Shield is a security app you install from the Apps market before its settings become available. Once installed, it adds several layers of protection to your checkout to block bots, fraudulent order patterns, and fake phone numbers. Go to Apps, find Shield in the Security & Privacy collection, install it, then click the settings (gear) icon next to it to open the configuration panel.
Captcha
When Captcha is enabled, a CAPTCHA input with an image code appears on the checkout form. Customers must type the numbers shown to place an order. This blocks bots, scripts, and macro-based abuse, so only real users who can read the image can complete checkout.
Duplicate orders blocker
When Duplicate orders blocker is enabled, each new order is checked against previous orders by the same customer, matched on email address and phone number. If a duplicate is detected, the order is blocked automatically. This prevents repeated or fraudulent purchases from the same identity.
Decoy mode
When Decoy mode is enabled, visitors whose device is banned, or whose order is rejected by another Shield rule, see a fully normal store: real cart, real validation, real totals. They then receive a fake order confirmation built from the data they entered. No real order is created, no notifications are sent, and no advertising pixels fire. Attackers think their orders went through and waste time re-attempting, while your real order data stays clean.
Toggling Decoy mode immediately changes how banned devices experience your store. With it on, those visitors see the store as normal and get a fake confirmation. With it off, they receive the standard blocked response. This also governs how the user-agent and URL-parameter blocklists below behave on a match.
Paste protection
When Paste protection is enabled, customers cannot paste text into checkout fields. This forces manual entry and blocks automated scripts and clipboard-based bots that populate forms programmatically.
WhatsApp validator
When WhatsApp validator is enabled, the phone number the customer enters is validated against the WhatsApp API. If the number is not associated with a real WhatsApp account, the order cannot be placed. This is especially useful for stores that confirm orders over WhatsApp, since fraudulent orders often use invented or non-existent numbers.
Max orders per customer
Enable Max orders per customer, then set the Maximum orders per customer field to a whole number between 1 and 3. The same customer cannot place more than that many orders within a short period. Values outside 1 to 3, or non-numeric values, are rejected with an inline error.
Minimum order placement delay
Enable Minimum order placement delay and the checkout order button stays inactive for a required number of seconds after the page loads. Set the wait with the Required delay time slider, which ranges from 2 to 20 seconds. The customer sees no countdown or timer: the button simply does nothing when clicked until the time has passed, so bots that submit instantly cannot place orders and attackers cannot read your threshold.
The panel hints: "Tip: Use this feature to block bots and scripts that submit instantly. Setting the time too long may frustrate genuine customers."
Blocked user-agent keywords
The Blocked User-Agent keywords textarea takes one keyword per line, up to 50 keywords, each between 2 and 100 characters. Every visit is checked: if any keyword appears anywhere in the visitor's User-Agent header, the request is blocked. Typical entries are tool names such as scrapy, selenium, headless, or apifybot. Duplicate and blank lines are ignored. Leave the field empty to disable this check. With Decoy mode on, a matching visitor sees a normal store and every order they submit is silently faked instead of being blocked.
Blocked URL parameters
The Blocked URL parameters textarea flags visitors by the parameters in the link they arrived on. Enter one rule per line, up to 50 rules, each up to 100 characters. A parameter name may contain letters, digits, underscores, and dashes. There are two rule forms:
- Name with a value, written as
name=value(for exampleutm_source=an): matches only when that parameter appears with exactly that value. - Name only, written as just the parameter name (for example
gclid): matches whenever that parameter appears, whatever its value.
If a visitor's landing URL carries a matching parameter, the request is blocked. This is useful for cutting off an ad source, campaign, or click identifier that keeps producing fake cash-on-delivery orders. Leave the field empty to disable this check. As with user-agent blocking, when Decoy mode is on a matching visitor sees a normal store and every order they submit is silently faked.
Additional protection and bans
A note in the panel explains that beyond Shield's configurable rules, Storeep runs multiple layered security measures silently in the background, including advanced behavioural and automator detection, to keep your store and orders secure.
Every order records the customer's device fingerprint and IP address, and you can ban a specific device or IP directly from the order details page. Those bans appear in Settings > Banned sessions, even when Shield is not installed. See Sessions and banned sessions for how to review and release bans.
Saving
Click Save. A success message confirms the update, and any out-of-range value shows an inline error next to its field so you can correct it before saving.