Category: Security · Min plan: Free · Slug: limit-orders-per-ip
Cap how many successful orders one IP address can place on your store within a chosen time window. Helps prevent flooding and fake orders.
Video tutorial
Features
Per-store IP rate limiting on orders
Configurable max orders and time window
Default: 3 orders per 12 hours
Counts only successful orders
Detects the customer's real IP address
Keeps enforcing the cap even during a partial platform outage
Why use it
Common abuse patterns on Algerian COD stores: - A competitor places 50 fake orders to waste your call-confirm staff's time. - A single household IP places repeat genuine orders, but you want to cap COD risk per address. - A scraper iterates through your catalog by submitting orders.
This add-on enforces a hard cap: "at most N successful orders from one IP within H hours". Excess attempts are rejected with an HTTP 429 and a message in your storefront's language telling the customer how long to wait (rendered in minutes, hours, or days — whichever reads best). The message deliberately never mentions IP addresses or anything technical.
How to activate
Open Dashboard → Add-ons at
/dashboard/addons.Find Limit Orders Per IP under Security.
Click Activate (Free plan).
The settings panel exposes: - Max successful orders per IP — default
3, range 1-100. - Time window in hours — default12, range 1-720.
Changing either setting immediately starts a fresh counter for every IP, so nobody inherits a wait time computed from your old configuration. That's deliberate — it means you can loosen the cap and unblock everyone instantly.
Where the cap applies
The normal checkout page and fast-checkout on the product page.
Landing-page order forms (
/landing/...).It never applies to orders you create from the dashboard, so manual and phone orders are always accepted.
How it counts
Only successful orders count toward the limit. A rejected, fraud-flagged, or invalid order doesn't burn the IP's quota.
The window is fixed, not rolling. It starts when the IP's first counted order lands, and when it expires the counter resets to zero all at once — individual orders never age out one by one. With the default 3 / 12h: orders at 09:00, 11:00 and 13:00 fill the quota, the IP is blocked from 13:00 until 21:00 (12 hours after the 09:00 order), and from 21:00 the count is 0 again.
Detection targets the customer's real IP address rather than any intermediate network hop, so the limit applies to the actual buyer.
Blocks are recorded, so if a customer reports a "lost order" support can confirm whether this add-on rejected it.
Failure modes
Partial platform outage: the limit keeps working. Counting continues transparently and the cap is still enforced.
Total outage: fails open — orders go through unchecked rather than being lost. This is rare, and it is the deliberate trade-off: a real order is never dropped because a check couldn't run.
Shared IPs: a shared corporate or carrier-grade NAT IP can hit the limit even with multiple distinct customers. If your traffic is heavily mobile-carrier-NAT (some Algerian ISPs), set the cap higher (e.g. 10 / 12h).
Tips
Keep the default 3 / 12h for new stores running cold paid traffic — most customers don't legitimately reorder within the same day.
Combine with Captcha Protection for layered defense — captcha catches headless browsers, this catches IP-bound spam.
Combine with Advanced Order Management — orders rejected for IP-cap don't appear in the order list at all, which keeps your call-confirm queue clean.
For B2B stores where one buyer legitimately reorders many times per day, raise the cap to ~20.