Creation of Fake Carts

-- HikaShop version -- : 6.6.0
-- Joomla version -- : 5.4.8
-- PHP version -- : 8.4
-- Error-message(debug-mod must be tuned on) -- : None

Hi, I know this has been addressed a few times but, I now have 58,000 carts created since 2/9/26.

The bots are creating them faster than they can be deleted!

This is now getting ridiculous, there have to be a solution to this by now surely??
this is my current robots.txt file
# If the Joomla site is installed within a folder
# eg www.example.com/joomla/ then the robots.txt file
# MUST be moved to the site root
# eg www.example.com/robots.txt
# AND the joomla folder name MUST be prefixed to all of the
# paths.
# eg the Disallow rule for the /administrator/ folder MUST
# be changed to read
# Disallow: /joomla/administrator/
#
# For more information about the robots.txt standard, see:
# www.robotstxt.org/orig.html

# Allow all search engines to crawl all content

Sitemap: www.xxxxx.com/index.php/component/osmap/...=xml&id=1&format=xml

Allow: /google*.html
User-agent: *

Disallow: */add-1/cid*
Allow: /

User-agent: Amazonbot
Disallow: /
User-agent: RainBot
Disallow: /
User-agent: test-both
Disallow: /
User-agent: fidget-spinner-bot
Disallow: /
User-agent: thesis-research-bot
Disallow: /
User-agent: Pinterestbot
Disallow: /
User-agent: BLEXBot
Disallow: /
User-agent: DataForSeoBot
Disallow: /
User-agent: Mail.Ru
Disallow: /
User-agent: SemrushBot
Disallow: /
User-agent: Baiduspider
Disallow: /
User-agent: MJ12bot
Disallow: /
User-agent: Yandex
Disallow: /
User-agent: AwarioBot
Disallow: /
User-agent: ClaudeBot
Disallow: /
User-agent: Bytespider
Disallow: /
User-agent: GPTBot/1.0
Disallow: /
User-agent: ClaudeBot
Disallow: /
User-agent: facebookexternalhit/1.1
Allow: /
User-agent: Barkrowler
Disallow: /
User-agent: Turnitin
Disallow: /
User-agent: VelenPublicWebCrawler
Disallow: /
User-agent: GPTBot
Disallow: /
User-agent: DotBot
Disallow: /
User-agent: Owler
Disallow: /
User-agent: YisouSpider
Disallow: /
User-agent: ChatGLM-Spider
Disallow: /
User-agent: Barkrowler|netEstate
Disallow: /
User-agent: MojeekBot
Disallow: /
User-agent: serpstatbot
Disallow: /



Thanks

Hello,

Since version 6.6.0, which you are running, HikaShop removes the old carts by itself: the carts left untouched for longer than the "Cart retaining period" setting of the Advanced tab of your HikaShop configuration are deleted while a page of your backend is displayed, and also by the HikaShop cron, which drains them by batches of 200, up to 5000 carts per run. So please first check that the cron is actually running, on the Cron tab of the configuration.

The retaining period is 30 days by default, which is why your carts created on the 2nd of September are still there. Lower it to one or two days and the cron will clear the 58,000 in a handful of runs. The wishlists of your customers are never removed by this, only the carts.

On the other side, HikaShop already refuses to add a product to the cart when the request comes from a user agent it knows as a bot, and that list is long. The ones filling your database are therefore announcing themselves as a normal browser, which is also why your robots.txt does not stop them: it only asks nicely. Stopping that kind of traffic has to be done before it reaches PHP, with the firewall of your host, with a service like Cloudflare, or with a Joomla firewall extension.

We are looking at whether HikaShop could avoid creating a cart at all for a request that carries no cookie, since a bot hitting an add to cart address directly has none, while a customer who browsed your shop before clicking always does. If that turns out to be safe, it would cut most of what you are seeing at the source.

Hiya, Yes the cron is running every 30 mins, but its only deleting a few carts per run? I cannot find anywhere to up the number? cart retention is set to 2 weeks.

******************************************************************************************************************************************************
******************** 2026-09-17 06:37 ********************
HikaShop Triggered at 2026-09-17 06:37
---- Details ----
Waitlist notifies checked (empty)
200 old carts have been removed.

******************************************************************************************************************************************************
******************** 2026-09-17 07:36 ********************
HikaShop Triggered at 2026-09-17 07:36

******************************************************************************************************************************************************
******************** 2026-09-17 08:37 ********************
HikaShop Triggered at 2026-09-17 08:37
---- Details ----
96 old carts have been removed.

******************************************************************************************************************************************************
******************** 2026-09-17 09:36 ********************
HikaShop Triggered at 2026-09-17 09:36
---- Details ----
Waitlist notifies checked (empty)

******************************************************************************************************************************************************
******************** 2026-09-17 10:36 ********************
HikaShop Triggered at 2026-09-17 10:36

Hello,

The number of carts removed per run is not what limits you: the cron removes them by batches of 200 and takes up to 25 batches in a row, so up to 5000 carts per run, and there is no setting to raise that because you are nowhere near it. What limits it is the retaining period itself, since only the carts left untouched for longer than it can be removed. With 2 weeks, the only carts your cron is allowed to touch today are the ones from the 2nd and the 3rd of September, and the other 58,000 are still too young for it. 58,000 carts since the 2nd of September is about 160 per hour, which is what you see leaving per hour: the cron is emptying them at the speed the robots created them two weeks ago.

So set the "Cart retaining period" to one day and the whole backlog becomes removable at once, a handful of cron runs will then clear it. The only consequence is that a customer who leaves their cart for a day finds it empty when they come back, so you can set it back to a longer period once your database is clean.