Configure security settings for checkout experience
Learn how to configure rate limiting and Google reCAPTCHA settings for the configured payment forms in Modernized Zuora Payments.
This feature is available only with the Modernized Zuora Payments add-on SKU.
To access the Early Adopter program, contact your Zuora account representative.
Securing your payment forms against malicious activity is critical to preventing fraud and maintaining system stability. By configuring rate limiting and Google reCAPTCHA, you protect your checkout flows from automated bot attacks while ensuring uninterrupted service for legitimate customers.
- In the left navigation pane, navigate to .
- Click Security Preferences.
- Configure the security settings. See Security settings reference for details.
- Click Done.
Security settings reference
Rate Limits
Rate limits control how many submissions are accepted and which IP addresses are exempt.
| Setting |
Value |
Default |
Description |
|---|---|---|---|
|
Submission limit per minute |
Number |
3 |
The maximum number of submissions accepted per minute. |
|
Submission limit per hour |
Number |
7 |
The maximum number of submissions accepted per hour. |
|
IP Whitelist |
Text |
192.168.0.1 |
IP addresses that are exempt from the rate limits. Multiple IP addresses should be separated by semicolons. |
Google reCAPTCHA Enterprise Configuration
We strongly recommend that you utilize your own Google reCAPTCHA license to maximize the effectiveness of the reCAPTCHA algorithm on your web pages. As a part of Zuora's constant effort to protect the security of payment forms, Zuora recommends that you install Google reCAPTCHA Enterprise.
For more information, see Google reCAPTCHA documentation.
Verification mode
|
Option |
Description |
|---|---|
| Disabled | reCAPTCHA verification is not performed. |
| AI Assessment (default) | Verification runs without user interaction. Google returns a risk score, which is compared against the configured Risk score threshold. |
| Interactive Checkbox | Displays a checkbox challenge that the user must complete. |
Behavior settings
| Setting | Value | Description |
|---|---|---|
| Risk score | Number, 0.1 to 1.00 |
The risk score threshold used in AI Assessment mode. Higher scores mean the interaction is more likely to be human. |
| Smart Bot Attack Prevention | Toggle (on or off) |
When turned on, Zuora will automatically enable the Google reCAPTCHA Enterprise Interactive Checkbox with risk score 0.8 when detecting the bot attack. |
Account setup
| Option | Description |
|---|---|
| Use Zuora's Google Cloud Enterprise Account | Verification uses the Google Cloud Enterprise account provided by Zuora. You do not supply credentials. |
| Use Your Own Google Cloud Enterprise Account | Verification uses your own Google Cloud Enterprise account. Provide the credentials below:
|
Advanced Payment Pages Settings
| Setting | Value | Description |
|---|---|---|
| Return Raw Gateway Info | Toggle (on or off) | Includes the raw gateway response information in the Payment Pages 2.0 response. For detailed information about fields returned in rawGatewayInfo for different gateways, see Fields returned in rawGatewayInfo. |
| Validate Client-Side HPM Parameters | Toggle (on or off) |
Validates the parameters passed from the client-side Hosted Payment Method (HPM) page. With this setting enabled, the client parameters in the requests for rendering or submitting Payment Pages 2.0 are validated by comparing with the values specified in the digital signature. see Security Measures for Payment Pages 2.0 for more information. |
| Allow Subdomain Callback for Hosted Pages | Toggle (on or off) |
With this setting enabled, your hosted payment pages and callback pages can reside in the subdomain of the hosted domain that you specified when configuring the payment pages. For more information about configuring the payment pages, see the articles listed in the Create and Configure the Payment Page section. |