Troubleshooting

Solutions for the most common issues you might run into with Card Testing Guard.

The Home page says “Protection paused: app embed is off”.

• Open Online Store > Themes > Customize > App embeds, switch on Card Testing Guard, and save.
• CTG checks your storefront hourly, and protection resumes within 5 minutes of a successful check. Click Check again on the Home page to re-check right away.
• If you recently switched themes, the embed has to be turned on in the new theme too.

The Home page says “Protection paused: no storefront tokens”.

• No shopper has received a pass in 24 hours. Usually the embed is off, or your theme blocks the app’s script.
• Turn the embed on if it isn’t, then visit your store and add an item to the cart. Protection resumes within 5 minutes of the next pass.
• A store with no real carts for a day pauses until its next real shopper adds to cart. That’s expected - bots never get passes, so an attack alone never lifts a pause.

The Home page says “Protection paused: token list out of date”.

• The app server can’t update your store, so it can’t keep the list of valid passes fresh. Checkouts go through normally in the meantime, and protection resumes on its own.
• If it lasts more than an hour, contact support.

The Home page says “Protection paused: checkout rules missing”.

• The checkout rule (Settings > Checkout) or payment customization (Settings > Payments) was deleted or disabled.
• CTG recreates both within 5 minutes. To stop protection, switch to monitoring instead of deleting them.

Settings say “Not set up yet” and won’t save.

• CTG creates its checkout rules within 5 minutes of install. Wait, then reload the page.

The embed shows as not confirmed on my development store.

• CTG normally reads the theme’s settings through the Admin API (read_themes scope), so a storefront password doesn’t stop the check. If the settings can’t be read, it falls back to fetching the storefront page, and a password page leaves the result inconclusive rather than failing. Confirm manually by viewing your storefront’s HTML for an element with id="ctg-origin".

Real customers are losing card payment.

• Switch to monitoring on the Home page first - nothing is blocked from that moment.
• Check Held but ordered in Last 7 days. Common causes are Buy it now (turn on Send Buy it now through the cart), links that skip your store (add a campaign code or allowlist the product), and a theme that blocks the app’s script.
• If real orders sit below your threshold, lower it or allowlist their products.

A customer saw the block message.

• Their pass was missing, expired, or cancelled. Make your block message tell them how to recover, such as returning to the store and refreshing. Wallets (Shop Pay, Apple Pay, Google Pay) also stay available.

One real customer keeps being held after many attempts.

• The same email or phone on more than 5 checkouts in 24 hours has its passes cancelled. A real customer retrying many times can trip it - the passes are re-issued automatically on their next visit to your storefront.

The Billing page shows no prevented attempts, or says “Tripwire isn’t charging yet”.

• Only checkouts held while protecting, that didn’t become orders, and that arrived during an attack count. Monitoring mode, quiet days, and attempts less than 24 hours old aren’t counted yet.
• “Tripwire isn’t charging yet” is expected until usage billing is configured. See Plans & Billing.

I deleted the app and reinstalled it.

• A reinstall starts fresh: your keys and bot-detection data are deleted on uninstall, and CTG sets up again in monitoring mode, so nothing is blocked until you turn protection on.