Bot protection: how your store is protected

Where to find it: Left menu → Integrations → Security Who it's for: Every store (protection is already on). Especially stores that use customer sign-in, sign-up and forms and are thinking about adding an extra verification layer. In short: Treyza always protects sign-in, sign-up, password reset and, if you want, forms on your storefront against bots; no setup is needed and customers usually see nothing. You can also add Cloudflare Turnstile or Google reCAPTCHA as an extra layer.

What does it do?

A "bot" is a computer program that does things instead of a person. Malicious bots usually try the following on online stores:

Bot protection tries to tell whether the request behind these actions comes from a person or from a program, and stops the programs. It is designed to work without slowing down your real customers.

What is protected?

These actions appear in the panel under the following names:

Sign-in and sign-up are protected the same way whether they happen on the separate sign-in page or in the window that opens from the cart, favorites or checkout.

What does your customer see?

Usually nothing. What they see depends on the verification method you use:

The messages your customer may see when something goes wrong, and what they should do:

How does Treyza's built-in protection work?

The built-in protection has four parts:

1. A small puzzle (proof of work): As soon as the customer opens the sign-in form, their browser solves a small math puzzle in the background. For a person it takes a fraction of a second and finishes while they fill in the form; by the time they press the sign-in button, the solution is ready. Every puzzle can be used only once. A bot that wants to make thousands of attempts has to solve a new puzzle for every single one, so the attack slows down and gets expensive.
2. Harder when the risk goes up: When wrong passwords are entered repeatedly from the same internet connection, when your store sees many failed sign-ins in a short time, or when a request looks like it comes from an automation tool, the puzzle gets harder and can take a few seconds. A real customer sees at most a short Verifying…; for the attacker every attempt becomes much more expensive.
3. Trap field: Forms contain a hidden field that people don't see. A person never sees it, so they leave it empty; a bot that fills in every box on a form fills it in, and its request is rejected.
4. Rate limits: The number of attempts from the same place in a short time is limited. At most 3 password reset emails an hour are sent to the same email address, so nobody can flood a customer's inbox with reset emails.

The built-in protection uses no cookies, doesn't send visitor information to any third-party company, is free and needs no setup. That's why it is always on in every store.

Which method should I choose?

Our recommendation: For most stores the built-in protection is enough. If you want an extra layer, choose Cloudflare Turnstile: it is free, verifications are unlimited, and Cloudflare states that it doesn't use the data it collects for advertising. You can also use Google reCAPTCHA, but more than 10,000 verifications a month requires Google Cloud billing. With both providers visitor data goes to a company abroad, so you need to update your privacy notice. The only option that never takes data outside Treyza is the built-in protection.

What changes when you add an extra provider?

The provider cards are in the Integrations → Security section: Cloudflare Turnstile and Google reCAPTCHA. For setup steps see the Setting up Cloudflare Turnstile and Setting up Google reCAPTCHA pages.

• Keys take effect domain by domain: The provider is used on one of your store's domains (e.g. mystore.treyza.shop or mystore.com) only if the integration is enabled and that domain has been verified once from the panel with Verify on storefront. On a domain that isn't verified, your customers are protected by the built-in protection; that way a wrongly copied key or a domain you forgot to add at the provider can't lock your customers out of signing in. When a key changes, the verifications are reset.
• One provider at a time: Only one provider can be active in the Security category at a time. If you turn on Turnstile, reCAPTCHA turns off (and vice versa).
• You choose where it is used: The provider's settings have the switches Girişte kullan (use on sign-in), Kayıtta kullan (use on sign-up), Şifre sıfırlamada kullan (use on password reset) and Formlarda kullan (use on forms); all of them start on. An action you turn off keeps being protected by Treyza's built-in protection — no action is ever left unprotected.
• Form file uploads are always verified with Treyza's built-in protection; they are never sent to the provider.
• If you turn the provider off, everything goes back to the built-in protection; you don't need to do anything else.

The "Treyza Bot Protection" card in the panel

On the Integrations page, the Treyza Bot Protection card sits at the very top of the Security section. The section description reads: "Protects your store against bots. Treyza's built-in protection is always on; you can also add Cloudflare Turnstile or Google reCAPTCHA."

Health warnings

If you use an extra provider and something goes wrong, a warning appears on the card. In the warning, {provider} is replaced by the provider's name and {host} by the domain where the problem happens.

Bot protection on forms

You can turn bot protection on or off separately for every form you build with the form builder.

1. Open Forms from the left menu and edit your form (or create a New Form).
2. Press the Form Settings button in the top bar.
3. Switch to the Security tab in the window that opens.
4. Turn on the Bot protection switch.
5. Close the window and press the Save button in the top bar.

The description under the switch reads: "When on, submissions and file uploads for this form go through bot verification. The method comes from your store setting: {provider}." Here {provider} is replaced by the method your store uses (for example, Treyza built-in protection). To change the method, use the Integrations → Security link under the description; the link opens in a new tab, so unsaved changes in the form aren't lost. If the method can't be loaded at that moment, the description shows only its first sentence and the link doesn't appear; you can still change the method in the Security section of the Integrations page.

• In new forms bot protection starts on.
• In existing forms created before this feature it starts off, so no form changes its behavior without you deciding so. To protect your existing forms too, turn the switch on yourself.
• Even on a form with bot protection off, the number of submissions is limited and the file upload rules apply.

What happens if the provider can't be reached?

If Cloudflare or Google has an outage, your Google reCAPTCHA free monthly verifications run out, or the provider rejects your secret key or its verifications, your storefront does not lock up:

1. Treyza notices the situation and automatically sends the visitor to the built-in protection.
2. The visitor briefly sees Running an extra security check… while a slightly harder puzzle is solved in the background.
3. The visitor completes their action (sign-in, sign-up, form submission).
4. A health warning appears on the Treyza Bot Protection card in the panel (see the table above).

Frequently asked questions

Will my customers notice anything? Most customers notice nothing. The built-in protection and Cloudflare Turnstile are invisible for most visitors. Only if you choose Google reCAPTCHA v2 does the customer tick the "I'm not a robot" box.

I entered my provider keys; why don't they work right away? The keys don't take effect until each of your store's domains has been verified once with Verify on storefront; until then your customers are protected by the built-in protection. The Enable Integration switch must be on too. The reason: a wrongly copied key or a domain you forgot to add at the provider could lock your customers out of signing in, and most of these mistakes only show up on the storefront, in a real verification. Verify every domain from the Domain verification list on the Treyza Bot Protection card; the steps are on the Setting up Cloudflare Turnstile and Setting up Google reCAPTCHA pages.

Can a customer with an ad blocker sign in? The built-in protection isn't affected by ad blockers; verification runs directly from your store's own address. If you use Cloudflare Turnstile or Google reCAPTCHA, some ad and privacy blockers may block the provider's verification file. The customer then sees "Security verification couldn't load…" and needs to turn off the blocker on your store and press Try again. If you get such complaints often, turn off the switch for that action (for example Girişte kullan); the action stays protected by the built-in protection.

What should a customer who was blocked by mistake do? First, refresh the page and try again. Make sure the browser is up to date and JavaScript is on. If they entered wrong passwords several times from the same connection, the puzzle gets harder for a while; after waiting a few minutes they can sign in with the right password. If the problem continues, ask them which message they saw; you can look up its meaning in the table above.

My customer didn't get the password reset email. If more than 3 reset requests are sent to the same address within an hour, no email is sent for the extra ones, to prevent email bombing; the screen still shows the success message. Ask your customer to wait an hour, request it once more and check the spam folder too.

Can I turn off the built-in protection? No. The built-in protection is invisible, uses no cookies, shares no data and is free; it puts no burden on your customers. If it could be turned off, your store's sign-in and sign-up pages would be open to bots. Even if you add an extra provider, the built-in protection keeps working as a fallback.

Which provider should I choose? Most stores don't need an extra provider. If you want an extra layer, we recommend Cloudflare Turnstile because it is free and doesn't limit the number of verifications. For a comparison, see the "Which method should I choose?" table above.

How do I remove a provider?

1. In the Integrations → Security section, click the provider's card.
2. Turn off the Enable Integration switch.
3. Press Save and close the window with Close.

The built-in protection carries on. Your keys are not deleted; later you only need to turn the switch back on. If you're leaving the provider for good, you can also delete the widget or key in the provider's own dashboard.

Does this protection also cover my management panel sign-in? No. This page is about customer actions on your storefront. To protect your panel account, turn on two-step verification: Two-Factor Authentication.

---

Related pages

• Setting up Cloudflare Turnstile: Setting up Cloudflare Turnstile
• Setting up Google reCAPTCHA: Setting up Google reCAPTCHA
• Setting up and enabling integrations: Managing Integrations (List, Setup, Turning On/Off)
• Form settings: Form Builder (Drag-and-Drop)
• Privacy notice and cookie policy: Legal Pages (Agreements)
• Customer registration settings: Customer Settings