Checkout Shield

Checkout Shield is a tool designed for WooCommerce stores to enhance the security of checkout processes, particularly in scenarios involving headless or custom checkout implementations. It addresses the issue where attacks target the WooCommerce API directly, rather than the standard browser-based checkout page, by providing a mechanism to protect API endpoints from unauthorized access.

The platform introduces API keys specifically intended for trusted custom integrations that cannot utilize the typical browser token, cookie, and session validation methods. These API keys are recommended for use cases such as headless frontends posting checkout requests to WooCommerce, trusted internal services creating checkout requests, or custom checkout flows that are unable to receive the standard Checkout Shield browser token. Integrations leveraging these keys must include them in the X-CCS-Key request header, which allows the requests to bypass normal shopper-session validation.

Checkout Shield provides guidance on secure key management, advising users to store generated keys securely, avoid exposing them in public browser JavaScript, promptly delete unused keys, and rotate keys if a server or deployment environment is compromised. The tool also references related protections for standard browser checkout flows and offers support for IP whitelisting and proxy/CDN configurations to further secure trusted integrations.

It is delivered as a solution for WooCommerce, with documentation aimed at developers integrating custom or headless checkout systems.