Product · Protection layers
Layered checkout protection, with limits you can understand.
Checkout Firewall evaluates flow, velocity, challenge results, and payment feedback before choosing to allow, challenge, or block.
Core engine
Six signals. One explainable decision.
Each layer covers a different failure mode. No card data enters the engine, and every decision carries a reason.
Layer 1
Checkout-flow proof
A legitimate checkout requests a short-lived signed token bound to the checkout and session context. Direct requests that skip the expected flow can be challenged or blocked.
Limit: It proves the expected flow—not a human—and is not enough by itself.
Layer 2
Turnstile when risk calls for it
Merchant-owned Cloudflare Turnstile keys are validated server-side. Standard Mode challenges suspicious traffic without putting every low-risk customer through a test.
Limit: Turnstile is an external service, and no challenge is infallible.
Layer 3
Velocity across several dimensions
Repeated behavior is evaluated by IP, billing email, WooCommerce session, and IP + email—not by one address alone.
Limit: Free uses conservative fixed thresholds; Pro adapts to distributed rotation.
Layer 4
Failed-payment feedback
Real gateway declines raise suspicion and can create a temporary local lockout. Form errors and broad gateway outages are treated differently.
Limit: This signal follows a gateway attempt, but helps shorten an active attack.
Layer 5
Allow, challenge, or block—with a reason
Every decision carries a stable reason code and readable explanation. Mistaken temporary blocks can be released in one click.
Limit: Challenges are preferred over hard blocks when risk is uncertain.
Layer 6
Emergency response, manual or automatic
Free adds a manual emergency posture with an expiry. Pro can move through Normal, Elevated, Attack, and Recovery states automatically.
Limit: Checkout Firewall never automatically disables the entire payment gateway.
Free core
Useful during a real attack—not a demo.
No account, timer, or local usage cap.
- Classic Checkout, Checkout Blocks, and Store API protection
- Signed, cache-safe checkout-flow proof
- Native Cloudflare Turnstile with server-side validation
- Fixed IP, email, session, and IP + email velocity controls
- Failed-payment lockout and trusted-customer friction reduction
- Manual Emergency Mode with automatic expiry
- Seven-day aggregated history, reason codes, and one-click unblock
- No Codeprint account and no local usage cap
Pro 1.0
Better distributed detection and automatic response.
Pro improves outcomes when attackers rotate identities or a team needs longer incident visibility.
- Normal, Elevated, Attack, and Recovery states
- Dynamic thresholds and distributed identity-pattern detection
- Rotating-IP, email, and session detection
- Adaptive challenge escalation with flash-sale safeguards
- Per-gateway thresholds and outage alerts
- 90-day incident analytics, timelines, and CSV export
- Slack, Discord, and generic webhook alerts
- Policy import/export, diagnostics, and priority support
Pre-launch · Be ready before the next burst
Put a control between checkout abuse and your payment gateway.
Checkout Firewall is being prepared for release. No download or paid checkout is live yet.