Start · Getting started
Planning your integration
Where to put a check, and what each placement costs you.
The hardest decision in an integration is not the code; it is where to put the check. Put it in the wrong place and you either stop nothing or turn real customers away.
Put it where something changes hands#
Do not block at the storefront. A visitor turned away there learns nothing except that the site seems broken, and a shop that refuses people before they have chosen anything loses far more to false positives than it ever stops.
Places worth guarding:
| Checkpoint | Why |
|---|---|
| Checkout | Money changes hands. The highest-value check there is. |
| Login | Stops credential stuffing and account takeover. |
| Password reset | Same reason, and usually forgotten. |
| Coupon redemption | Promotion abuse is a question about history. |
| Account creation | Bulk accounts show up here first. |
Treat the three verdicts differently#
allow passes.
block refuses, but return the page with a notice on it, not a bare error. Some of the people a rule stops are real, and they need to see where they are and how to complain.
challenge is not a refusal. It is a step-up: 3-D Secure, an OTP, manual review, or simply closer logging. Refuse on challenge and you have turned a moderate signal into a lost order, and the engine's weights are not set on that assumption.
Start in observation mode#
Integrate fully, but log the verdict instead of acting on it at first. Run it for a few days, open Smart Signals to see the score distribution over your own traffic, and only then turn blocking on.
It is the only way to learn your false-positive rate before it becomes lost revenue.
Always fail open#
let verdict = "allow";
try {
verdict = (await askHideGuard(context)).verdict;
} catch {
// No answer means let it through. The check must not be able to take checkout down.
}This is not a concession: an external service in your critical path that fails closed makes its downtime into your downtime.
Never trust a claimed visitor ID#
The fpc_vid cookie is on your own domain and a determined visitor can edit it. It is only used to find a record we wrote ourselves. The verdict is always based on the record found, never on the claim.