Shield is a security app that protects your store and checkout from bots, fake orders, and fake phone numbers. Go to Apps, open the Security and Privacy tab, click Install on the Shield card, then click Settings on its card. Shield is a paid app billed monthly from your wallet (included on the Business plan). The price shows on its card, and Installing and managing apps explains billing.
Statistics
Shield opens on its Statistics tab, which shows what it stopped for you in the last 30 full days, compared with the 30 days before. Your rules are on the Settings tab, explained below.
- Visitors stopped: visitors blocked before they could shop, including wrong answers to the store entry captcha. A visitor stopped on several days counts once per day.
- Orders stopped: orders Shield refused, including the ones Decoy mode answered with a fake confirmation.
- Orders challenged: orders asked to type the captcha by the step-up captcha or by attack mode. Some of them were real customers who then ordered, so they are not counted as stopped.
- Attacks detected: how many times attack mode turned on.
- Banned now: the bans in force today, split into Devices, IP addresses, and Phone numbers.
The figures are updated once a day and do not include today. They are rounded: small numbers show as "Fewer than 10", and larger ones are rounded to the nearest 10 or 100. This keeps someone testing a bot against a store from learning anything from the figures. Days follow UTC time. If Shield has not stopped anything yet the tab says so, and if counting started less than 30 days ago a note shows the start date. While an attack is running, a note at the top of the tab says when it started and until when attack mode stays on.
Checkout captcha
When Checkout captcha is enabled, a captcha field with an image code appears on the checkout form. Customers must type the numbers shown to place an order. This blocks bots, scripts, and macro abuse.
Step-up captcha
When Step-up captcha is enabled, only the orders Shield is unsure about are asked for the captcha, and every other customer orders as usual. Shield asks when the order is sent through a VPN or proxy, when another new visitor just ordered from the same internet connection, or when a computer reaches the order button without moving its mouse. When the customer clicks to order, the captcha field appears in the same place as the checkout captcha with the message "Enter the numbers you see to confirm your order". Once they type the right code the order goes through, and they are not asked again if they then fix another field. Step-up captcha does nothing while Checkout captcha is on, since every customer is already asked.
Store entry captcha
When Store entry captcha is enabled, every visitor has to read a short code and type it before your store loads. Until they do, they see only the code challenge: no products, no prices, no design. Each visitor solves it once per visit, and verified search engine crawlers pass straight through, so your Google indexing and link previews keep working. Use it when scrapers or bot traffic hit your store, and keep in mind that it adds one step in front of every real customer. Some ad review or domain verification tools may not get past it, so turn it off for a moment if a platform cannot check your site.
Duplicate orders blocker
When Duplicate orders blocker is enabled, a new order is blocked when the same email address or phone number recently ordered the same product, with the same variant. The buyer sees "This order has already been placed". With Decoy mode on, they get a fake confirmation instead and no order is saved.
Decoy mode
When Decoy mode is enabled, visitors stopped by Shield still see a normal store and a normal order confirmation, but no real order is created and you are not notified. Attackers think their orders went through and waste time trying again, while your real order data stays clean.
Toggling Decoy mode immediately changes how banned devices and banned IP addresses experience your store. With it on, those visitors see the store as normal and get a fake confirmation. With it off, they receive the standard blocked response. This also governs how the user-agent and URL-parameter blocklists below behave on a match.
Attack mode
Attack mode is on by default. Shield compares the orders it stops with what your store usually sees, and when they suddenly rise far above your normal, your store is treated as under attack. For the next 3 hours every customer is asked for the captcha before ordering, every order Shield stops gets a fake confirmation like Decoy mode, and you get an email and an app notification. Each new rise keeps attack mode on, and it turns off on its own 3 hours after the last one, so there is nothing to undo. Attack mode only acts while Decoy mode is off, since Decoy mode already fakes every stopped order. You can mute the alerts under Shield attack alerts in your notification settings, and switching attack mode off ends a running attack at once.
Paste protection
When Paste protection is enabled, pasting into the checkout fields is treated as a sign of automated ordering. This helps stop scripts and copy and paste bots that fill forms on their own, so your customers should type their details rather than paste them. The coupon field is never affected.
WhatsApp validator
When WhatsApp validator is enabled, the phone number the customer enters is validated against the WhatsApp API. If the number is not associated with a real WhatsApp account, the order cannot be placed. This is especially useful for stores that confirm orders over WhatsApp, since fraudulent orders often use invented or non-existent numbers.
Max orders per customer
Enable Max orders per customer, then set Maximum orders per customer to 1, 2, or 3. The same customer cannot place more than that many orders in about a day. Other values show "The max orders per customer must be between 1 and 3".
Even without Shield, Storeep applies a limit of 3 orders per customer in about a day. If you install Shield and switch this setting off, the same default limit of 3 applies, so the limit is never removed.
Storeep recognizes the same customer even when they change some of their details. Mobile networks often put many unrelated people behind one connection, so a shared connection is given more room before it is blocked. Setting the limit to 1 never means one order per household or network.
Abandoned and deleted orders do not count. Test orders count like any other order. The blocked customer sees "You have placed several orders recently. Please wait a few hours before trying again", unless Decoy mode is on, in which case they get a fake confirmation and no order is saved.
This is the rule merchants hit while testing their own store. Orders you place after opening your store from a preview link skip it, see How do I place a test order, and why am I blocked from placing more?.
Stricter customer recognition
Some bots change their IP address and their device on every order, so they never reach the limit above. When Stricter customer recognition is enabled, Shield still recognizes them and stops them. Your store stays as fast as before when this option is off.
Minimum order placement delay
Enable Minimum order placement delay and orders sent sooner than a number of seconds after the checkout opens are stopped. Set the wait with the Required delay time slider, from 2 to 15 seconds. Shield may wait a little longer than the time you set, never less. Customers see no countdown or timer, so bots cannot tell how long the wait is.
The panel hints: "Tip: Use this feature to block bots and scripts that submit instantly. Setting the time too long may frustrate genuine customers."
Minimum time between orders
Enable Minimum time between orders and a customer who just placed an order has to wait before placing another one. Set the wait with the Time between orders slider, from 5 to 60 minutes. Shield recognizes the same customer by their visit, device, phone number and email address, and by their connection when it is a VPN or proxy. Shield may wait a little longer than the time you set, never less. The customer sees "You have just placed an order. Please wait a few minutes before placing another one", unless Decoy mode is on, in which case they get a fake confirmation and no order is saved.
The panel hints: "Tip: Use this feature to slow down bots that place several orders in a row. Some real customers place a second order a few minutes after the first, so keep the time short."
Order burst blocker
Some bots clear their cookies and data before every order, so each order looks like it comes from a new visitor. When Order burst blocker is enabled, Shield stops the orders once several new visitors order from the same internet connection within a few minutes. A visitor who browsed your store for a while before ordering is never counted, and real customers who share a connection almost never order this way. The blocked visitor sees "You have placed several orders recently. Please wait a few hours before trying again", unless Decoy mode is on, in which case they get a fake confirmation and no order is saved.
Blocked user-agent keywords
In Blocked User-Agent keywords, enter one keyword per line, up to 50. Every visit is checked: if any keyword appears anywhere in the visitor's User-Agent (the name their browser or tool sends), the visit is blocked. Typical entries are tool names such as scrapy, selenium, headless, or apifybot. Duplicate and blank lines are ignored. Leave it empty to turn this check off. With Decoy mode on, a matching visitor sees a normal store and every order they submit is silently faked instead.
URL parameters
URL parameters checks the parameters in the link a visitor arrived on. Enter one rule per line, up to 50. There are two rule forms:
- Name with a value, written as
name=value(for exampleutm_source=an): matches only when that parameter appears with exactly that value. - Name only, written as just the parameter name (for example
gclid): matches whenever that parameter appears, whatever its value.
Choose how the list is used in URL parameters method:
- Blacklist: a visitor whose landing link carries a matching parameter is blocked. This is useful for cutting off an ad source, campaign, or click identifier that keeps producing fake cash-on-delivery orders. As with user-agent blocking, when Decoy mode is on that visitor sees a normal store and every order they submit is silently faked instead.
- Whitelist: only visitors whose landing link carries a matching parameter can place real orders, for example
utm_source=facebookto accept orders only from your own Facebook ads. Everyone else, including people who type your address or find you on search, can still open your store, but their orders are silently faked when Decoy mode is on, or do not go through when it is off. A match counts for the rest of that visit. You need at least one rule to save a whitelist.
Anyone who knows a listed parameter can add it to your link, so a whitelist does not replace the other Shield checks, which keep running for every visitor. Leave the field empty to turn this check off.
Additional protection and bans
A note in the panel explains that beyond these settings, Storeep also protects your store and orders in the background, with no setting to manage.
From an order's details you can ban the customer's IP (no app needed) or their device (needs Shield). See Logins and banned sessions to review and release bans. To block whole countries, devices, or VPNs, use Access control.
Saving
Click Save. The message "Shield has been updated successfully" confirms it. A value out of range shows an error next to its field.