Stop VPN and proxy fraud before checkout
Block the VPNs, residential proxies, and Tor exits that card testers and serial refunders hide behind, without blocking privacy-conscious real customers.
The problem
Card testers, serial refund abusers, and discount-code farmers do not shop from their home IP. They rotate through VPNs, residential proxies, and Tor so every attempt looks like a new visitor from a new country, and your fraud pattern never becomes visible.
Shopify's built-in fraud analysis flags suspicious orders after they exist. By then you are already managing chargebacks, restocking fees, and a payment processor watching your dispute rate.
How Cordon handles it
Live detection, not 2018 lists
Residential proxies look like home connections to static IP lists. Cordon scores every visit against live commercial VPN, proxy, and Tor data that updates continuously.
A threshold you control
Not every VPN user is a fraudster. A tunable fraud-score threshold blocks high-risk anonymizers while ordinary privacy users keep shopping.
Private Relay stays welcome
iCloud Private Relay users are real Apple customers, not threats. Cordon allowlists Private Relay by default so iPhone shoppers are never caught in the net.
Prevention, not cleanup
Blocking happens at the visit, before a cart or an order exists. No chargeback to fight, no order to cancel, no processor risk-score damage.
Set it up
- 1Install Cordon and start the Growth plan trial (VPN detection starts at Growth)
- 2Enable VPN, proxy, and Tor blocking
- 3Set the fraud-score threshold (the default is tuned to spare privacy users)
- 4Allowlist any known customers who legitimately use a VPN
Plans: VPN, proxy, and Tor detection is on Growth ($19/mo) and up. Country and IP rules, which catch cruder fraud, work on every plan including Free. See pricing →
What it looks like
Click the screenshot to see it full size.
Frequently asked questions
Will I lose sales from real customers who use VPNs?
The fraud-score threshold exists for exactly this. Commercial VPN exits with clean reputations score lower than residential proxies and Tor, and you choose where to draw the line. iCloud Private Relay is allowlisted by default.
Why block at the visit instead of reviewing orders?
A blocked visit costs you nothing. A fraudulent order costs the chargeback fee, the inventory, staff time, and your standing with the payment processor, even when you win the dispute.
Does this replace Shopify's fraud analysis?
No, it complements it. Shopify scores orders that happen; Cordon prevents the riskiest traffic from placing orders at all. Together they cover before and after.
Can I see what was blocked and why?
Yes. The live visitor log shows every decision with the country, network, and rule that fired, with IPs hashed so the log stays GDPR-safe.
Ready when you are
Install free, enable a preset, and watch the live log do its work.
Free plan included, 7-day free trial on paid plans. Cancel anytime.