How Protection Works

A plain-language breakdown of what CTG checks, what it never touches, and how it handles passes that get abused.

The Pass

When a shopper browses your store, the app embed runs an invisible Cloudflare Turnstile check and asks the app for a signed token. The token is written to the shopper’s cart as the attribute _origin_token (alongside _origin_minted_at). Shoppers see nothing.

Short-lived - tokens are issued per 15-minute window and stay valid for 15 to 30 minutes
Per shopper - every mint gets its own random value, so one abused token can be cancelled without affecting anyone else
Refreshed automatically - the storefront re-mints every 10 minutes, and whenever a theme updates the cart
Silent on failure - any error on the storefront is swallowed; it never shows to a shopper or stops checkout

The Checkout Rule

Two Shopify Functions apply the same rule, in this order:

Only at checkout - the rule ignores the theme cart page and other steps, so shoppers never see a block before their pass is issued
Monitoring mode - allow everything
Returning customers - a buyer with one or more prior orders is allowed
Company (B2B) buyers - allowed (unless you turned this off)
Campaign codes - a cart carrying a valid code is allowed
Allowlists - carts containing an allowed product or variant are allowed
Scope - outside attack mode, only carts at or below your low-value threshold (or shipping/billing to a strict country) are checked; everything else is allowed
Missing or expired token list - allow (fail open), unless attack mode with “Block even if the token list is unavailable” is on
Token check - the cart’s token must be on the published list and not cancelled; otherwise the checkout is held

What “held” means

Payment customization (primary)

Hides every card payment method, so no card can be entered and no authorization is attempted. Express wallets (Shop Pay, Apple Pay, Google Pay) stay, as a way to pay for real shoppers whose pass failed.

Cart validation (second layer)

Returns a checkout error carrying your block message. Shopify can display these errors without always enforcing them on one-page checkout, which is why the payment customization is the primary block.

What Is Never Checked

Carts above your low-value threshold (unless attack mode or a strict country applies)
Returning customers with at least one prior order
Company (B2B) buyers (unless turned off)
Carts with a valid campaign code
Allowlisted products and variants
Anything while protection is paused or in monitoring mode

Attack mode is stricter, but not unlimited

Attack mode checks every cart, including logged-in customers with zero orders - but the returning-customer, B2B, campaign-code and allowlist exceptions still apply.

Cancelling Abused Passes

An attacker can earn a pass by passing the same invisible check a browser does. CTG makes that costly and short-lived:

Signal	What CTG does
Pass reused on more than 3 checkouts within an hour	Pass is cancelled
Same email or phone on more than 5 checkouts in 24 hours	Every pass it used is cancelled
Fake phone number (such as a 555 number)	That checkout’s pass is cancelled at once
Any pass older than 30 minutes	Expires on its own

Cancellation happens after the fact, so a harvested pass can work for a few checkouts before it is denied. IP address, country, VPN, and email or name patterns are not used to block - attackers control or rotate all of them, and a bot that skips your storefront never reaches the app server where they could be read.

Attack Detection

Every 5 minutes CTG counts your held checkouts in the last hour. 20 or more starts an attack; it ends after at least an hour, once the count is below 5. The gap stops a store near the threshold from flapping on and off. Start and end are logged, fire the Shopify Flow triggers, and show a banner on the Home page.

When Protection Pauses Itself

CTG would rather let a bot through than turn away your customers. It stops blocking, and tells you, when:

The app embed is off - CTG checks your storefront hourly; two misses in a row pause protection (within about 5 minutes of the second check). Protection resumes within 5 minutes of the embed coming back.
No shopper has received a pass in 24 hours - usually the embed is off or your theme blocks the script. It resumes within 5 minutes of the next pass.
Its token list is out of date - the list expires after 10 minutes, so an app outage stops blocking within 10 minutes; it resumes on its own.

Mint failures are deliberately not a signal

A storefront can’t report failed mints in a way an attacker couldn’t forge to switch your protection off. CTG relies on signals it can verify itself: your storefront HTML, and whether any pass has been issued.

The one exception is “Block even if the token list is unavailable”, an explicit opt-in that applies only in attack mode.

What CTG Doesn’t Do

It does not make card testing impossible - a bot that drives a real browser through your storefront can earn a pass
It does not cancel, refund, or delete orders for you
It does not hide payment methods other than card payment, and leaves wallets in place
It does not use IP, country, or VPN signals to block