Checkout Protection

Documentation · IP & Fake Order Blocker · Enterprise

Checkout Protection is an Enterprise feature that stops a blocklisted customer from completing checkout — separate from, and narrower than, the Block & Re-director engine.

This is customer-account blocking, not IP or country blocking. It only affects a shopper who is checking out as a logged-in, identified customer on your store. Guest checkouts with no linked Shopify customer account are not affected by this feature.

What it actually checks

Checkout Protection runs as a Shopify Function at the cart-validation stage of checkout. It looks at the customer ID attached to the checkout (if any) and compares it against your blocklist. If that specific customer ID is on the blocklist, checkout is stopped with a message asking the shopper to contact your store. If there’s no logged-in customer on the checkout, or the customer ID isn’t on the blocklist, checkout proceeds normally — this feature does not evaluate IP address, country, or any other signal from Block Rules.

Who ends up on the blocklist

Checkout Protection reads specifically the customer-ID entries from your blocklist — the same blocklist described in Fraud Order Detection. Email, phone, or address blocklist entries feed into risk scoring, but do not by themselves block checkout; only a customer account explicitly added as a blocked customer is enforced at checkout.

How it stays up to date

Whenever your customer blocklist changes, the app syncs the current list to your store so the checkout Function can check against it. This sync happens automatically in the background — there’s no manual step to keep it current.

Turning it on

Checkout Protection is available on the Enterprise plan. See Plans & Billing for plan details.