Payment page protection
Why a checkout, invoice pay link or card-update link can temporarily stop accepting payments, and what to do.
Your hosted checkout links, invoice pay links and card-update links are public by design, so anyone with the link can use it. That also makes them a target for card testing: people with stolen card numbers push them through a public payment form to find out which ones still work.
If a single link starts taking a burst of declined attempts at a rate no real buyer produces, that link stops accepting payments for a short time and we raise an alert. It thaws on its own.
The protection covers every public payment surface yRecurring hosts for you: a checkout page, an invoice pay page, and the page a customer uses to update a saved card. It covers every step of them, including the flows that send a buyer to their bank for verification and bring them back afterwards. Saving a new card without paying counts too, because a card can be tested that way just as easily.
Why this matters to you
Card testing is not just an annoyance. Payment providers measure decline and chargeback rates, and a page being used this way puts the payment processing at risk for everyone on the platform, not only the merchant whose link it is. Stopping it early protects your ability to take payments at all.
Will this affect real customers?
It should not. The check needs both a burst of attempts and a decline rate far above what a genuine checkout produces. A quiet shop with a few unlucky declines will not trigger it, and neither will a busy one with a normal share of failed cards.
A few other things keep it out of the way:
- Only genuine card declines count. A problem at your payment provider, or on our side, never freezes a link.
- Your other checkouts and invoices keep working normally.
What to do if a link is paused
- Wait. It clears itself a while after the last declined attempt, and if something is still hammering the link the clock keeps restarting.
- Check where the link has been shared. A checkout link posted somewhere public is a more attractive target than one emailed to a named buyer.
- Consider a fresh link if the old one is being hammered. Create a new checkout and stop sharing the old one.
- Contact us if a genuine customer is affected. We can see exactly what happened and clear it immediately.