Installation Guide
This guide walks you through installing Card Testing Guard and getting ready to turn on protection. Setup itself takes about 10 minutes; the extra time is the 7 days of monitoring you’ll want before blocking.
Install the App
- In your Shopify admin, go to Apps
- Search for “Card Testing Guard” and open its listing
- Click “Add app”, review the permissions, and click “Install app” to confirm
- You’ll automatically be taken to the Card Testing Guard Home page
Permissions requested
read_products, read_orders, read_validations, write_validations, read_payment_customizations, and write_payment_customizations. The write scopes are only for creating and updating CTG’s own checkout rule and payment customization. CTG never edits, cancels, refunds, or deletes your products or orders.Let CTG Set Up Your Checkout Rules
Within about 5 minutes of install, CTG creates two parts on your store:
- A checkout rule (Settings > Checkout)
- A payment customization (Settings > Payments)
Both start in monitoring mode, so they block nothing.
Don't delete them
Turn On the App Embed
This is the part that gives your shoppers their pass. Without it, nobody gets one.
- In your Shopify admin, open Online Store > Themes > Customize > App embeds (the Home page has a button that opens this for you)
- Switch on Card Testing Guard and click Save
- Visit your store and add any item to the cart
Back in the app, click Check again. CTG reads your live theme’s settings to confirm the embed is on.
Development and password-protected stores
read_themes permission. Only if those settings can’t be read does it fall back to fetching the storefront page, and a password page then leaves the result inconclusive rather than failing.Watch in Monitoring Mode
CTG starts in monitoring mode: nothing is blocked. The Home page’s Last 7 days table counts how many checkouts CTG would have held.
The number to watch is Held but ordered - held checkouts that still became orders, so they may be real customers whose pass didn’t arrive. If it isn’t zero, look at those orders before you protect.
Test Your Checkout
Open Test your checkout and work through the list. It shows you, on your own store, that bots are stopped and real customers aren’t. See Testing Your Checkout for the walkthrough.
Turn On Protection
Once the three readiness checks pass, switch Protection on from the Home page. It takes effect within seconds.
If you want to turn it on before setup is finished, CTG asks you to confirm first. Monitoring mode ends only when you switch it off - CTG never turns blocking on by itself.
Stop it any time
What's Next?
- Tune your low-value threshold to sit just above the cheap items bots pick
- Add campaign codes if you send links that go straight to checkout
- Build a Shopify Flow workflow on the attack triggers to get alerts in Slack or email
- Read How Protection Works to understand exactly what gets checked