Geolocation API Google Cloud Bill

General
1

Hello everyone,

Recently, my store was the victim of a coordinated cyberattack. Malicious international bots and crawlers targeted the frontend maps scripts and forced an aggressive, automated external request loop to the Google Geolocation API. Even though I had standard HTTP domain restrictions active on Google Cloud, the attackers bypassed them using advanced referrer spoofing.

The result? In a matter of days, the bots generated over 6,000,000 requests, racking up a shocking fraudulent bill of $15,301.01 USD.

I found a temporary code workaround in a forum thread, where a user reported a invoice amount spike, and a developer suggested modifying design/backend/templates/addons/geo_maps/components/scripts.tpl by wrapping the provider scripts inside a crawler check.
If you use Google Maps / Geolocation, apply this patch to your .tpl file immediately, clear your cache, and set strict daily quota limits inside your Google Cloud Console so you don’t wake up to a financial nightmare like I did.

Best regards

2

Hello

Additional:

Google Cloud Console (do this first):

  1. Remove “Geolocation API” from the allowed APIs on that key (API restrictions)
  2. Set a hard daily quota cap per API (APIs & Services → Quotas) - the only real hard stop against a runaway bill.
  3. Add a billing budget + alerts.
  4. If you need server-side geolocation, use a separate, IP-restricted key that’s never printed in the page.

and
wrap the geo_maps script loading in {if !defined(‘CRAWLER’)}…{/if}

fallback in js/addons/geo_maps/provider/google/locate.js

_identifyCurrentPositionByApi: $.post(“https://www.googleapis.com/geolocation/v1/geolocate?key=” + api_key)

DISABLE this fallback or prepare small addon without fallback.

Best regards
Robert

3

This continues to work for me.

Google API cost reducer add-on - Google Location Guard?