---
title: Payment page protection
description: Why a checkout, invoice pay link or card-update link can temporarily stop accepting payments, and what to do.
domain: payment
status: shipped
visibility: public
last_verified: 2026-08-01
order: 30
---
Your hosted checkout links, invoice pay links and card-update links are public by
design, so anyone with the link can use it. That also makes them a target for
**card testing**: people with stolen card numbers push them through a public
payment form to find out which ones still work.

If a single link starts taking a burst of declined attempts at a rate no real
buyer produces, that link stops accepting payments for a short time and we raise
an alert. It thaws on its own.

The protection covers every public payment surface yRecurring hosts for you: a
checkout page, an invoice pay page, and the page a customer uses to update a
saved card. It covers every step of them, including the flows that send a buyer
to their bank for verification and bring them back afterwards. Saving a new card
without paying counts too, because a card can be tested that way just as easily.

## Why this matters to you

Card testing is not just an annoyance. Payment providers measure decline and
chargeback rates, and a page being used this way puts the payment processing at
risk for everyone on the platform, not only the merchant whose link it is.
Stopping it early protects your ability to take payments at all.

## Will this affect real customers?

It should not. The check needs both a burst of attempts **and** a decline rate
far above what a genuine checkout produces. A quiet shop with a few unlucky
declines will not trigger it, and neither will a busy one with a normal share of
failed cards.

A few other things keep it out of the way:

- Only genuine card declines count. A problem at your payment provider, or on
  our side, never freezes a link.
- Your other checkouts and invoices keep working normally.

## What to do if a link is paused

- **Wait.** It clears itself a while after the last declined attempt, and if
  something is still hammering the link the clock keeps restarting.
- **Check where the link has been shared.** A checkout link posted somewhere
  public is a more attractive target than one emailed to a named buyer.
- **Consider a fresh link** if the old one is being hammered. Create a new
  checkout and stop sharing the old one.
- **Contact us** if a genuine customer is affected. We can see exactly what
  happened and clear it immediately.

## Related

- [Hosted checkout](hosted-checkout)