Field note · Layered defense
Why blocking checkout bots is not enough to stop modern card testing
A checkout token can stop basic direct scripts. It cannot, by itself, stop automation that behaves more like a browser.
Direct scripts
The simplest automation never loads checkout. Checkout-flow proof makes this cheap path harder by requiring a short-lived signed token from the expected flow.
Token-aware automation
An attacker can obtain a normal session or token before submitting. That is why a token must be combined with velocity across IP, email, session, and failure history.
Headless and full-browser automation
More capable automation can execute JavaScript and complete the expected flow. A risk-triggered Turnstile challenge adds another layer, but should not be described as infallible.
Why feedback matters
Actual payment declines tell the protection engine that a pattern is becoming dangerous. Combined with explainable decisions and recovery, the layers can shorten abuse without treating every checkout as hostile.
Pre-launch · Be ready before the next burst
Put a control between checkout abuse and your payment gateway.
Checkout Firewall is being prepared for release. No download or paid checkout is live yet.