---
title: "Bot protection at checkout: CAPTCHAs and AI agents"
description: "Stores challenge bots hardest at checkout, the one step an agent buying for a real shopper must pass. How to verify agents instead, and what it costs."
source_url: "https://specoria.com/insights/bot-protection-at-checkout-captchas-and-ai-agents/"
lang: "en"
---

[Insights](https://specoria.com/insights/) Infrastructure

# Bot protection at checkout: when CAPTCHAs and WAF challenges stop the agents you want

Stores challenge bots hardest at checkout, the one step an agent buying for a real shopper must pass. How to verify agents instead, and what it costs.

By [Specoria Team](https://specoria.com/about/) October 27, 2026 9 min read

![A plaster hand holds a blank paper card beside a grey stone arch, and the card has a single violet round seal.](https://specoria.com/insights/img/bot-protection-at-checkout-captchas-and-ai-agents-1-0651226f.jpg) Before an agent may pass the gate, it must show who sent it. Illustration: Specoria · generated with AI

In this article

- [What a challenge looks like to an agent](https://specoria.com/insights/bot-protection-at-checkout-captchas-and-ai-agents/#what-a-challenge-looks-like-to-an-agent)
- [What vendors now document for agents at checkout](https://specoria.com/insights/bot-protection-at-checkout-captchas-and-ai-agents/#what-vendors-now-document-for-agents-at-checkout)
- [A setup for cart and checkout routes](https://specoria.com/insights/bot-protection-at-checkout-captchas-and-ai-agents/#a-setup-for-cart-and-checkout-routes)
- [The trade-offs: fraud and card testing](https://specoria.com/insights/bot-protection-at-checkout-captchas-and-ai-agents/#the-trade-offs-fraud-and-card-testing)
- [Watch the numbers that show the cost](https://specoria.com/insights/bot-protection-at-checkout-captchas-and-ai-agents/#watch-the-numbers-that-show-the-cost)
- [Test it the way an agent shops](https://specoria.com/insights/bot-protection-at-checkout-captchas-and-ai-agents/#test-it-the-way-an-agent-shops)
- [The bottom line](https://specoria.com/insights/bot-protection-at-checkout-captchas-and-ai-agents/#the-bottom-line)

A shopper tells an assistant to reorder the same running shoes in size 43 and stop before paying. The agent finds the product, picks the size and clicks "Add to cart". Instead of the cart, it gets a full-page challenge. The shopper never learns why the task failed, and the store sees only one more bot that went away.

The cart and checkout are where most stores turn bot protection up highest, for good reasons such as card testing and account abuse. They are also the one place an agent acting for a real customer has to get through. In this article, we look at what a challenge looks like from the agent's side, what bot-management vendors now document for verified agents at checkout, and a setup that keeps fraud controls without stopping the agents you want. For the wider page-by-page policy, see [A bot policy by page type](https://specoria.com/insights/bot-policy-by-page-type/).

## What a challenge looks like to an agent

"CAPTCHA" is used loosely, but the tools behave differently. Taking Cloudflare's documentation as an example:

- **Interstitial challenge pages** hold the request before the visitor reaches the URL. A Non-Interactive Challenge only runs JavaScript in the browser; a Managed Challenge lets Cloudflare pick the check and asks for interaction only when the browser looks automated; an Interactive Challenge always requires the visitor to act. Cloudflare recommends Managed Challenges for most rules.
- **Turnstile** is a widget inside the page rather than a gate in front of it. It usually runs in the background but may show a checkbox, and its token must be checked on the server before a sensitive action such as a form submission.
- **Bot Fight Mode**, on the Free plan, issues computationally expensive challenges to traffic that matches known bot patterns, across the whole domain.

Two details matter at checkout. First, Cloudflare notes that challenge pages fail when the browser expects a non-HTML response, as with fetch or XHR requests. On many stores, "Add to cart" sends exactly that kind of request, so a challenge there can break the step silently, for people and agents alike. Second, a challenge built to ask "is this automated?" will, by design, answer yes for an agent. Whether that is a problem depends on whom the agent works for.

## What vendors now document for agents at checkout

![Paper shopping bags, a blank price tag and an open envelope sit on a table, while a paper hand rests on a violet key.](https://specoria.com/insights/img/bot-protection-at-checkout-captchas-and-ai-agents-2-ed1d9a90.jpg) The shopper keeps the last word, so the final press stays in a human hand. Illustration: Specoria · generated with AI

The answer the industry is converging on is identity: let the agent prove who it is, then decide what it may do.

- **Cloudflare.** Since July 1, 2026, signed agents are Verified bots, labeled Direct or Intermediary. Its classification lists a **Transact** behavior: checkout or other transactions on behalf of users. Cloudflare says these behavior labels are not individual fields in WAF custom rules; rules use the Verified Bot field and, with Bot Management, a Signed Agent field for agents that identify themselves with Web Bot Auth. It also warns about intermediaries: you may trust the operator without trusting every end user behind it.
- **HUMAN.** In its AgenticTrust product, permissions are set per known agent. If only reading products and content is allowed, it blocks the agent from login or checkout pages; **Checkout** is a separate permission, "including as a guest user", and each agent gets a requests-per-minute rate limit per session.
- **Visa and Akamai.** Visa's Trusted Agent Protocol binds the agent's signature to your domain and to the operation, browsing or payment. In December 2025, Akamai and Visa announced they would support the protocol across Akamai's platform, combining it with Akamai's behavioral intelligence and user recognition so merchants can tell whether an agent is browsing or paying.
- **Mastercard.** Cloudflare announced in October 2025 that Mastercard is incorporating Web Bot Auth into Agent Pay so merchants can identify trusted agents.

The products differ and most are early, but they share a pattern: a separate permission for checkout, granted to verified agents, with limits.

## A setup for cart and checkout routes

- **List the real paths.** Cart, checkout, the add-to-cart endpoint and any payment callbacks your platform uses. Rules scoped to `/checkout` miss a cart that lives at `/sepet` or an API path.
- **Exempt verified agents from challenges on those paths.** On Cloudflare, a custom rule with the Skip action can exclude matching requests from Super Bot Fight Mode and rate limiting rules. Know your plan: Cloudflare says Bot Fight Mode cannot be skipped with WAF rules at all, so a store that relies on it cannot carve out an exception for checkout.
- **Use rate limits instead of challenges for verified traffic.** An agent placing one order for a shopper has no need for a high request rate. Cloudflare's rate limiting rules accept the path and Verified Bot fields even on the Free plan. A ceiling on requests per minute stops a runaway agent without asking it to solve anything.
- **For unidentified traffic, prefer Managed over Interactive.** Agents running inside the shopper's own browser often can't be told apart from the shopper. A challenge a person can pass in a second is a smaller cost than one that always needs a click.
- **Keep the human confirmation for payment.** Don't remove the step where the shopper approves the payment to make agents faster. Agents themselves are built around it: OpenAI says ChatGPT agent asks for user confirmation on high-impact actions. Verification decides who may reach the payment form; the shopper still decides whether to pay.

## The trade-offs: fraud and card testing

None of this is free. Stripe describes card testing as fraudsters using scripts to check stolen card details through card setup or small payments, and warns that a guest checkout makes the payment form easier to reach. Its suggested defenses include CAPTCHAs on every request that can validate a card, rate limits, and limits such as cards per account or new customers per IP address. Stripe also says simple firewall rules based on one signal such as IP addresses are usually not enough on their own.

So the honest position is narrower than "never challenge an agent":

- **Exempt identity, not behavior.** A skip rule for verified agents on checkout paths is not a skip rule for anything that looks automated. Card testers don't get a pass because they are fast.
- **Your payment provider has its own layer.** Stripe says its recommended integrations can trigger CAPTCHAs dynamically during a card testing attack. Your WAF exemption does not change that, and it shouldn't.
- **Verification is not approval.** A verified intermediary can still carry a bad end user, and an agent order still goes through your fraud screening. We covered how those rules can misread agents in [Agent orders are reaching your fraud filter](https://specoria.com/insights/agent-orders-meet-the-fraud-filter/).

## Watch the numbers that show the cost

- **Challenge solve rate per rule.** Cloudflare defines it as challenges solved divided by challenges issued. A high rate on a checkout rule means real visitors are being challenged; a low rate looks like success, but an agent that gave up counts the same as a scraper.
- **Challenges issued to verified bots on checkout paths.** After your skip rule, this should be close to zero.
- **Challenged responses on cart endpoints.** Cloudflare marks every challenge page response with a `cf-mitigated: challenge` header, which lets you count how often an add-to-cart call returned a challenge instead of a cart.

## Test it the way an agent shops

Send a real browser agent from a product page to checkout and stop before the final payment button. That is how we ran our [field study](https://specoria.com/insights/ai-agents-shopping-in-a-real-browser/) in October 2026: 40 runs across five live stores, two shopping tasks per store and four model families, with each run stopping as soon as the agent reached checkout. The strongest models reached checkout in 9 of 9 possible tasks and the lighter ones in 7 of 9. Forty runs is a small sample, but the gaps between models showed up exactly where a store made the path harder.

## The bottom line

Checkout is where bot protection and agentic commerce meet head on. A challenge that asks "are you automated?" will stop an honest agent every time. The better question is "who are you, and what may you do here?" Verify agents on cart and checkout routes, limit them instead of challenging them, keep the shopper's own confirmation at payment, and measure what your rules actually stop.

Specoria runs real browser agents from product page to checkout, without pressing the final payment button, and records where bot protection or anything else stops them. Start with a [free readiness test](https://specoria.com/#contact).

### Sources

- Cloudflare Docs, [Verified bots](https://developers.cloudflare.com/bots/concepts/bot/verified-bots/), updated October 8, 2026.
- Cloudflare Docs, [Bot Management variables](https://developers.cloudflare.com/bots/reference/bot-management-variables/), updated September 16, 2026.
- Cloudflare Docs, [Interstitial Challenge Pages](https://developers.cloudflare.com/cloudflare-challenges/challenge-types/challenge-pages/), updated July 6, 2026.
- Cloudflare Docs, [Turnstile](https://developers.cloudflare.com/cloudflare-challenges/challenge-types/turnstile/), updated July 6, 2026.
- Cloudflare Docs, [Bot Fight Mode](https://developers.cloudflare.com/bots/get-started/bot-fight-mode/), updated August 3, 2026.
- Cloudflare Docs, [Super Bot Fight Mode](https://developers.cloudflare.com/bots/get-started/super-bot-fight-mode/), updated August 3, 2026.
- Cloudflare Docs, [Rate limiting rules](https://developers.cloudflare.com/waf/rate-limiting-rules/), updated August 25, 2026.
- Cloudflare Docs, [Challenge solve rate (CSR)](https://developers.cloudflare.com/cloudflare-challenges/reference/challenge-solve-rate/), updated August 3, 2026.
- Cloudflare Docs, [Detect a Challenge Page response](https://developers.cloudflare.com/cloudflare-challenges/challenge-types/challenge-pages/detect-response/), updated May 5, 2026.
- Cloudflare, [Cloudflare Collaborates with Leading Payments Companies to Secure and Enable Agentic Commerce](https://www.cloudflare.com/press/press-releases/2025/cloudflare-collaborates-with-leading-payments-companies-to-secure-and-enable-agentic-commerce/), October 14, 2025.
- HUMAN Security Docs, [Manage AI agent permissions](https://docs.humansecurity.com/applications/manage-ai-agent-permissions), accessed October 20, 2026.
- Visa, [Akamai and Visa Collaborate to Build Trust in Agentic Commerce](https://corporate.visa.com/en/sites/visa-perspectives/newsroom/akamai-visa-collaborate-to-build-trust-in-agentic-commerce.html), December 17, 2025.
- Visa, [Trusted Agent Protocol](https://github.com/visa/trusted-agent-protocol), accessed October 20, 2026.
- Stripe Docs, [Protect yourself from card testing](https://docs.stripe.com/disputes/prevention/card-testing), accessed October 20, 2026.
- OpenAI Help Center, [ChatGPT agent](https://help.openai.com/en/articles/11752874-chatgpt-agent), accessed October 20, 2026.
- Specoria Insights, [We sent AI agents shopping in a real browser 40 times. Here's where they got stuck.](https://specoria.com/insights/ai-agents-shopping-in-a-real-browser/), October 7, 2026.
- Specoria Insights, [A bot policy by page type: what to open to AI agents and what to keep closed](https://specoria.com/insights/bot-policy-by-page-type/), October 22, 2026.
- Specoria Insights, [Agent orders are reaching your fraud filter](https://specoria.com/insights/agent-orders-meet-the-fraud-filter/), October 16, 2026.

## Related

- [WebMCP in practice: turning add-to-cart and stock check into tools an agent can call](https://specoria.com/insights/webmcp-in-practice-add-to-cart-and-stock-check-tools/)
- [Guest checkout and AI agents: where a sign-in wall ends the purchase](https://specoria.com/insights/guest-checkout-and-ai-agents/)
- [A bot policy by page type: what to open to AI agents and what to keep closed](https://specoria.com/insights/bot-policy-by-page-type/)
- [Scan API, MCP server and GitHub Action](https://specoria.com/developers/) Run the free test from your own scripts or CI
- [Trust center](https://specoria.com/trust/) What we read, what we store, sub-processors and AI use

FREE TEST

## Is your store ready for shopping agents?

See in seconds how a shopping agent reads your store: free, instant, no email needed.

The free test runs in your browser and needs JavaScript. [Request the free deep audit by email instead →](https://specoria.com/#contact)

Your result opens on its own page. Want the full picture? The free deep audit and panel come next, by email.