Fix. FW. Improve AC module to correct processing loopback.

[svfcode]

task https://app.doboard.com/1/task/55330

[codecov]

Codecov Report

❌ Patch coverage is 86.66667% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 29.37%. Comparing base (3a82ac5) to head (fd71dd7).

Files with missing lines	Patch %	Lines
inc/cleantalk-pluggable.php	85.71%	3 Missing ⚠️
lib/Cleantalk/Common/Firewall/FirewallModule.php	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##                fix     #862      +/-   ##
============================================
+ Coverage     29.29%   29.37%   +0.08%     
- Complexity     6462     6465       +3     
============================================
  Files           288      288              
  Lines         26102    26119      +17     
============================================
+ Hits           7646     7672      +26     
+ Misses        18456    18447       -9     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR aims to prevent AntiCrawler / anti-bot cookie logic from interfering with internal “loopback-like” requests (WordPress HTTP API loopbacks and WP Rocket preload hits), and modernizes the firewall block response status handling.

Changes:

• Add AntiCrawler exclusions for WordPress HTTP API loopback User-Agent and WP Rocket preload User-Agent.
• Add a pluggable helper apbct__is_wordpress_loopback_request() and use it to skip cookie-setting for those requests.
• Update firewall die-page response to set HTTP 403 via http_response_code(403) and add PHPUnit coverage for the new exclusions/helper.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/ApbctWP/Firewall/TestAntiCrawler.php	Adds tests for new AntiCrawler exclusions and the new loopback helper; resets cached server variables for deterministic UA reads.
lib/Cleantalk/Common/Firewall/FirewallModule.php	Uses http_response_code(403) instead of sending a raw status line header.
lib/Cleantalk/ApbctWP/Firewall/AntiCrawler.php	Adds new UA-based early exclusions for WordPress loopbacks and WP Rocket preload hits.
inc/cleantalk-pluggable.php	Introduces apbct__is_wordpress_loopback_request() helper based on User-Agent prefix.
cleantalk.php	Uses the new loopback helper to skip anti-bot cookie-setting for matching requests.

Suppressed comments (1)

lib/Cleantalk/ApbctWP/Firewall/AntiCrawler.php:697

• The new WP Rocket preload exclusion checks only the User-Agent substring. There is already a stricter helper apbct__is_wp_rocket_preloader_request() which also verifies the request is a local loopback (REMOTE_ADDR === SERVER_ADDR). Consider using the same stricter criteria here to avoid a spoofable bypass via WP Rocket/Preload UA.

        if ( strpos($this->server__http_user_agent, 'WP Rocket/Preload') !== false ) {
            $this->debug('exclusions precheck: WP Rocket preload user-agent');
            return true;
        }

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.