Protecting Your Store From Bots, Scrapers and Card Testing

Ecommerce bot protection means telling apart the automated traffic that helps your store, such as search engine crawlers, from the bots that harm it: scripts that test stolen card numbers at checkout, try leaked passwords against customer accounts, copy your prices and content, create fake accounts or buy up limited stock. Bad bots cost money directly through fraud, chargebacks and fees, and indirectly through slower pages and distorted analytics. No single tool stops them all. Layered defences, from rate limits and bot detection to fraud screening and good account security, keep most of them out while letting real customers shop normally, on any device and from anywhere they live.

The bots that target online stores

Bots range from simple scripts that are easy to block to sophisticated tools that imitate real browsers and spread requests across many addresses. The OWASP project on automated threats to web applications catalogues the many ways bots misuse websites. For online stores, the most common are:

Card testing: the costliest attack

Card testing often starts quietly, at night or at weekends when nobody is watching, and can involve thousands of attempts in a few hours. Stores with no monitoring may only discover it when the payment provider gets in touch or a pile of chargebacks arrives.

Criminals who buy lists of stolen card numbers need to know which still work. They use bots to make many small payment attempts on online stores. Even when most fail, each attempt can cost you payment fees, and successful ones lead to chargebacks when the real cardholder notices. A sudden burst can also lead your payment provider to raise fees or suspend your account.

Warning signs

• Many failed payments in a short time.
• Lots of small orders, often for the cheapest product.
• Many different cards from the same device, IP address or account.
• Unusual billing addresses or mismatched countries.

Defences

• Rate-limit payment attempts per session, device and IP address.
• Add a challenge, such as a CAPTCHA, after repeated failures.
• Use your payment provider's fraud tools and strong customer authentication.
• Block or review orders below a minimum value if testing targets cheap items.
• Alert your team when failure rates spike.

Talk to your payment provider before an attack, not only during one. Many providers have specific protections against card testing that can be switched on or tuned, and they can advise on the patterns they see across many stores.

Our guide on why online payments fail explains how to monitor payment failures, which also helps spot attacks early.

Protecting customer accounts

Account takeover hurts customers directly. Attackers can place orders with saved cards, redeem loyalty points, change delivery addresses or steal personal details. Even a few incidents can damage trust widely if customers share their experience.

Credential stuffing works because many people reuse passwords. Bots take email and password pairs leaked from other sites and try them on yours.

• Limit login attempts per account and per IP address, with temporary lockouts.
• Add challenges when login patterns look automated.
• Offer stronger sign-in, such as one-time codes or passkeys.
• Alert customers when their password or email address changes, or a login comes from a new device.
• Check new passwords against lists of known breached passwords, where your platform supports it.

Apply similar care to account creation, password reset and gift card balance checks, which bots also target. A gift card balance page without limits lets bots guess card numbers until they find live ones, and those balances can be spent within minutes.

Layers of defence

1. At the edge: a content delivery network or web application firewall with bot management can block known bad bots and suspicious traffic before it reaches your store. Our guide to CDNs for ecommerce covers these services.
2. Rate limits: cap how often any visitor can perform sensitive actions, such as logging in, paying or applying coupons.
3. Challenges: show CAPTCHAs or similar checks only when behaviour looks suspicious, to avoid annoying real customers.
4. Application rules: sensible limits in the store itself, such as maximum quantities for limited items.
5. Fraud screening: your payment provider's tools score orders by risk.
6. Monitoring: alerts for spikes in failed logins, failed payments, new accounts or traffic to particular pages.

Start with the most valuable targets: checkout, login, account creation, password reset, coupon fields and gift card balances. These are where bots do the most damage, and protecting them first gives the biggest benefit for the effort. Layers matter because determined attackers adapt. If one defence is bypassed, the next still slows them down.

Allowing the good bots

Distinguishing good from bad bots needs care, because bad bots often pretend to be good ones. Check that a visitor claiming to be a search engine really comes from that search engine before trusting it. Not all bots are harmful. Search engine crawlers, price comparison services you work with, uptime monitors and some partner integrations need access. Make sure bot rules allow verified search engine crawlers, and test that important pages remain crawlable after changes. Blocking good bots by accident can damage search visibility and break integrations. Our technical SEO checklist explains how to check crawling.

Keeping real customers happy

Protection is only worthwhile if the store still works well for the people it is meant to serve. Bot defences that are too aggressive punish real shoppers: endless CAPTCHAs, blocked payments and locked accounts. Balance protection with experience:

• Show challenges only when risk is high.
• Give clear messages and an easy way to contact support if someone is blocked.
• Review blocked traffic regularly for false positives.
• Test checkout and login after every change to rules.

Watch customer service contacts too. A rise in complaints about being blocked, unable to pay or unable to log in is often the first sign that a rule is too strict.

Ecommerce bot protection for sales and limited launches

Limited editions, collaborations and big sale events attract bots designed to buy stock faster than any person can. Customers who miss out see the products appear on resale sites at higher prices, and blame you for letting it happen.

• Set purchase limits per customer, address and payment method for limited items.
• Use a queue or draw for very high-demand launches, so access is fair rather than a race.
• Require accounts created in advance for some launches, with checks against bulk sign-ups.
• Turn on stronger bot rules for the launch period, then relax them afterwards.
• Review orders before dispatch for patterns such as many orders to similar addresses.
• Cancel and refund orders that clearly breach your terms, and say so in the terms beforehand.

Prepare your hosting as well, because launches stress every single part of the store at once. Bot traffic during launches can be many times normal levels. Our guide to ecommerce hosting covers planning capacity for peaks.

Scraping and your content

Scrapers copy product descriptions, images and prices. Some of this is unavoidable: anything shown publicly can be copied. But heavy scraping slows your store for real customers, and copied content can compete with your pages in search.

• Rate-limit requests from single sources that load pages far faster than any person.
• Block known scraping tools and data-centre traffic that behaves like scraping.
• Write original product content, which gives search engines reason to prefer your pages even if copies exist.
• Monitor for copied content and use the takedown processes of platforms and hosts where appropriate.

Building a response plan

When an attack starts, a plan saves time. Write down:

1. Who receives alerts for unusual payment failures, logins or traffic, and who decides on action.
2. Which rules can be tightened quickly, such as payment rate limits or challenges on login.
3. How to contact your payment provider, host and CDN provider urgently.
4. How to check whether customer accounts were compromised, and how to reset them and inform customers.
5. How to review and reverse rules once the attack ends, so normal customers are not affected for longer than necessary.

Keep the plan short enough to use under pressure, and test it once a year with a simple exercise. After each incident, record what happened and what you changed. Attackers often return, and lessons from the last attack make the next one easier to stop.

Frequently asked questions

Seeing suspicious traffic, failed payments or account takeovers? Ask us for a security review, including bot protection for login, checkout and account pages.