Plans & Billing

Billing may not be switched on yet

Charging only starts once usage billing is configured for the app. Until then, everything is counted and shown on the Billing page - the plan section says “Tripwire isn’t charging yet” and the estimate reads “Would be charged” - but nothing is billed.

Card Testing Guard has no subscription. You pay only for bot attempts it actually stops, and only during an attack. Charges run through Shopify and appear on your regular Shopify invoice - CTG never collects payment directly.

Pricing

Prevented attempts per monthPrice per attempt
First 100Free
101 to 2,500$0.05
Above 2,500Free

That caps the most you can pay at $120 a month. Monitoring mode has no attempt limit and is always free.

What Is a Prevented Attempt?

A checkout that:

  1. CTG held while protecting
  2. Never became an order within 24 hours
  3. Arrived during an attack - at least 20 held checkouts in the hour up to and including it

Because the burst window is trailing, the first 19 attempts of each burst are never billed. Each prevented attempt is settled 24 hours after it arrived.

What You’re Never Charged For

  • Monitoring mode
  • Checkouts that became orders
  • Returning customers and allowlisted products
  • Quiet days and single mistaken blocks - an isolated held checkout is never billed
  • Anything while protection was paused, or while the token list was out of date (CTG was failing open, so it prevented nothing)

Prevented Attempts on the Billing Page

So you can audit every charge, the Billing page shows:

  • Prevented attempts over the last 30 days
  • Estimated charge by the tiers above (labelled “Would be charged” while billing is off)
  • Waiting 24 hours to count - held checkouts still waiting out their 24 hours before they can count
  • Each attempt’s time, reason, cart value, and billing state

It's an estimate

The page looks at a rolling 30 days, not your actual Shopify billing cycle, so the charge shown is an estimate. Your Shopify invoice is the source of truth.

How Billing Works

Each prevented attempt is reported to Shopify as one usage event (meter bot-blocked), with a permanent idempotency key per checkout so an attempt can never be billed twice. The tiers are configured on Shopify’s side, and Shopify applies them when it builds your invoice.

Worked example

A store that sees 400 prevented attempts in a month pays for 300 of them: 300 × $0.05 = $15.00. A heavy attack with 5,000 pays $120.00, not more.