Home›Odoo apps›Anti-Bot Rate Limiter

Block the bots slowing down your Odoo

Price scrapers, booking bots and AI crawlers load your public pages thousands of times a day. Anti-Bot Rate Limiter stops them at Odoo’s door, before the session and the page rendering. It also works on Odoo.sh, where you have neither nginx nor a firewall.

  • €49
  • Odoo 18 · 19 · 20
  • Community & Enterprise
  • Odoo.sh
See it on the Odoo Apps Store (new tab) Have Kameos install it
The symptoms

A problem the Odoo interface never shows

A bot creates no user, no record and no error. You only see its effects.

A slow website for no clear reason

Public pages slow down in quiet hours as well as busy ones, although nothing was changed.

Killed workers, late scheduled actions

The server saturates in waves: Odoo.sh restarts workers, scheduled actions wait their turn.

A bigger Odoo.sh plan… for nothing

Adding capacity fixes nothing: the bot takes it too. The problem is volume, not power.

A measured case

Up to 77% of the server for a single bot

On a production Odoo.sh database we maintain: 175,000 requests a day on the appointment booking pages, from some sixty addresses in the same range, without reverse DNS. After blocking, over two comparable days (same weekday):

−96%server time used by the bot
−63%total server time
50 → 5saturated minutes
12 → 0killed workers

The response time of a page for a human visitor did not go down: the gain is in freed capacity and the end of saturation. Read the full case.

The module

What Anti-Bot Rate Limiter does

A protection built for Odoo: it knows its URLs, its workers and its logged-in users.

Rules per URL

URL patterns (/appointment*, /shop*), HTTP method and User-Agent, with a limit over a sliding window. The language prefix is ignored.

Per address or per network

Counting per IP or per network (/24 in IPv4, /64 in IPv6): a bot rotating over a whole range is seen as one.

Observe, then block

Observe mode counts what would be refused without refusing anything. Block mode answers “429 Too Many Requests”, then bans the network for a while.

Allow and block lists

Your offices and partners always allowed, a range blocked for good, automatic bans lifted in one click.

Traffic report

Requests per address and per hour, in list, pivot and graph views. Block a network from the report in one click.

No SQL query per visit

Each worker counts in memory and shares its counters every 5 seconds, in a single batch. A refusal costs a few milliseconds.

Anti-Bot Rate Limiter traffic report in Odoo, grouped by network: one range refused 53,746 times, normal visitors at a few dozen requests
The traffic report, grouped by network: a bot range refused tens of thousands of times, real visitors at a few dozen requests.
An Anti-Bot Rate Limiter rule form: paths, 120 requests per 60 seconds, counted per network, Block mode, 10-minute ban
A rule: the costly pages, 120 requests per minute and per network, then a 10-minute ban.
Getting started

Installed in five minutes, without blocking anyone by mistake

  1. Install the module

    Four rules are created in Observe mode: whole site, login, costly public pages, AI and SEO crawlers. Installing refuses nothing.

  2. Read the traffic

    After a day, the report shows who loads your server: network, URL, User-Agent, requests, and what would have been refused.

  3. Switch to Block

    Switch only the rules the figures convinced you of. Changes apply within 5 seconds, without a restart.

  4. Tune the lists

    Allow your offices and integrations, block known ranges, lift a ban when needed.

FAQ

Frequently asked questions

No, not with the default rules: search engines usually crawl well below 300 pages a minute from one address, and the crawler rule only targets AI and SEO tools, in Observe mode. A “429” is understood by search engines as “slow down”, not as an error.
No. Checking a request only reads the worker’s memory, with no database query. The shared state is written every 5 seconds in a single batch, and every second only during an attack.
Yes, that is the case it was built for: Odoo.sh gives access neither to nginx nor to a firewall. On your own server behind a proxy, start Odoo with --proxy-mode.
Cloudflare stops traffic before Odoo, which is even better when you can configure its firewall. The module covers the cases where you cannot, and the bots that still get through.
No. Logged-in users, private addresses (office network, proxy) and allowed networks are never counted. And when in doubt, the module lets the request through.

Not sure what is slowing your Odoo down? We rank your server logs and tell you where the time goes during an audit of your Odoo. And when the standard is not enough, we build the missing module: see our custom Odoo development.

Odoo apps

Our other Odoo modules

All our modules Chatter Position Keep PO Arrival Date Partner Ledger Button Delivery Line Description Mail Composer PDF Reuse Accounting Reports: All History Knowledge Guide

Your Odoo is slow and you do not know why?

Let us look at your server logs together. 30 minutes, no commitment.

Talk about my Odoo