Protection Settings

The Settings page controls which checkouts CTG checks, which it never checks, what a held shopper sees, and how it behaves during an attack. Protection mode itself (monitoring or protecting) is switched on the Home page, not here.

What to Check

Low-value threshold

Shown as Check carts under. Only carts at or below this amount need a pass. Card testers buy the cheapest items in your store, so checking only small carts leaves your normal orders untouched. The default is 10 in your store’s currency.

Set it just above the price of the cheap items bots pick, and below most of your real orders. If Held but ordered on the Home page shows real customers, raise it or allowlist their products.

Always check these countries

Two-letter country codes. Carts shipping or billing to these countries always need a pass, whatever their value. Leave empty unless attacks keep using the same country.

Exceptions

Carts matching any of these skip the check entirely.

Products and variants

Pick up to 50 products and up to 50 variants that are never checked. Use this for gift cards, samples, or products you mostly sell through links that skip your storefront.

Company (B2B) buyers

On by default. Buyers ordering for a company you approved skip the check, because bots can’t sign in as one of your companies. Turn it off if you want them checked.

Campaign codes

For email, SMS or influencer links that go straight to checkout and skip your storefront, so they arrive without a pass.

1. Add a code in Settings (up to 10; each 4 to 64 letters, digits, - or _; case is kept)
2. Add ?attributes[_ctg_campaign]=YOURCODE to the campaign link
3. Remove the code when the campaign ends

Block Message

What a shopper sees if their checkout is held (up to 250 characters). Leave it empty for the default. Tell them how to get through - for example, returning to the store and refreshing - rather than that something went wrong.

Attack Mode

A stricter setting for while an attack is running. It overrides the low-value scope and will slow down some real shoppers.

• Attack mode - checks every cart, not only cheap ones, including logged-in customers with no previous orders (a bot can create an account). Returning customers, B2B buyers, campaign codes and allowlists are still honored.
• Turn attack mode on automatically - when 20 or more held checkouts arrive in an hour while protecting, CTG switches attack mode on, and off again after at least an hour below 5. Attack mode you turn on yourself is never switched off for you. In monitoring mode, an attack is only reported.
• Block even if the token list is unavailable - only available while attack mode is on. Normally checkouts go through while CTG is paused or its server is down. With this on, checked carts are held instead. It keeps bots out during an outage, but real customers without a pass lose card payment too.

App Embed Setting: Buy It Now

The app embed (Online Store > Themes > Customize > App embeds) has one more setting: Send Buy it now through the cart, off by default.

Shopify creates a fresh cart for Buy it now, which leaves the pass behind - so with protection on, a cheap Buy it now order can lose card payment. With this setting on, Buy it now adds the item to the cart and goes to checkout, so the customer checks out everything in their cart, not just that item. Express wallet buttons are not intercepted.

Limits at a Glance