Recently we've had some bots testing (stolen?) CC numbers against our CiviContribute form. Our payment processor declines them all, but it sometimes results in our account getting suspended for 30 minutes.

Has anyone implemented per-IP-address transaction rate limiting? As a module, or some other way?


3 Answers 3



This is a very common scam, the best way is to add recaptcha; it's worked for all of our clients with this issue. The new recaptcha "I am not a robot" is very user friendly. This can be set up from the CiviCRM admin menu.

If your coming to the CiviCRM User summit today, please speak with Steven from iATS, he is very knowledgeable in this space and is giving a talk on security that will include this topic.

  • One additional point to Paul's comment: the "I am not a robot" recaptcha is supported natively in Civi from 4.6.x forward, I believe; if you want it for earlier versions, you'll need to backport the changes to use Google's new API. (You didn't specify what version of Civi you're using so wanted to point this out just in case.) Sep 24, 2015 at 15:28

The Authorize.net fraud detection suite now includes a "Transaction IP Velocity Filter." This must be new since the last time I looked at the fraud settings. In any case, you can now set a rule to block IPs that attempt more than 5 transactions in an hour, and you can also whitelist IPs.

Hoping this will take care of the issue.

  • Any defence against abuse has to be considered against your specific reality, since you don't want to shoot yourself in the foot. For example - if you've got an administrator manually entering a bunch of credit card donations in CiviCRM, you want to make sure you don't block them.
    – Alan Dixon
    Jan 14, 2016 at 14:52

iATS Payments also provides a server-level transaction ip velocity filter, amongst other security features, as listed here:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.