address. * `country`: The country where the visitor is located. * `latitude`: The latitude coordinate of the IP address location. * `longitude`: The longitude coordinate of the IP address location. * `timezone`: The timezone of the IP address location. * `IPStatus`: Information about the visitor's IP status. * `isBot`: Indicates whether the visitor is a bot (1) or not (0). * `BlockAccess`: Indicates whether access is blocked (1) or not (0). * `ThreatURL`: Indicating whether the visitor is performing suspicious actions on your URL, result true (1) or false (0). * `DetectActivity`: Describes the visitor's status. There are 13 possible statuses: 1. BLOCK BY IP DATABASE 2. BLOCK BY MALICIOUS ACTIVITY 3. BLOCK BY HOSTNAME DATABASE 4. BLOCK BY PROXY/VPN/TOR 5. BLOCK BY COUNTRY 6. BLOCK BY IP NON-ISP 7. BLOCK BY SPIDER CRAWLER 8. BLOCK BY THREAT URL 9. BLOCK BY DEVICE DESKTOP 10. BLOCK BY DEVICE MOBILE 11. BLOCK BY BLACKLIST IP (USER) 12. ALLOW BY WHITELIST IP (USER) 13. VISITOR * `UA`: The useragent used by the visitor. * `status`: Indicates the success or failure of the request. * `timeResponse`: Date and time when the response was sent. ### Failed Response If the HTTP response is 400 or 401 (failed response), it will generate the following response: ```json { "status": "failed", "timeResponse": "2023-06-8 23:00" } ``` ### Description on failed response: * `status`: Response Status: The value is "failed" if the request fails. * `timeResponse`: Date and time when the response was sent. # Blocker V2 Here is an example API documentation for the endpoint used for checking visitors status. ## REQUEST ### Endpoint ```url https://stopbot.net/api/v2/blockerv2?apikey={APIKEY}&ip={IP}&ua={url-encode-useragent}&url={url-encode-url}&confname={config-name}¶ms={url-encode-params}&headers={url-encode-params} ``` ### Method ``` GET ``` ### Parameters * `apikey` (string, required): The API key provided to the user. * `ip` (string, required): The IP address of the visitor. * `ua` (string, required): The useragent used by the visitor. * `url` (string, required): The URL opened by the visitor, REQUEST\_URI from your Website/Apps). * `confname` (string, required): The configuration name obtained from STOPBOT.NET Blocker V2. * `params` (string, required): The parameters are received from your Website/Apps and converted the parameter array into JSON. * `headers` (string, required): The headers are received from your Website/Apps and converted the headers array into JSON. ### Example Request ```bash curl "https://stopbot.net/api/v2/blockerv2?apikey=6ba6cb9406efaag4966d2e858c8ba4e4&ip=1.1.1.1&ua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F118.0.0.0%20Safari%2F537.36&url=https%3A%2F%2Fstopbot.net%2Fasdasdasd%2Fasdasdasdasdav2&confname=adakami¶ms=%7B%22paramskey1%22%3A%20%22value1%22%2C%22paramskey2%22%3A%20%22value2%22%7D&headers=%7B%22headerskey1%22%3A%20%22value1%22%2C%22headerskey2%22%3A%20%22value2%22%7D" ``` ## **Example Response** ### Success Response If the HTTP response is 200 (success response), it will generate the following response: ```json { "IP": "1.1.1.1", "UserAgent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/118.0.0.0 Safari\/537.36", "IPInfo": { "hostname": "one.one.one.one", "asn": "AS13335", "company": "Cloudflare, Inc.", "isp": "Cloudflare, Inc.", "city": "Marble Bar", "district": "East Pilbara", "region": "Western Australia", "postcode": "", "country": "AU", "latitude": -20.5, "longitude": 120.15, "timezone": "Australia/Perth" }, "Status": { "Bot": 1, "Block": 1, "ThreatURL": 0, "Desc": "[Disallow] - IP Non-ISP" }, "PageResponse": { "Type": "RedirectURL", "Contents": "https://stopbot.net/bot" }, "status": "success", "timeResponse": "2023-10-31 19:28:50" } ``` ### Description on successful response * `IP`: The visitor's IP address. * `UA`: The useragent used by the visitor. * `IPInfo`: Information about the visitor's IP. * `hostname`: The visitor's hostname. * `asn`: The Autonomous System Number (ASN) that identifies the internet service provider. * `company`: The company associated with the visitor's IP. * `isp`: The Internet Service Provider (ISP) name. * `city`: The city where the visitor is located. * `district`: The district or area associated with the IP address. * `region`: The region where the visitor is located. * `postcode`: The postal code associated with the IP address. * `country`: The country where the visitor is located. * `latitude`: The latitude coordinate of the IP address location. * `longitude`: The longitude coordinate of the IP address location. * `timezone`: The timezone of the IP address location. * `Status`: Information about the visitor's IP status. * `Bot`: Indicates whether the visitor is a bot (1) or not (0). * `Block`: Indicates whether access is blocked (1) or not (0). * `ThreatURL`: Indicating whether the visitor is performing suspicious actions on your URL, result true (1) or false (0). * `Desc`: Description status. * `PageResponse`: Information about the response page. * `Type`: indicates that the response type is : * None : \ Stay on Page. * RedirectURL :\ It's a signal that you should redirect the request to a specific URL provided in the `Contents` field as a way to mitigate or handle bot-related activity. * HTTPStatusCode :\ HTTP status codes are standardized codes used by web servers to indicate the outcome of an HTTP request. The `Contents` field specifies the specific HTTP status code returned in response to your visitor request. (ex: `Contents` 404 and and the HTTP response status code 404 Not Found was returned to indicate this, [click here](https://en.wikipedia.org/wiki/List_of_HTTP_status_codes) for HTTPS Response status code details.) * `Contents`: Response contents. * `status`: Indicates the success or failure of the request. * `timeResponse`: Date and time when the response was sent. ### Failed Response If the HTTP response is 400 or 401 (failed response), it will generate the following response: ```json { "status": "errors", "message": "Your Configuration Name is not registered in our database.", "timeResponse": "2023-10-31 19:28:50" } ``` ### Description on failed response: * `status`: Response Status: The value is "errors" if the request fails. * `message`: Error message. * `timeResponse`: Date and time when the response was sent. # Smart URLs Here is an example API documentation for the endpoint used for checking visitors status of Smart URLs. ## REQUEST ### Endpoint ```url https://stopbot.net/api/shorterlink?apikey={APIKEY}&ip={IP}&keyname={keyname from Stopbot Smart URLs}&ua={url-encode-useragent}&url={url-encode-url} ``` ### Method ``` GET ``` ### Parameters * `apikey` (string, required): The API key provided to the user. * `ip` (string, required): The IP address of the visitor. * `keyname` (string, required): The keyname obtained from STOPBOT.NET Smart URLs. * `ua` (string, required): The useragent used by the visitor. * `url` (string, required): The URL opened by the visitor, REQUEST\_URI from your website or APP). ### Example Request ```bash curl "https://stopbot.net/api/shorterlink?apikey=9ca6f45b2e9821b3a964c0f79cb67dc3&ip=1.1.1.1&keyname=44CSRK&ua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F113.0.0.0%20Safari%2F537.36&url=some_script.php%3Fid%3D1" ``` ## **Example Response** ### Success Response If the HTTP response is 200 (success response), it will generate the following response: ```json { "IP": "1.1.1.1", "IPInfo": { "hostname": "", "asn": 13335, "company": "Cloudflare, Inc.", "isp": "Cloudflare, Inc.", "city": "Marble Bar", "district": "East Pilbara", "region": "Western Australia", "postcode": "", "country": "AU", "latitude": -20.5, "longitude": 120.15, "timezone": "Australia\/Perth" }, "IPStatus": { "isBot": 1, "BlockAccess": 1, "ThreatURL": 0, "DetectActivity": "BLOCKED BY IP DATABASE." }, "UA": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/113.0.0.0 Safari\/537.36", "redirectTo": "STOPBOTNET 404", "jsResponse": "0", "status": "success", "timeResponse": "2023-07-21 04:17:49" } ``` ### Description on successful response * `IP`: The visitor's IP address. * `IPInfo`: Information about the visitor's IP. * `hostname`: The visitor's hostname. * `asn`: The Autonomous System Number (ASN) that identifies the internet service provider. * `company`: The company associated with the visitor's IP. * `isp`: The Internet Service Provider (ISP) name. * `city`: The city where the visitor is located. * `district`: The district or area associated with the IP address. * `region`: The region where the visitor is located. * `postcode`: The postal code associated with the IP address. * `country`: The country where the visitor is located. * `latitude`: The latitude coordinate of the IP address location. * `longitude`: The longitude coordinate of the IP address location. * `timezone`: The timezone of the IP address location. * `IPStatus`: Information about the visitor's IP status. * `isBot`: Indicates whether the visitor is a bot (1) or not (0). * `BlockAccess`: Indicates whether access is blocked (1) or not (0). * `ThreatURL`: Indicating whether the visitor is performing suspicious actions on your URL, result true (1) or false (0). * `DetectActivity`: Describes the visitor's status. There are 13 possible statuses: 1. BLOCK BY IP DATABASE 2. BLOCK BY MALICIOUS ACTIVITY 3. BLOCK BY HOSTNAME DATABASE 4. BLOCK BY PROXY/VPN/TOR 5. BLOCK BY COUNTRY 6. BLOCK BY IP NON-ISP 7. BLOCK BY SPIDER CRAWLER 8. BLOCK BY THREAT URL 9. BLOCK BY INVALID KEYNAME (This notification will be redirected to the BLOCKER panel.) 10. BLOCK BY DEVICE DESKTOP 11. BLOCK BY DEVICE MOBILE 12. BLOCK BY BLACKLIST IP (USER) 13. ALLOW BY WHITELIST IP (USER) 14. VISITOR * `UA`: The useragent used by the visitor. * `redirectTo`: Proceeding to the page that the all visitor will receive. * `jsResponse`: The setting in STOPBOT.NET Smart URLs for JavaScript is enabled (1) or disabled (0). * `status`: Indicates the success or failure of the request. * `timeResponse`: Date and time when the response was sent. ### Failed Response If the HTTP response is 400 or 401 (failed response), it will generate the following response: ```json { "status": "failed", "timeResponse": "2023-06-8 23:00" } ``` ### Description on failed response: * `status`: Response Status: The value is "failed" if the request fails. * `timeResponse`: Date and time when the response was sent. ## REQUEST SHORTLINK JAVASCRIPT To determine the result of JavaScript identification, whether it is active or not in the panel, we need you to update the result to us (such as the ShortenerLink app that you can download by clicking here). Please note that we will not count this API request usage towards your total usage. Additionally, the response we can receive for the `js` = 1 parameter is as follows. ### Endpoint ``` https://stopbot.net/api/shorterlink?apikey={APIKEY}&ip={IP}&keyname={keyname from Stopbot Smart URLs}&js=1 ``` ### Method ``` GET ``` ### Parameters * `apikey` (string, required): The API key provided to the user. * `ip` (string, required): The IP address of the visitor. * `keyname` (string, required): The useragent used by the visitor. * `js` (string, required): Set '1' for active JavaScript. We only accept a value of '1' to determine if visitors are using JavaScript. ### Example Request ```bash CURL "https://stopbot.net/api/shorterlink?apikey=9ca6f45b2e9821b3a964c0f79cb67dc3&ip=1.1.1.1&keyname=44CSRK&js=1" ``` ## **Example Response** ### Success Response If the HTTP response is 200 (success response), it will generate the following response: ```json { "status": "success", "AddVisitorStatus": 1, "timeResponse": "2023-06-8 23:00" } ``` ### Description on successful response * `status`: Indicates the success or failure of the request. * `AddVisitorStatus`: If the update of JavaScript to your IP on the keyname in your Smart URLs is successful, the result will be success (1); otherwise, it will be failure (0). * `timeResponse`: Date and time when the response was sent. ### Failed Response If the HTTP response is 400 (failed response), it will generate the following response: ```json { "status": "failed", "timeResponse": "2023-06-8 23:00" } ``` ### Description on failed response: * `status`: Response Status: The value is "failed" if the request fails. * `timeResponse`: Date and time when the response was sent. # IP Lookup Here is an example API documentation for the endpoint used for IP Lookup. ## REQUEST ### Endpoint ```url https://stopbot.net/api/iplookup?apikey={APIKEY}&ip={IP} ``` ### Method ``` GET ``` ### Parameters * `apikey` (string, required): The API key provided to the user. * `ip` (string, required): The IP address of the visitor. ### Example Request ```bash curl "https://stopbot.net/api/iplookup?apikey=9ca6f45b2e9821b3a964c0f79cb67dc3&ip=1.1.1.1" ``` ## **Example Response** ### Success Response If the HTTP response is 200 (success response), it will generate the following response: ```json { "ip": "1.1.1.1", "hostname": "", "asn": 13335, "company": "Cloudflare, Inc.", "isp": "Cloudflare, Inc.", "city": "Marble Bar", "district": "East Pilbara", "region": "Western Australia", "postcode": "", "country": "Australia", "countryCode": "AU", "latitude": -20.5, "longitude": 120.15, "timezone": "Australia\/Perth", "status": "success", "timeResponse": "2023-07-21 03:55:57" } ``` ### Description on successful response * `hostname`: The visitor's hostname. * `asn`: The Autonomous System Number (ASN) that identifies the internet service provider. * `company`: The company associated with the visitor's IP. * `isp`: The Internet Service Provider (ISP) name. * `city`: The city where the visitor is located. * `district`: The district or area associated with the IP address. * `region`: The region where the visitor is located. * `postcode`: The postal code associated with the IP address. * `country`: The country where the visitor is located. * `countryCode`: The ISO-3166 alpha-2 country code. * `latitude`: The latitude coordinate of the IP address location. * `longitude`: The longitude coordinate of the IP address location. * `timezone`: The timezone of the IP address location. ### Failed Response If the HTTP response is 400 or 401 (failed response), it will generate the following response: ```json { "status": "failed", "timeResponse": "2023-06-8 23:00" } ``` ### Description on failed response: * `status`: Response Status: The value is "failed" if the request fails. * `timeResponse`: Date and time when the response was sent. # Email Validation Here is an example API documentation for the endpoint used for Email Validation. ## REQUEST ### Endpoint ```url https://stopbot.net/api/email-validation?apikey={APIKEY}&email={email} ``` ### Method ``` GET ``` ### Parameters * `apikey` (string, required): The API key provided to the user. * `email` (string, required): The email to be identified. \ Example:\ `email@mailinator.com` ### Example Request ```bash CURL "https://stopbot.net/api/email-validation?apikey=9ca6f45b2e9821b3a964c0f79cb67dc3&email=email@mailinator.com" ``` ## **Example Response** ### Success Response If the HTTP response is 200 (success response), it will generate the following response: ```json { "isEmail": "true", "info": { "user": "email", "domain": "mailinator.com", "isDisposableEmail": 1, "mx": "configured", "spf": "configured", "dmarc": "configured" }, "status": "success", "timeResponse": "2023-06-8 23:00" } ``` ### Description on successful response * `isEmail`: Indicates whether the email parameter is a valid email address. The value true indicates a valid email address, while false indicates an invalid email address. * `info`: Contains information related to the email address. * `user`: The user part of the email address. * `domain`: The domain of the email address. * `isDisposableEmail`: Indicates whether the email address is a disposable email address. A value of 1 indicates a disposable email address. * `mx`: MX (Mail Exchange) configuration status for the domain. * `spf`: SPF (Sender Policy Framework) configuration status for the domain. * `dmarc`: DMARC (Domain-based Message Authentication, Reporting, and Conformance) configuration status for the domain. * `status`: Indicates the success or failure of the request. * `timeResponse`: Date and time when the response was sent. ### Failed Response If the HTTP response is 400 or 401 (failed response), it will generate the following response: ```json { "status": "failed", "timeResponse": "2023-06-8 23:00" } ``` ### Description on failed response: * `status`: Response Status: The value is "failed" if the request fails. * `timeResponse`: Date and time when the response was sent. # Email Verifier Here is an example API documentation for the endpoint used for Email Verifier. Under construction. # Phone Number Identify Here is an example API documentation for the endpoint used for Phone Number Identify. ## REQUEST ### Endpoint ```url https://stopbot.net/api/phone?apikey={APIKEY}&number={phonenumber} ``` ### Method ``` GET ``` ### Parameters * `apikey` (string, required): The API key provided to the user. * `number` (string, required): The number to be identified. \ Example:\ `+11231231234`\ `+6562502222`\ `+6281212341234` ### Example Request ```bash CURL "https://stopbot.net/api/phone?apikey=9ca6f45b2e9821b3a964c0f79cb67dc3&number=+6281212341234" ``` ## **Example Response** ### Success Response If the HTTP response is 200 (success response), it will generate the following response: ```json { "number": "+6281212341234", "isValid": 1, "info": { "phonenumber": "+62 812-1234-1234", "type": "MOBILE", "carrier": "TELKOMSEL", "location": "INDONESIA", "countryCode": "ID" }, "status": "success", "timeResponse": "2023-06-8 23:00" } ``` ### Description on successful response * `number`: This field represents the input phone number that was requested for identification. * `isValid`: This field indicates whether the provided phone number is valid (1) or not valid (0). * `info`: This object contains additional information about the phone numbe. * `phonenumber`: This field represents the formatted version of the phone number. * `type`: This field indicates the type of the phone number. The "type" field can have different values to represent various types of phone numbers. Here are some commonly used types: 1. `FIXED_LINE`: Indicates that the phone number is a fixed line number. It is usually used for home or office telephone numbers that are physically connected. 2. `MOBILE`: Indicates that the phone number is a mobile number. It is typically used for phone numbers associated with mobile devices or cell phones. 3. `TOLL_FREE`: Indicates that the phone number is a toll-free number. It is commonly used for phone numbers that do not incur charges for the calling party. 4. `PREMIUM_RATE`: Indicates that the phone number is a premium rate number. It is often used for phone numbers that provide specialized services with additional charges. 5. `SHARED_COST`: Indicates that the call cost for the phone number is shared between the caller and the recipient. This type may be used for phone numbers that have shared costs between the parties involved. 6. `VOIP`: Indicates that the phone number is used for voice services over the internet protocol (Voice over IP / VoIP). It is typically used for phone numbers connected through internet networks. 7. `PERSONAL_NUMBER`: Indicates that the phone number is a personal number. This type may be used for phone numbers issued to individuals as an alternative to fixed line or mobile numbers. 8. `PAGER`: Indicates that the phone number is a pager number. It is commonly used for phone numbers used to send short messages or notifications. 9. `UAN`: Indicates that the phone number is a universal access number. This type may be used for phone numbers that provide access to special services or general access numbers. 10. `EMERGENCY`: Indicates that the phone number is an emergency number. 11. `VOICEMAIL`: Indicates that the phone number is a voicemail number. 12. `SHORT_CODE`: Indicates that the phone number is a short code number. 13. `STANDARD_RATE`: Indicates that the phone number is a standard rate number. 14. `UNKNOWN`: Indicates that the phone number type cannot be determined. This can occur if the library is unable to classify the phone number correctly or if the phone number is invalid. * `carrier`: This field specifies the mobile carrier associated with the phone number. * `location`: This field indicates the country where the phone number is registered. * `countryCode`: This field represents the country code of the phone number. * `status`: Indicates the success or failure of the request. * `timeResponse`: Date and time when the response was sent. ### Failed Response If the HTTP response is 400 or 401 (failed response), it will generate the following response: ```json { "status": "failed", "timeResponse": "2023-06-8 23:00" } ``` ### Description on failed response: * `status`: Response Status: The value is "failed" if the request fails. * `timeResponse`: Date and time when the response was sent. # STOPBOT Here is a guide to integrating STOPBOT's product into your server: * Blocker () * Smart URLs () # Blocker Identify whether website visitors are real users or bots. It employs various checks such as user-agent analysis, IP blacklist verification, detection of proxies/Tor/VPNs, identification of malicious IPs, hostname blacklist checks, and threat URL detection. By conducting these checks, the Blocker helps protect websites from malicious activities and security threats. It distinguishes between legitimate users and suspicious or malicious visitors, enhancing website security and preventing unauthorized access. While a Blocker provides effective security measures, continuous updates and monitoring of threat databases are essential to stay ahead of evolving bot techniques and emerging threats. \ INTEGRATION GUIDE ----------------- Please follow the instruction as shown in the video or documentation provided. ### VIDEO Here is a video guide on integrating ***Blocker*** into your server. {% embed url="" %} ### DOCUMENTATION Here is the documentation guide on integrating ***Blocker*** into your server. #### BITVISE * Login into your server * Open New SFTP window * Open your main web dir "/var/www/" or the directory that you already specified * Create a file named blocker.php and then fill it with the following code: {% code title="blocker.php" lineNumbers="true" %} ```php Request Timeout\r\n", FILE_APPEND); break; default: $resp = json_decode($response, true); switch($resp['status']){ case "error": file_put_contents("stopbot.txt", "[".date("D/m/y H:i:s")."] -> ".$resp['message']."\r\n", FILE_APPEND); break; case "success": switch(true){ case $resp['IPStatus']['BlockAccess'] == 1 && !empty($RedirectURL): header("Location: ".$RedirectURL); die(); break; case $resp['IPStatus']['BlockAccess'] == 1 && empty($RedirectURL): http_response_code(404); die(); break; } break; default: file_put_contents("stopbot.txt", "[".date("D/m/y H:i:s")."] -> Unknown error\r\n", FILE_APPEND); break; } break; } ``` {% endcode %} * Replace apikey with your API key ([Click here](https://stopbot.net/apikey) for APIKey), then save. ```php #Put your Apikey here. $Apikey = "________________________________"; ``` * Open your index.php file, then add this code on the first line, then save. {% code lineNumbers="true" %} ```php ``` {% endcode %} * For information regarding visitor statistics, [click here](https://docs.stopbot.net/panel-guides/services/stopbot/blocker) for details. If you're still having trouble installing ***Blocker***, please contact us for assistance. # Smart URLs A smart URL refers to a URL that has been enhanced with various features that provide additional advantages. These features may include visitor tracking, customized display based on geographical location, redirection to different links based on the device used, advanced analytics, or the use of specific parameters to send additional data to the destination page. Smart URLs allow users to optimize and manage user experiences better and gain deeper insights into their users. ## INTEGRATION GUIDE Please follow the instruction as shown in the video or documentation provided. ### Download You can download the SmartUrls app files from the server by [clicking here](https://stopbot.net/stopbot-SmartUrls-v.1.2.zip), or you can open the SmartUrls app files on GitHub (). ### VIDEO Here is a video guide on integrating ***SmartURLs*** into your server. {% embed url="" %} ### DOCUMENTATION Here is the documentation guide on integrating ***SmartURLs*** into your server. #### BITVISE * Login into your server * Open New SFTP window * Open your main web dir "/var/www/" or the directory that you already specified * Upload the stopbot-SmartURLs File zip * Unzip/Extract the stopbot-SmartURLs File zip * Edit config.php then change with your APIKey, [Click here](https://stopbot.net/apikey) for APIKey 
<?php
/*
     _              _           _                _   
    | |            | |         | |              | |  
 ___| |_ ___  _ __ | |__   ___ | |_   _ __   ___| |_ 
/ __| __/ _ \| '_ \| '_ \ / _ \| __| | '_ \ / _ \ __|
\__ \ || (_) | |_) | |_) | (_) | |_ _| | | |  __/ |_ 
|___/\__\___/| .__/|_.__/ \___/ \__(_)_| |_|\___|\__|
             | |                                     
             |_|                                     
                      [Stopbot SmartUrls v.1.2]

Guide   : https://docs.stopbot.net/service-guides/stopbot/smart-urls
Website : stopbot.net
contact : t.me @stopbotnet

*/


#Put your Apikey here.
$Apikey = "________________________________";
* You can create Shortlinks / SmartURLs in our control panel, [click here](https://docs.stopbot.net/panel-guides/services/stopbot/smart-urls) for details. * To access the results of the Shortlinks / SmartURLs, please open or you can view them in our control panel, [click here](https://docs.stopbot.net/panel-guides/services/stopbot/smart-urls) for details. * For information regarding visitor statistics, [click here](https://docs.stopbot.net/panel-guides/services/stopbot/smart-urls) for details. #### CPANEL * Open the [STOPBOT Control Panel](http://stopbot.net/signin) page and log in to your stopbot.net account using the registered credentials. * Open the [SmartURLs](https://stopbot.net/shortlink) page and click on "Download SmartURLs".

Download SmartURLs

* Login to your Cpanel, then open "File manager" > public\_html.

Log in to cPanel

Click "File Manager"

Click "public_html"

* Click on "Upload".

Click "Upload"

* Upload the "STOPBOT SmartUrls ZIPFILES" by either "Dropping files here to start uploading" or "selecting the file manually".

Click "Select File"

Select "STOPBOT SMART URLS FILES" and Click "OPEN"

* After the upload is complete, click on "Go Back to".

After Complete, Click "Go Back to"

* Then click on "STOPBOT SmartUrls ZIPFILES" and click on "Extract", and delete the "STOPBOT SmartUrls ZIPFILES" file.

Select the file "STOPBOT SMARTURLS ZIPFILE" and then Click "Extract"

Click "Extract Files"

Select the file "STOPBOT SMARTURLS ZIPFILE" and then Click "Delete"

* Please modify the "config.php" file and enter your API Key ([click here](https://stopbot.net/apikey) to find out your API Key).

Select the file "config.php" and then Click "Edit"

Click "Edit"

Change with your APIKEY, click here for apikey

Click "Save Changes"

* You can create Shortlinks / SmartURLs in our control panel, [click here](https://docs.stopbot.net/panel-guides/services/stopbot/smart-urls) for details. * To access the results of the Shortlinks / SmartURLs, please open or you can view them in our control panel, [click here](https://docs.stopbot.net/panel-guides/services/stopbot/smart-urls) for details. * For information regarding visitor statistics, [click here](https://docs.stopbot.net/panel-guides/services/stopbot/smart-urls) for details. # Blocker V2 Assisting you in identifying whether a user is a bot or not, this feature can also help you perform simple Ad Cloaking by checking which search engine and advertising service the traffic originates from. It can also identify the headers and URLs opened by visitors. You can create multiple configurations, not limited to just one. \ INTEGRATION GUIDE ----------------- Please follow the instruction as shown in the video or documentation provided. ### VIDEO Here is a video guide on integrating ***BlockerV2*** into your server. {% embed url="" %} ### DOCUMENTATION Here is the documentation guide on integrating ***BlockerV2*** into your server. #### BITVISE * Login into your server * Open New SFTP window * Open your main web dir "/var/www/" or the directory that you already specified * Create a file named blockerv2.php and then fill it with the following code: 
<?php
/*
     _              _           _                _   
    | |            | |         | |              | |  
 ___| |_ ___  _ __ | |__   ___ | |_   _ __   ___| |_ 
/ __| __/ _ \| '_ \| '_ \ / _ \| __| | '_ \ / _ \ __|
\__ \ || (_) | |_) | |_) | (_) | |_ _| | | |  __/ |_ 
|___/\__\___/| .__/|_.__/ \___/ \__(_)_| |_|\___|\__|
             | |                                     
             |_|                                     
                      [Example Code BlockerV2]

Guide   : https://docs.stopbot.net/service-guides/stopbot/blockerv2
Website : stopbot.net
contact : t.me @stopbotnet
*/

/* START CONFIGURATION */

#Put your Apikey here.
$api = "________________________________";

# Blockerv2 Configuration Name
# You can view it at https://stopbot.net/blockerv2-list.
# If you haven't created your configuration yet,
# you can do so at https://stopbot.net/blockerv2-add.

#Put your Config Name here.
$configName = "________________________________"; /*  */


stopbot($api, $configName);

function stopbot($api, $configName){
    $return = array("stat"=>0);
    for($a = 1; $a <= 10; $a++){
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, 'https://stopbot.net/api/v2/blockerv2?apikey='.$api.'&ip='.GetIp().'&ua='.urlencode($_SERVER['HTTP_USER_AGENT']).'&url='.urlencode($_SERVER['REQUEST_URI']).'&confname='.$configName.'&params='.urlencode(json_encode($_GET)).'&headers='.urlencode(json_encode(getallheaders())).'&'.rand());
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
        curl_setopt($ch, CURLOPT_ENCODING, 'gzip, deflate');
        $result = curl_exec($ch);
        if($result){
            $resultJson = json_decode($result, TRUE);
            if($resultJson['status'] == "success"){
                $return['stat'] = 1;
                if($resultJson['PageResponse']['Type'] == "RedirectURL"){
                    header("Location: ".$resultJson['PageResponse']['Contents']);
                    die();
                }elseif($resultJson['PageResponse']['Type'] == "HTTPStatusCode"){
                    header("HTTP/1.1 ".httpcodetostatus($resultJson['PageResponse']['Contents']));
                    die();
                }
                
            }else{
                file_put_contents("errorsApi.txt", "[".date("H:i:s d/m/Y")."]".$resultJson['message']."\r\n", FILE_APPEND);
            }
            $a += 10;
        }
    }
    if($a === 10){
        file_put_contents("errorsApi.txt", "[".date("H:i:s d/m/Y")."]Problem with your connection.\r\n", FILE_APPEND);
    }
}
function GetIp(){
    if (isset($_SERVER["HTTP_CF_CONNECTING_IP"])) {
        $_SERVER['REMOTE_ADDR'] = $_SERVER["HTTP_CF_CONNECTING_IP"];
        $_SERVER['HTTP_CLIENT_IP'] = $_SERVER["HTTP_CF_CONNECTING_IP"];
    }
    $client  = @$_SERVER['HTTP_CLIENT_IP'];
    $forward = @$_SERVER['HTTP_X_FORWARDED_FOR'];
    $remote  = $_SERVER['REMOTE_ADDR'];
            
    switch(true){
        case (filter_var($client, FILTER_VALIDATE_IP)):
            $Ip = $client;
            break;
        case(filter_var($forward, FILTER_VALIDATE_IP)):
            $Ip = $forward;
            break;
        default:
            $Ip = $remote;
            break;
    }
    return $Ip;
}
function httpcodetostatus($http_code){
    $status_messages = array(
        "204" => "204 No Content",
        "400" => "400 Bad Request",
        "401" => "401 Unauthorized",
        "403" => "403 Forbidden",
        "404" => "404 Not Found",
        "405" => "405 Method Not Allowed",
        "406" => "406 Not Acceptable",
        "408" => "408 Request Timeout",
        "409" => "409 Conflict",
        "411" => "411 Length Required",
        "412" => "412 Precondition Failed",
        "413" => "413 Payload Too Large",
        "414" => "414 URI Too Long",
        "415" => "415 Unsupported Media Type",
        "416" => "416 Range Not Satisfiable",
        "417" => "417 Expectation Failed",
        "418" => "418 I'm a teapot",
        "421" => "421 Misdirected Request",
        "422" => "422 Unprocessable Entity",
        "423" => "423 Locked",
        "424" => "424 Failed Dependency",
        "425" => "425 Too Early",
        "426" => "426 Upgrade Required",
        "428" => "428 Precondition Required",
        "429" => "429 Too Many Requests",
        "431" => "431 Request Header Fields Too Large",
        "451" => "451 Unavailable For Legal Reasons",
        "500" => "500 Internal Server Error",
        "501" => "501 Not Implemented",
        "502" => "502 Bad Gateway",
        "503" => "503 Service Unavailable",
        "504" => "504 Gateway Timeout",
        "505" => "505 HTTP Version Not Supported",
        "507" => "507 Insufficient Storage",
        "508" => "508 Loop Detected",
        "511" => "511 Network Authentication Required"
    );
    if(empty($http_code) || $http_code == "0"){
        $d = array();
        foreach($status_messages as $code=>$detail){
            $d[] = $detail;
        }
        $return = $d[rand(0, count($d))];
    }else{
        $return = isset($status_messages[$http_code]) ? $status_messages[$http_code] : '404 Not Found';
    }
    
    return $return;
}
* Replace apikey with your API key ([Click here](https://stopbot.net/apikey) for APIKey) ```php #Put your Apikey here. $Apikey = "________________________________"; ``` * And, replace configName with your Config Name ([Click here](https://stopbot.net/blockerv2-list) for Config Name), then save. ```php #Put your Config Name here. $configName = "________________________________"; ``` * Open your index.php file, then add this code on the first line, then save. {% code lineNumbers="true" %} ```php ``` {% endcode %} * For information regarding visitor statistics, [click here](https://stopbot.net/blockerv2-list) for details. If you're still having trouble installing ***BlockerV2***, please contact us for assistance. # Panel Overview # Dashboard # Account # My Account # Recent Logs # Payments # Redeem Coupons # Plans & Pricing # Payment # Services # STOPBOT # BLOCKER # Smart URLs # Optional # BOT Redirect # Blacklist IP # Whitelist IP # Apikey # Affiliate ## Tier Details For each subscribed customer, you will receive a commission per transaction. And this also applies to your sales tier: * Diamond will receive a 15% commission per transaction from users affiliated with your account. * Platinum will receive an 10% commission per transaction from users affiliated with your account. * Silver will receive a 8% commission per transaction from users affiliated with your account. * Bronze will receive a 6% commission per transaction from users affiliated with your account. * none will receive a 5% commission per transaction from users affiliated with your account. ## How do I obtain commission tiers? Here are the details on the number of buyers required to qualify for each commission tier: * Diamond tier requires 100 completed purchase transactions in a single month. * Platinum tier requires 50 completed purchase transactions in a single month. * Silver tier requires 30 completed purchase transactions in a single month. * Bronze tier requires 10 completed purchase transactions in a single month. ## When can I receive commissions based on the tier I achieve? You will receive the commission tier percentage in the same month as the purchasing tier is achieved. ## Can my tier be downgraded? Yes. If your buyers decrease, your tier for the following month will be downgraded. ## How long does it take for my commission withdrawal to be processed? For the commission withdrawal process, it takes a maximum of 7x24 hours on business days, excluding holidays. ## Through which currency is the fund withdrawal conducted? We will only send funds through cryptocurrency, here are the cryptocurrencies we support: * BUSD (BEP20) * USDT (BEP20, SOL, PRC20) * USDC (BEP20, SOL, PRC20) * LTC ## What causes buyers not to leave my referral code? If users register through the referral code you provide, we will offer the predetermined discount to those users. ## Is there any tax deduction on fund withdrawals? Yes, there is a tax deduction related to the conversion into the currency you desire. There is also a deduction for the withdrawal process through the exchanger to your currency address, as well as a fee for the transfer from your cryptocurrency. ## Can I avoid taxes on commission withdrawals? Yes, you can avoid taxes by making a purchase from the stopbot package. Contact us by [clicking here](https://discord.gg/3k5rRXbx) (DEV AND SUPPORT ONLY).
## How do I register to become an affiliate member? You just need to be registered on stopbot.net. If you haven't registered yet, you can sign up by [clicking here](https://stopbot.net/signup). ## Why was my account banned? If your account is breaking the rules as stated in our Terms of Service or engages in illegal and/or activities against the law and there is one or more evidence beyond a reasonable doubt, we will take strict action, including banning your account. ## Can I withdraw commissions after being banned? You will never be able to make withdrawals. # Status # Update Logs This is a notification page for update logs and server maintenance. ### June 2023 \[21-06-2023] Added Coinbase (Bitcoin, Bitcoin Cash, Litecoin,USDC, Matic/Polygon, USDC Polygon) payment gateway.\ \[25-06-2023] Added an API feature to check account details.\ \[26-06-2023] Added the IPlookup API.\ \[27-06-2023] Added Midtrans (GoPay, Qris, and Bank Transfer) payment gateway. ## July 2023 \[05-07-2023] Added the Phone Number Identify API.\ \[08-07-2023] Added the Email Validation API.\ \[14-07-2023] Planned maintenance for migration to a better server.\ \[14-07-2023] Server migration done succesfully.\ \[14-07-2023] Fixed reset password feature.\ \[14-07-2023] Login with Google account is now available.\ \[17-07-2023] Blocker API issues fixed.\ \[17-07-2023] SmartUrls API issues fixed.\ \[21-07-2023] IP information database updated for better accuracy. (IP Lookup, Blocker, SmartURL)\ \[21-07-2023] API documentation has been updated. (IP Lookup, Blocker, SmartURL)\ \[21-07-2023] IPv6 is now supported (beta-testing phase).\ \[22-07-2023] Detection for ipv6 updated and now able to fully analyze audience using ipv6.\ \[24-07-2023] API and Stopbot panel (SmartURL and blocker) updated. You can now select multiple options in allowed country category. ## August 2023 There is no update for august. ## September 2023 \[13-09-2023] Midtrans payment methods (bank transfer, QRIS, GO Pay) have been fixed. ## October 2023 There is no update for october. ## November 2023 \[01-11-2023] Adding a new feature 'Blocker V2' to API v2. \ \[01-11-2023] Adding a new feature 'Blocker V2' to the client panel.\ \[14-11-2023] Added Coinpayments payment gateway (Litecoin, BNB, BNB (BEP20), BUSD (BEP20), BUSD (TRC20), SOLANA, TRON (TRX), USDC (BEP20), USDC (TRC20), USDT (BEP20), USDT (TRC20)).\ \[18-11-2023] Payment Gateway "Coinbase" has been updated (Coinbase Wallet, MetaMask, and WalletConnect).\ \[23-11-2023] Update cryptocurrency Coinpayments gateway (BTC, LTC, BNB, BNB (BSC), BUSD (BEP20), DAI (BEP20), MATIC/POLYGON, SOL, USDC (BEP20), USDC (PRC20), USDT (BEP20), USDT (PRC20), USDT (SOL)).\ \[28-11-2023] Fixed Coinpayments gateway payments and removed BTC from the list of cryptocurrencies. ## December 2023 \[30-12-2023] Adding the affiliate system feature. ## January 2024 \[09-01-2024] Have created sample code for the use of BlockerV2.\ \[30-01-2024] Updated the bot filtering system.\ \[31-01-2024] Adding a bot category 'Threat Feeds'. ## February 2024 \[02-02-2024] Adding the feature to add a "Blacklist - Hostname"\ \[09-02-2024] The API blocker has been updated.\ \[19-02-2024] We have updated the data display, added data filters, and added data sorting to the Blocker panel.\ \[22-02-2024] Planned maintenance for migration to a better server.\ \[22-02-2024] Server migration done succesfully.\ \[22-02-2024] We have updated the data display, added data filters, and added data sorting to the Shortlink panel. ## March 2024 \[04-03-2024] We have updated the IP MALICIOUS detection, and you can 'enable' and 'disable' it in Fraud Check.\ \[09-03-2024] We have updated the APIs for Blocker, BlockerV2, and SmartURLs. ## April 2024 There is no update for april. ## May 2024 There is no update for may. ## June 2024 There is no update for june. ## July 2024 There is no update for july. ## August 2024 There is no update for august. ## September 2024 There is no update for september. ## October 2024 \[10-10-2024] Planned maintenance for migration to a better server.\ \[10-10-2024] Server migration done succesfully. ## November 2024 There is no update for November. ## December 2024 There is no update for December. ## January 2025 There is no update for January. ## February 2025 There is no update for February . ## March 2025 There is no update for March . ## April 2025 There is no update for April. ## May 2025 There is no update for May. ## June 2025 There is no update for June. ## July 2025 There is no update for July. ## August 2025 There is no update for August. ## September 2025 There is no update for September. ## October 2025 There is no update for October. ## November 2025 There is no update for November. ## December 2025 There is no update for December. ## January 2026 There is no update for January. ## February 2026 There is no update for February. ## March 2026 There is no update for March. ## April 2026 There is no update for April. ## May 2026 There is no update for May. ## June 2026 \[06-10-2026] Updated IP Geolocation database with more accurate and up-to-date data, improved city-level accuracy across multiple regions, and added Anycast IP detection. ## July 2026 \[07-07-2026] Added STOPBOT API V2 documentation and Service Guides, including endpoint references, migration notes from V1, error codes, SmartURLs V2 JavaScript verification, and integration examples for Blocker, SmartURLs, and Blocker V2.\ \[07-07-2026] Added SmartURLs Apps with PHP lang and GO lang \ \[09-07-2026] Added WP Plugins with Blocker V2. \ \[11-07-2026] Added Payment method: Midtrans (IDR) and Coinpayments Cryptocurrencies. \ \[12-07-2026] Fixed issue with payment processing. \ \[13-07-2026] Fixed the issue with the 'Change API Key' button.\ \[13-07-2026] Server status monitoring now available for American, Europe, Asia, and Oceania.\ \[13-07-2026] Fixed issue with Server status monitoring (Oceania Server).