Checkout has stricter controls than the product page

What we check

This check compares your checkout with your product pages. We grade the responses from your cart and checkout, and from up to 3 of your product pages, on one scale: a bot wall answered instead of your shop (strongest); a CAPTCHA widget in the page markup; a challenge status (401, 403, 405, 429 or 503); or nothing. We then compare the strongest control seen at checkout with the strongest seen on product pages.

Why it matters

Agents need to read your product pages to find and compare your products, so those pages should stay open. A control does the most good on your cart and checkout, where money moves. Challenging everything equally makes you hard to shop; challenging nothing leaves checkout open to abuse.

How we check

We use the cart and checkout pages captured by our crawl, requesting them (or /cart and /checkout) if not captured. We do not grade responses we refused ourselves, 404 and 410 responses, or other errors such as 500; they say nothing about protection.

PASS: checkout is protected more strictly than product pages. WARN: checkout has a control, but product pages have one at least as strong. FAIL: no control detected on the cart or checkout. SKIPPED: no cart or checkout response could be graded, or no product page could be graded, so there is nothing to compare.

A risk engine that scores silently and challenges only when an order is submitted is invisible to us, because we never place an order. Such a checkout may show here as having no control.

How to fix it

1. Apply your bot management challenge or risk check on cart, checkout and payment, while leaving product pages open to agents.
2. Do not put an interactive CAPTCHA on product pages; agents need to read them.
3. Prefer bot management that lets verified agents through over an interactive CAPTCHA at checkout; an interactive challenge before payment is reported as a problem by our separate "No CAPTCHA before the payment step" check.
4. Log the verdict per request so you can see agent traffic in your analytics.

What good looks like

Product page, requested by an automated client:
GET /products/linen-shirt
HTTP/2 200
content-type: text/html; charset=utf-8
(no challenge markup)

Checkout, requested by the same client:
GET /checkout
HTTP/2 403
cf-mitigated: challenge

Sources

• IETF draft-ietf-webbotauth-httpsig-protocol-00 (Web Bot Auth, for letting verified agents through)

Read more

• Why agents stall at checkout

  Challenges, required sign-in and card authentication: what the vendors’ documents say each does, how UCP and ACP handle sign-in, how ACP handles 3-D Secure, and what OAuth metadata tells an agent.