Protect product drops, checkout, and customer accounts from bots
Scrapers read the catalogue, inventory bots buy the limited drop, card testers use the payment form, and credential stuffers attack the login. Centinel evaluates how each request was made. Shoppers check out as usual, and scripts get the response your policy sets.
Request a site auditThe bots use the same routes your customers pay through
These bots need no hidden endpoint. They load product pages, add to cart, log in, and submit payment details like any shopper. A rule that blocks one of those routes also blocks real sales. Centinel evaluates how each request was made.
Read the analysisWhat the traffic looks like
Limited stock, bought by script
Scalping bots (OWASP OAT-005, often called sneaker bots) watch for a release and check out faster than a person can, across many accounts and IP addresses.
The catalogue, copied repeatedly
Competitors and resellers crawl product and search pages to track prices and stock. They spread requests across proxies, so no single IP address stands out.
Stolen cards checked at your checkout
Card-testing scripts submit card after card through payment and card-setup forms to learn which ones still work. The store pays the fees and handles the disputes.
What runs against this traffic
Evidence on cart and checkout routes
In supported web checkouts, Centinel evaluates browser and request evidence around add-to-cart and payment, before the request reaches payment handling.
Teams can challenge or block scripted checkout and card testing, and ordinary sessions can pass without an extra step. Centinel does not decide whether a card or transaction is fraudulent.
Read more: Evidence on cart and checkout routesEvidence on catalogue and search routes
In supported browser deployments, Centinel evaluates request and browser evidence on product and search pages instead of relying on one IP address or header.
Teams can rate-limit or challenge a price-scraping session without putting every shopper through the same check.
Read more: Evidence on catalogue and search routesA login policy for customer accounts
Where the integration supports it, login attempts can be observed, rate-limited, challenged, or blocked by how they were made.
Teams can add friction to credential stuffing against stored cards and loyalty balances. Centinel does not decide whether a password was stolen.
Read more: A login policy for customer accountsEvidence behind repeated offer claims
In supported sign-up flows, Centinel evaluates the session around account creation and promo redemption, not only the submitted details.
Scripted sign-ups that claim a first-order discount again and again can be reviewed or restricted. Offer eligibility stays with your rules.
Read more: Evidence behind repeated offer claims
See what reaches your site
Start with a free scraping audit. A person reviews the scraping test results, then emails you the exposed pages and fixes to consider. The audit covers scraping exposure only, not every abuse pattern or all production traffic. Discuss broader coverage in a demo.
Retail and e-commerce: common questions
What platform and security teams ask before they deploy.
What is ecommerce bot protection?
E-commerce bot protection separates automated requests from shopper requests on a store's product, cart, login, and checkout routes. It then applies a response to the automation: allow, rate-limit, challenge, or block. It targets scraping, scalping, card testing, and credential stuffing.
What is a sneaker bot?
A sneaker bot is a script that buys limited-release products the moment they go on sale. It often runs across many accounts, cards, and proxy addresses to get around per-customer limits. OWASP catalogues the pattern as OAT-005 Scalping.
How do bots test stolen cards on an online store?
They submit many card numbers through checkout or an add-card form and record which ones the payment provider accepts. The store still pays authorisation and dispute fees, and a high decline rate can affect its legitimate payments.
Can a store block price scrapers and stay in Google Shopping?
Yes. Centinel can check a declared search crawler against the verification data its operator publishes, and approved feed partners can keep an explicit policy. A scraper that copies a crawler's user agent gets no trust from the name alone.
Does bot protection replace ecommerce fraud prevention?
No. Bot protection asks how a request was made. Fraud prevention asks whether a person, card, or order is legitimate. Bot protection can challenge or block scripted volume before it reaches checkout, and the fraud tool decides on the remaining orders.