Skip to content

VER-003Beside the path

Checkout has stricter controls than the product page

Checks whether your cart and checkout are protected against automation more strictly than your product pages.

What we check

This is a comparison. We grade the responses from your cart and checkout, and from up to 3 of your product pages, on one scale: a bot wall answered instead of your shop (strongest); a CAPTCHA widget in the page markup; a challenge status (401, 403, 405, 429 or 503); or nothing. We then compare the strongest control seen at checkout with the strongest seen on product pages.

Why it matters

Agents need to read your product pages to find and compare your products, so those pages should stay open. The place where money moves, your cart and checkout, is where a control does most good. Challenging everything equally makes you hard to shop; challenging nothing leaves checkout open to abuse.

How we check

We use the cart and checkout pages captured by our crawl, requesting them (or /cart and /checkout) if not captured. Responses we refused ourselves, 404 and 410 responses, and other errors such as 500 are not graded, because they say nothing about protection.

PASS: checkout is protected more strictly than product pages. WARN: checkout has a control, but product pages have one at least as strong. FAIL: no control detected on the cart or checkout. SKIPPED: no cart or checkout response could be graded, or no product page could be graded, so there is nothing to compare.

A risk engine that scores silently and only challenges when an order is submitted cannot be seen without placing an order, so such a checkout may show here as having no control.

How to fix it

  1. Apply your bot management challenge or risk check on cart, checkout and payment, while leaving product pages open to agents.
  2. Do not put an interactive CAPTCHA on product pages; agents need to read them.
  3. Prefer bot management that lets verified agents through over an interactive CAPTCHA at checkout; an interactive challenge before payment is reported as a problem by our separate "No CAPTCHA before the payment step" check.
  4. Log the verdict per request so you can see agent traffic in your analytics.

What good looks like

Product page, requested by an automated client:
GET /products/linen-shirt
HTTP/2 200
content-type: text/html; charset=utf-8
(no challenge markup)

Checkout, requested by the same client:
GET /checkout
HTTP/2 403
cf-mitigated: challenge

Sources