For an online shop, an hour of downtime has a precise cost: the orders that never arrive. That's exactly why e-commerce sites attract one more kind of attack than a blog. The goal isn't always to take the site down: often bots want something from the shop, and the slowdown is a side effect.
The four typical attacks against a shop
1. Carding: testing stolen cards at checkout
People who buy lists of stolen credit cards online need to know which ones still work. The easiest way is to use any shop's checkout: many small orders, often for a few euros, with different cards, one after another.
The signs:
- dozens or hundreds of declined payments in a short time;
- orders with small amounts, nonsense or identical names and addresses;
- an email from your payment provider flagging unusual activity.
Beyond the load on the site, carding costs money: transaction fees, disputes (chargebacks) and the risk of the payment provider suspending the shop.
2. Bots hoarding stock
During limited product launches, bots put all available stock into carts within seconds, to resell it or simply to block it. Real customers see "sold out" even though nobody has paid yet.
3. Price and catalogue scraping
Competitors (or services working for them) download the whole catalogue several times a day to compare prices. It's rarely illegal in itself, but a bot downloading thousands of product pages with different filters and sort orders weighs on the server as much as a small attack.
4. DDoS on the days that matter
Black Friday, sales, an advertised launch: the moment the site has to hold up the most is also the moment an attack does the most damage. Sometimes it's extortion ("pay or we continue"), sometimes unfair competition, often you'll never know.
Customer spike or attack?
On sale day traffic really does go up, and it's the last thing you want to block. The difference:
| Real customers | Bots |
|---|---|
| Browse different categories and products | Hit the same pages or try every filter combination |
| Few payment attempts, almost all successful | Many declined payments in a row |
| Carts with various products | Carts full of the same product, never paid |
| Come from newsletters, social, ads | No referrer, automated user agents |
How to defend yourself
Protect the sensitive pages, not the whole shop
The catalogue must be fast and open to everyone, Google included. The pages to protect are few:
- login and sign-up (attempts with stolen passwords);
- checkout and payment (carding);
- add to cart (bots hoarding stock);
- search and filters (pages that can't be cached).
These pages need much tighter per-IP request limits than the rest of the site.
Let your payment provider do its job
Turn on every anti-fraud control your provider offers: strong customer authentication (3-D Secure) for card payments, limits on failed attempts and alerts on suspicious transactions. Against carding they are the most effective defence, because they make the tests fail before they even reach the bank.
Cache the catalogue
Product and category pages, for visitors who aren't logged in, can stay cached on the CDN nodes for a few minutes. On sale day the server only works on carts and payments, the things that make money.
With 1PrimeCDN, pages requested with a session cookie (cart, login) always go to the shop, while images, CSS and JavaScript stay cached for everyone: shoppers always see their up-to-date cart, and the server doesn't have to deliver the same photos every time.
Let Shield decide who is a bot
1PrimeCDN Shield looks at how each address behaves: how many requests per second, how many reach the server instead of the cache, how many errors, whether it dodges the cache with ever-changing parameters, whether it introduces itself as an automated tool. Anyone over the threshold goes through a check that people pass in a second without doing anything; anyone overdoing it is blocked for a time that doubles with every repeat, up to 24 hours. Every decision is visible in the panel, with its reason.
If the shop only sells in some countries, you can also block or check traffic from the others.
Prepare before the busy days
- run a load test or a benchmark a few weeks ahead;
- keep the TTL of your DNS records low, so you can change route quickly;
- decide beforehand who does what if the site goes down, and keep your host's number at hand;
- don't update plugins or the theme during sales.
If it's happening now
If the shop is under attack right now, the «Under attack?» page has the steps to take immediately and a form that alerts our staff. If you use WordPress and WooCommerce, also read how to protect wp-login.php and xmlrpc.php.
Want a site that holds up even under attack?
1PrimeCDN puts your site behind 8 European nodes with caching, HTTPS and Shield against bots and attacks. Fixed monthly price from €9.90.