Quick Start

Go to Settings → General and confirm that ccp_enable_protection is enabled. Protection is enabled by default.

Go to Settings → Request Validation and add your site domain or domains to ccp_trusted_domains. Trusted domains help ensure that legitimate referrers are not blocked.

Set ccp_invalid_referrer_action to one of the following responses:

• redirect: Redirect invalid referrers. This is the default.
• block: Block requests from invalid referrers.
• log-only: Record invalid referrers without blocking or redirecting requests.

Use redirect while you observe traffic, then choose a stricter action if your checkout requires it.

Go to Settings → Fraud/Risk and review the progressive risk thresholds:

• Allow: 0
• Additional Checks: 25
• CAPTCHA: 50
• Hold for Review: 70
• Block: 90

Keep the default thresholds while you observe real checkout traffic. Adjust them after you understand how Checkout Security scores legitimate and suspicious orders.

Threat intelligence is disabled by default. To enable it, go to Settings → Threat Intel, configure at least one threat intelligence provider with a valid API key, and set ccp_enable_threat_intel to yes.

The default value for ccp_threat_intel_confidence_threshold is 70. Checkout Security uses this threshold when evaluating threat-intelligence signals such as IP reputation and geographic risk.

You can skip this step during initial setup and enable threat intelligence later once you have provider credentials.

Open the Checkout Security dashboard and check the following:

• Protection status is enabled.
• Your connector adapter shows a green connected status.
• Recent security events appear in the activity view.

A green adapter status confirms that the core plugin is connected to your e-commerce platform.