Welcome to Card Testing Guard
Card Testing Guard stops card-testing bots at your Shopify checkout before a card is ever charged - without adding a single step for your real customers.
What is Card Testing Guard?
Card testing is when fraudsters use your checkout to find out which stolen card numbers still work. A bot runs hundreds of cheap orders through your store, and you pay the gateway fee for every attempt - plus chargebacks for the ones that go through, and possibly a review of your payment account.
Card Testing Guard (CTG) is a Shopify app that stops those bots at checkout. Instead of trying to guess whether a visitor looks bad, it asks a simpler question: did this checkout start from a real browser session on your storefront?
How It Works
Real customers browse your store before they check out. Bots usually don’t - they jump straight to checkout with a link.
- A pass is issued while shoppers browse - an app embed on your storefront quietly gives each browsing shopper’s cart a short-lived, signed pass, behind an invisible Cloudflare Turnstile check.
- Checkout looks for the pass - two Shopify Functions check low-value checkouts for a valid pass. A payment customization removes card payment from any that lack one; a cart validation blocks them as a second layer.
- Wallets stay available - Shop Pay, Apple Pay and Google Pay are left in place, so a real customer whose pass didn’t arrive can still pay.
- It fails open - if CTG can’t be sure real shoppers are getting passes, it pauses itself rather than blocking anyone.
Orders above your low-value threshold, returning customers, and company (B2B) buyers are never checked. See How Protection Works for the full rule.
What CTG does and doesn't promise
Key Features
Blocks Before the Charge
A checkout without a valid pass has card payment removed, so there is nowhere to enter a card and nothing reaches your payment gateway.
Invisible to Real Shoppers
The pass is created in the background while customers browse - no puzzle, no extra step. Returning customers and company (B2B) buyers are never checked.
Monitoring Mode First
It starts by watching only. The Home page shows how many checkouts it would have held in the last 7 days, and how many of those still became orders.
Attack Detection
A burst of held checkouts is flagged as an attack on your Home page. Optionally, attack mode switches on automatically and checks every cart, not just cheap ones.
Fails Open
If the app embed is off, no passes are being issued, or the app server is down, protection pauses itself instead of turning away your customers.
Built-In Checkout Tests
A ten-row checklist walks you through proving, on your own store with your own gateway in test mode, that bots are stopped and real customers are not.
Shopify Flow Triggers
Four triggers - attack detected, attack ended, protection paused, protection resumed - let you route alerts to Slack, email, or anything Flow can do.
Pay Only for Results
No subscription. You pay only for bot attempts it actually stops during an attack: the first 100 each month are free, and the most you can pay is $120 a month.
Who Should Use This App?
- Stores under attack that want blocking on within minutes, plus proof it worked
- Stores that want insurance that never interferes with real sales and needs no attention between attacks
- Digital-goods merchants who can’t use manual payment capture because customers expect instant delivery
Ready to Get Started?
Installation Guide
Install the app, turn on the app embed, and watch in monitoring mode.
Testing Your Checkout
Prove on your own store that bots are stopped and customers aren't.
Protection Settings
Set your threshold, exceptions, block message, and attack mode.
FAQs
Answers to common questions about customers, attacks, pricing, and privacy.
Have Questions?
Check out our FAQ section or contact our support team at team@distylled.com - we're here to help!