Bot Protection
Real Shoppers In, Floods of Fake Orders Out
A store that accepts cash on delivery is an easy target for scripts that place fake orders. Mercayo limits how fast anyone can do the things that cost you money, and can ask guests' browsers to prove they are not bots.
- In every plan
- Free for 14 days
Kosha is a demo store on Mercayo. Its products, orders and customers are sample data.
In short
What It Does
Two layers protect your checkout, and a few smaller ones protect the rest of your store.
1. Limits, Always On
Every request is counted per internet address, and the actions that cost you money or can be guessed have their own limits:
| What | Limit per Address |
|---|---|
| Placing an order (cash or online) | 30 in 10 minutes |
| Trying a discount code in the bag | 30 in 10 minutes |
| Sending a COD confirmation code | 10 an hour, and at most 3 codes per phone in 15 minutes |
| Sending a sign-in code | 10 an hour, and at most 3 codes per phone in 15 minutes |
| Looking up an order to track it | 30 in 10 minutes, and 5 wrong phone numbers per order |
| Changing an order found by its number and phone (cancel, return, exchange) | Only with a code sent to the order's own phone or email: 10 an hour, at most 3 per phone in 15 minutes, 5 tries a code |
| Checking a gift card's balance | 10 in 10 minutes |
| Starting a new bag | 120 in 10 minutes |
| Changing bag lines | 600 in 10 minutes |
| Searching | 1,200 a minute |
The limits are generous on purpose, because many Indian mobile shoppers share one carrier address: they stop floods and guessing, not ordinary shopping. Someone who reaches a limit is asked to wait and try again, and nothing they did before is lost.
2. An Optional Bot Check for Guests
With Bot check set to Turnstile, a guest's browser is asked to prove it is not a bot before an order is placed. For most people it is invisible: no puzzles, no pictures of traffic lights. The check sits just above PLACE ORDER; if it has not finished, the shopper is asked to "complete the check above, then place your order", and an order without a passing check is refused on the server. Signed-in shoppers are not asked, because they already proved their phone or email. A fresh check is made for every attempt.
3. Smaller Guards Elsewhere
- Reviews: 3 per address an hour, one review per product per phone or email, links removed, and a hidden field that only bots fill in.
- Questions: 3 per address in 10 minutes and 10 a day, the same question twice on one product refused, links removed, the same hidden field.
- Sign-up forms: 5 sign-ups per address an hour, and a new email joins only after its owner confirms it.
- Contact form: 5 messages per address in 10 minutes, with its own spam checks.
These sit beside the protections for cash orders: the COD confirmation code, part payment and the confirmation call.
For your store
Why It Matters
A burst of fake cash orders can cost a small store a lot: stock held for orders that will never ship, labels printed for nobody, and courier charges for parcels that come back. Limits stop the floods before they reach your orders list.
Guessing is the other risk. Without limits, a script could try thousands of discount codes, order numbers or phone numbers until one works. With them, a few wrong tries are all anyone gets.
The bot check adds a second line for guests without adding friction for real shoppers: there is no puzzle to solve, so your checkout stays as quick as it was. And because the limits and the check come with every store, a small team gets protection it would otherwise have to pay for and set up itself.
Step by step
How It Works
Limits Work From Day One
Nothing to set up: the limits apply to every store, on every request, from the start. They are counted by Mercayo's servers per internet address, so a flood from one place cannot crowd out shoppers elsewhere.
Turn On the Bot Check If You Need It
In Settings → Checkout and COD → Checkout, set Bot check to Turnstile. It applies to guests only, just before an order is placed, and uses Mercayo's own keys: there is no account to create.
Guests Check Out as Usual
For most shoppers the check passes on its own in the background while they fill in the form. If the browser cannot be confirmed, the shopper is asked once, by Cloudflare's Turnstile, right above PLACE ORDER.
Add COD Protection for Cash Orders
For cash on delivery, add the one-time code, part payment or the confirmation call as your store needs. A code proves the phone is real; part payment makes a fake order cost its maker money; a call catches the rest.
Watch for Patterns
Unconfirmed cash orders that nobody answers can be cancelled on their own after the time you choose (see unconfirmed order expiry), so their stock goes back without anyone on your team doing it.
Your shoppers
What Your Shoppers See
Nothing, in most cases. A guest whose browser looks automated may be asked to confirm once before the order is placed. Someone placing many orders, or trying many codes, very quickly is asked to wait a few minutes. Signed-in shoppers are never asked to prove anything more.
Settings
Settings You Control
All are under Settings → Checkout and COD → Checkout.
Mercayo
Mercayo's Controls
Mercayo sets the limits for every store and can turn the bot check on for a store that is being targeted, with a reason your admin shows; every change is in Mercayo's audit log, and the effective value is Mercayo's override, then your setting, then the default. The bot check uses Mercayo's own Turnstile keys, so you do not need a Cloudflare account. The limits trust only the address Mercayo's own servers saw, so a script cannot dodge them by claiming to be someone else.
Limits today
Good to Know Before You Start
- The Turnstile check starts working once Mercayo's Turnstile keys are in place on the live service; until then the setting does nothing and checkout never blocks on it.
- The limits are counted per address and are the same for every store; a store cannot set its own numbers.
- Signed-in shoppers are never asked for the bot check.
- A person placing a fake order by hand is not a bot: the COD code, part payment or a call are the tools for that.
Questions
About Bot Protection
Will the bot check annoy my shoppers?
For most people it is invisible. It runs only for guests, only at the moment the order is placed, and asks for nothing unless the browser looks automated.
What if many shoppers share one mobile network address?
The limits are generous for exactly that reason. They are set to stop floods and guessing, not people shopping at the same time on the same network: 30 orders in 10 minutes from one address is far more than real shoppers place.
Do I need my own Cloudflare account?
No. The bot check uses Mercayo's own keys. You only choose Turnstile in Settings → Checkout and COD.
Does this stop all fake cash orders?
It stops automated floods. A person placing a fake order by hand is stopped better by the COD confirmation code, part payment or a confirmation call.
Can someone guess my discount codes?
Not quickly. Codes typed in the bag are limited to 30 tries in 10 minutes from one address. One-time codes are made of random characters with no look-alike letters, so one code says nothing about the next.
What does a shopper see when they reach a limit?
A plain message asking them to wait a little and try again; at checkout it says how long to wait. Nothing in their bag or on the form is lost.
Related
Related Features
- COD Confirmation CodeShoppers confirm their mobile number with a 6-digit code before a cash on delivery order is placed, so orders with wrong numbers never happen.
- Part Payment for CODCash on delivery shoppers pay a small COD charge or an advance online first and the rest in cash, so a refused parcel still covers its trip.
- COD Confirmation CallMark new cash on delivery orders Unconfirmed until your team has phoned the shopper, with a warning when the shopper has refused parcels before.
- Store IsolationEvery store's orders, shoppers and products are walled off by the database itself, and tests prove one store can never reach another's.
- One-Time CodesMake up to 10,000 single-use codes for one discount, for influencers, printed cards or campaigns: each works once, and you see which order used it.
More in Checkout and Payments: Phone-First Checkout · Online Payments · Bag and Bag Drawer · Delivery Options at Checkout · Gift Options · Quick Checkout for Returning Shoppers · Thank-You Page
Try It on Your Own Store
Every feature is in every plan, free for 14 days.
