Testing Your Checkout
Whether a held checkout stops before your payment gateway sees the card depends on your checkout layout and payment methods, and Shopify can change it. The Test your checkout page lets you prove it on your own store.
How to Run the Tests
- Put your payment gateway in test mode
- Use a test card that will decline
- Work through each row on the Test your checkout page, following its steps
- Check your gateway’s log: no authorization attempt means the block worked
- Record the result for each row: passed, failed, or not applicable, with an optional note
Why the gateway log?
Checkout Layouts
Results are stored per row and per checkout layout - one-page and three-page - because Shopify enforces rules differently in each. If you use one layout, test that one; if you might switch, test both.
The Ten Rows
Rows marked important are the ones where a failure can either let card testing through or turn away real buyers. Failed important rows are named in a banner on your Home page.
1. Cart permalink, no token
ImportantSteps: In a private window, open /cart/VARIANT_ID:1 for a product under your threshold, without visiting the store first. Try to pay by card.
Expected: No card field (or checkout blocked), and no authorization attempt in the gateway log.
2. Cart permalink, forged token
ImportantSteps: Open /cart/VARIANT_ID:1?attributes[_origin_token]=123.abcdefghijklmnopqrstuv.abcdefghijklmnopqrstuv and try to pay by card.
Expected: Blocked, and no authorization attempt in the gateway log.
3. Cart permalink, reused real token
Steps: Add to cart on the storefront, copy the _origin_token cart attribute (from /cart.js), then start 5 permalink checkouts with it.
Expected: The first few pass (by design); from the 4th, card payment is hidden.
4. Storefront API or headless cart
Steps: Only if you sell through a headless store, app or Checkout Kit: create a cart there and go to its checkout.
Expected: Wallets stay available; card follows your settings. Mark N/A if you have no such channel.
5. Normal storefront checkout
ImportantSteps: Browse the store, add a cheap item to the cart, go to checkout and pay by card.
Expected: Card payment available and the order goes through - a real shopper is never affected.
6. Buy it now button
ImportantSteps: On a product page, press Buy it now for an item under your threshold and try to pay by card.
Expected: Card payment available. If it is hidden, turn on "Send Buy it now through the cart" in the app embed settings and test again.
7. Express checkout buttons
Steps: From the product page and the cart, try Shop Pay, Apple Pay, Google Pay, PayPal (including its guest card form) and Klarna, whichever you offer.
Expected: Record for each whether the rule is enforced or only displayed. Wallets are left available on purpose; a guest card form inside a wallet is the one to watch.
8. Draft order invoice
ImportantSteps: In Shopify admin, create a draft order under your threshold, send the invoice to yourself, and pay it by card.
Expected: Must go through. If card payment is hidden, contact support - draft orders need an exemption on your store.
9. Campaign link straight to checkout
Steps: If you send links that skip the store: add a campaign code in Settings, put ?attributes[_ctg_campaign]=CODE on the link, and open it.
Expected: Card payment available. Mark N/A if you never send such links.
10. App embed off while protecting
ImportantSteps: While protecting, turn the app embed off, wait for the "app embed is off" banner (up to an hour), then check out with a cheap item.
Expected: Card payment available - protection pauses instead of blocking everyone. Turn the embed back on afterwards.
Progress on the Home Page
The Home page’s setup guide shows how many test cells you’ve completed out of the total (ten rows across two layouts). It is a recommendation, not a requirement - but a store that skips it hasn’t seen proof that real customers are unaffected.