Bot protection

Public chat widgets attract bots that try to use your AI for free. ShopAssist protects your store in three layers.

Abuse scoringCopy Anchor Link

Every chat session gets a score from signals such as automation user agents, missing browser headers, data-center IP ranges, many sessions from one network, repeated identical messages and prompt-injection attempts. A high score triggers a challenge; a very high score blocks the session. Conversations blocked before an AI reply are never billed.

ChallengesCopy Anchor Link

By default the challenge is a proof of work: the shopper's browser solves a small puzzle in the background, without cookies or third parties. Under budget pressure the puzzle gets harder.

For stores under repeated attack, use Cloudflare Turnstile with your own Cloudflare account:

1. Create a Turnstile widget in Cloudflare for your storefront hostnames.
2. In Settings → Security → Challenges, enter the site key and secret (the secret is write-only).
3. Add https://challenges.cloudflare.com to your CSP (Content Security Policy).

Cloudflare then processes the challenge as your sub-processor. You can also challenge every new session (Challenge mode → Always).

Cost guardCopy Anchor Link

Daily limits per store protect your AI budget (especially with your own key): AI replies, input tokens and, with your own key, an estimated provider cost in USD. You can change them in Settings → Security. As usage approaches a limit:

No single network may use more than a fair share of the daily limits, so one attacker can't use up your budget for everyone. Sudden surges in new sessions turn on challenges automatically for an hour.