Your Checkout Page Just Got a Bouncer
Card testers, bot farms, and fraud rings have been walking straight through your front door. Checkout Shield stands in the way, checks every ID, and throws the garbage back out before it costs you a dime.
What's Actually Standing Guard
Every checkout attempt gets weighed, scored, and acted on — automatically.
Layered Risk Scoring
Every checkout step gets weighed against a stack of independent signals and a real verdict — not one twitchy rule that nukes your best customer by accident.
Watch-First Monitor Mode
See exactly who would've been caught before you block a single real shopper. Prove it works, then flip the switch to enforce.
Bot Behavior Detection
A hidden trap field, a browser-only proof token, typing-speed analysis, and mouse activity checks catch scripts that never touch a keyboard.
Velocity Limiting
Caps how many times one IP, session, email, or device can hammer your checkout in a short window, then cools them off harder every time.
Card-Testing Detection
Spots rapid, mostly-declined, near-identical-amount charges — the exact fingerprint of someone validating stolen cards against your store.
IP & Email Reputation
Cross-checks visitors against known-abuse databases and throwaway email domains before they ever reach your inventory.
Country-Based Rules
Only ship to a handful of countries? Turn away checkout attempts from everywhere else, automatically, no manual review needed.
Optional Professional Scoring
Bolt on a professional-grade fraud score at the exact moment your customer confirms, with a hard stop for the very worst offenders.
Human Verification Challenge
Shows a quick, familiar verification only to the traffic that earned it. Real shoppers barely notice. Scripts choke, every time.
Escalating Automatic Bans
Repeat offenders get timed out, then timed out longer, then locked out for good. No manual IP-blocking spreadsheet required.
One-Click Lockdown Mode
The instant you sense trouble, tighten every limit and force verification site-wide — then let it release itself on a timer.
Suspect Orders Queue
A dedicated shortlist of the orders that raised eyebrows, with one-click block, allowlist, or status-change actions.
The Risk Score That Rides With Every Order
Every order that raised a flag carries its score, band, and reasoning right there next to the order itself. Your fulfillment team doesn't need a security degree — they just need to glance at the card.
- Score and verdict shown on the order screen, no digging required
- Block, allowlist, or change status in bulk from the suspect-orders shortlist
- A full searchable, exportable attempts log for the paper trail your processor will eventually ask for
Alerts That Reach You Before the Damage Does
Immediate email the moment something severe crosses your line, an optional rollup digest so low-level noise doesn't drown your inbox, and an optional chat message so your whole team knows the second an attack starts — not the next time someone happens to glance at the dashboard.
- Severity-based email alerts with editable templates
- Hourly or daily digest rollups for the quiet stuff
- Optional chat webhook so the whole team finds out at once
Backup the Bouncer Can Call In
Checkout Shield stands guard on its own. Plug in outside intelligence and it stops guessing and starts knowing.
MaxMind minFraud
The heavyweight in the lineup — a paid risk score built from a fraud network far bigger than any one store could ever see on its own. It earns its own section below. Keep scrolling.
MaxMind GeoIP Database
A location database that lives on your own server, not someone else's API queue. Country rules and datacenter-network detection run instantly and locally, with nothing to call and nothing to wait on.
AbuseIPDB
A community-built record of addresses already caught misbehaving elsewhere. If the internet flagged them before your customer even loaded the page, Checkout Shield already knows.
IPQualityScore
A second, independent set of eyes on the visitor's address — commercial-grade fraud scoring that catches what a free list alone would let slide.
StopForumSpam
A long-running public blacklist of addresses and emails already caught abusing sites just like yours. Old troublemakers don't get a clean slate here.
Tor Exit-Node Detection
Knows the difference between a customer and a connection built to hide one. Anonymizing traffic gets weighed accordingly, not waved through blind.
Disposable-Email Blocklist
The public registry of throwaway domains, refreshed on a schedule so newly minted burner addresses don't slip through the week they first show up.
Built-In Challenge, Your Choice of Provider
When a visitor earns a second look, the shield hands off to Joomla's own proof-of-work challenge or to whatever captcha plugin you've already got installed — Cloudflare Turnstile included.
Every one of these is optional, and every one is switched on independently. Checkout Shield works with none of them connected. Add one and you've added another opinion in the room before an order gets trusted.
AI to Assist in Fighting AI
The fraud hitting your checkout today isn't a bored teenager with a stolen card. It's automated, tireless, and increasingly built by machines that never sleep and never get bored trying. MaxMind minFraud answers with the same kind of firepower — a risk model built on machine learning, trained across a fraud network spanning thousands of stores, spotting patterns no single shop could ever see on its own.
- Three depths of answer — a plain score, a fuller picture, or a full breakdown of every factor behind it
- Sends only what the decision needs: the email, the billing details, the device, and the order itself
- Medium- and high-risk orders come back with the actual reasons behind the score, not just a number to shrug at
- Report outcomes back — chargeback, confirmed fraud, spam, or perfectly fine — and the model gets sharper on your traffic over time
- A hard line you draw yourself: cross the block score you set, and the order does not go through
What Screening Actually Costs You
Screening is priced per transaction, paid straight through to MaxMind, and only on the checkouts you choose to screen. No subscription. No J2Commerce invoice. Just a small pass-through charge, same as any specialist you'd pay to check one thing well.
Now put that against what one bad order actually costs. The processing fee on the original charge. The processing fee again on the refund. The chargeback penalty stacked on top of both. The item already boxed, labeled, and shipped. The shipping itself, gone for good. The inventory that never comes back. The hour someone on your team spends untangling all of it after the fact.
One bad order stopped pays for a very long run of screening. Work it out. We'll wait. Simple math.
Real-World Use Cases
Stop Running Checkout on the Honor System
Every night you wait is another night the card testers get a free shot at your gateway. Put the bouncer on the door.
Translated In The Following Languages
Arabic Unitag (ar-AA), Chinese, Traditional (zh-TW), Danish (da-DK), Dutch (nl-NL), English (en-GB), English, USA (en-US), Finnish (fi-FI), French (fr-FR), German (de-DE), Greek (el-GR), Hebrew (he-IL), Italian (it-IT), Japanese (ja-JP), Norwegian Bokmål (nb-NO), Persian Farsi (fa-IR), Polish (pl-PL), Portuguese, Brazil (pt-BR), Portuguese, Portugal (pt-PT), Russian (ru-RU), Spanish (es-ES), Swedish (sv-SE), Turkish (tr-TR)
License Information
An active license entitles you to updates, downloads, and support for the duration of the license period. You may continue using this plugin indefinitely without an active license; however, support, updates, and downloads will not be available while your license is inactive.
- Developer J2Commerce
- Extension Type Apps
- J2Commerce Version 6.x
- Joomla Version 6.x
Arabic Unitag
Chinese, Traditional
Danish
Dutch
English
English, USA
Finnish
French
German
Greek
Hebrew
Italian
Japanese
Norwegian Bokmål
Persian Farsi
Polish
Portuguese, Brazil
Portuguese, Portugal
Russian
Spanish
Swedish
TurkishFix Hold the confirm step to the same signal set as the rest of checkout
Fix Resolve the shopper address from the proxy chain the store declares, not the caller
Fix Refuse an address range whose prefix is missing, non-numeric or zero
Fix Keep the shield's own JSON responses out of Joomla's shared page cache
New Feature Carry every node a captcha provider renders, so any installed captcha can be used
Fix Scope a captcha render failure to the visitor who hit it, not the whole store
Fix Report captcha health against the store's own traffic instead of a fixed failure count
New Feature Scoring Thresholds dashboard card with dial controls and AJAX save
New Feature Connector Status card showing every intelligence source at a glance
New Feature Attack Origins card mapping flagged attempts by country
New Feature Revenue by Risk chart replacing the two flat trend tabs
New Feature Enforcement mode choice between Checkout Shield and MaxMind minFraud
New Feature Check MinFraud button to confirm credentials from the settings form
Fix Record the country on each attempt so the origins data has something to plot
Fix Clear the plugin parameter cache after a dashboard save so the change takes effect
Fix Give the honeypot and card-testing signals their own decisive outcome
Fix Separate the velocity buckets so one counter no longer stands in for another
Improvement Group the third-party services under a Connectors tab
Improvement Rename the Mode setting to Enforcement
Improvement Raise the block score floor to 1, matching how the minFraud thresholds already behave
Improvement Draw the empty Attack Origins card as a world map with the reason it is empty
Improvement Resolve the admin dial and card colours from the active template palette
Deletion Drop the spinning icon from the connector re-check
Update Requires Joomla 6.x + J2Commerce 6.x. MaxMind minFraud and the GeoLite2 country
Update database are optional and configured on the Connectors tab. Any captcha plugin
Update installed on the site can be selected as the challenge provider.
New Feature Sync the AbuseIPDB blacklist alongside the disposable-email, StopForumSpam and Tor lists
Improvement Pass the Checkout Shield plugin settings into the bulk-list sync so it can read the API key
Improvement Report the imported AbuseIPDB address count in the task log
Update Requires the Checkout Shield app plugin at version 6.4.4 or later
Update The AbuseIPDB import self-skips when no API key is configured, so this routine is safe to enable either way
You may also be interested in these products
Stay Updated
Subscribe for free and be the first to know about the latest features, updates, and new additions.