> For the complete documentation index, see [llms.txt](https://fraud-block-ip.labxapp.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://fraud-block-ip.labxapp.com/documentation/core-concepts/checkout-protection.md).

# Checkout Protection

Server-side fraud rules enforced by a Shopify Function — can't be bypassed from the browser.

Checkout Protection blocks fraudulent checkouts using a **Shopify Function** that runs on Shopify's servers, not in the shopper's browser — a rule here can't be disabled by turning off JavaScript or using a script blocker.

## Supported conditions

| Condition        | Matches on                              |
| ---------------- | --------------------------------------- |
| **Email**        | Contact email — exact match or contains |
| **Phone**        | Phone number — exact match or contains  |
| **Name**         | Customer name                           |
| **Country**      | Shipping/billing country                |
| **Zip code**     | Postal/zip code                         |
| **Customer tag** | Tags on the customer's account          |

## Creating a rule

1. Go to **Checkout Protection**
2. Click **Add rule**
3. Choose a condition (e.g. *Email*) and a mode (*exact* or *contains*)
4. Enter the value(s) to match — a rule can hold multiple values at once
5. Write the **custom error message** the buyer will see at checkout
6. Save

## What the buyer sees

When a rule matches, Shopify blocks the checkout and shows your custom message inline on the relevant field — the buyer cannot complete the order until they change the offending value (or they simply can't, if they're the fraud attempt you're targeting).

## Good to know

* Rules take effect immediately after saving — no separate deploy step
* Because this runs server-side, it's effective even against automated checkout bots
* Use broad `contains` rules carefully — a rule that's too broad can block legitimate customers. Check **Visitor Analytics** periodically to catch false positives