Merchants who enable Shopify's spam protection and keep receiving spam are usually told they configured something wrong. They did not. Solving services publish their rates, and defeating the challenge on a contact form costs the sender about a tenth of a cent. A coverage map, the four routes around the gate, a ten-minute triage, and a matrix of what every defence actually stops, ours included.
Read the dispatch →A Signifyd employee woke one Sunday to several hundred unread emails. Buried among them was a $1,300 Apple Store receipt she had not authorised. Every one of those messages came from a signup form on somebody's website. Researchers who analysed 24 such campaigns found the traffic almost impossible to filter, because it is genuine mail sent by real shops that did nothing wrong except leave a form open.
Read the dispatch →A spam filter's dial has nine positions, of which roughly four produce distinct results, and one blocks every submission the store will ever receive. What the number underneath represents, why a new store's scores cannot be trusted, and what is traded away at each end. With a sorting rack you can drag, our behavioural signal weights published in full, and the one question to put to any vendor ahead of the pricing question.
Read the dispatch →A merchant deployed hCaptcha, reCAPTCHA, a premium bot app, Cloudflare in Challenge Mode, ASN blocks and rate limiting. The card-testing attack continued at 500 fake carts an hour. The logs explained why: the bots were never touching the domain any of it was installed on. What Shopify says about the gap, and the one setting that closes it.
Read the dispatch →Account-checking software has been sold openly for a decade. In 2019 the tools were priced at $12 to $50; the equivalents are now free. The credentials are close to free too, and published hit rates run from 0.1 to 2 percent. The cost stack, the three account forms it arrives through, and what actually raises the price.
Read the dispatch →Seven form types scored by Google reCAPTCHA. Keys provisioned for you, so there is no console to visit and nothing to paste. Nothing loaded on the pages that do not need it. Every decision written down with the score behind it. And a job that runs every night to check the whole arrangement still works.
Read the dispatch →App Store listings in this category are close to interchangeable. These are the seven questions whose answers actually differ between products, what a good answer sounds like, and a scorecard you can fill in for anyone you are considering. Our own score is seven out of ten, and we name the three.
Read the dispatch →Four rules, because this category has a credibility problem
Invisible Google reCAPTCHA scoring on every Shopify storefront form — contact, newsletter, comments, reviews, login, registration and checkout. Two minutes to set up, no keys to paste.
Install on Shopify — free for 14 days →