Panic Button

The Panic Freeze button is TrustLens’s emergency stop for card-testing attacks. One click halts every checkout in your store for a duration you choose — 5, 15, or 30 minutes — giving you breathing room to investigate, tune, and decide on a response while the attack stops costing you money. This page covers when to use it, what happens when you do, and how it interacts with the rest of Card-Testing Defense.

Choosing a duration. A dropdown next to the button lets you pick 5, 15, or 30 minutes; 15 minutes is the default. Your choice is remembered in your browser, so the next time you reach for the button it’s already set to the duration you used last. The server caps any freeze at 30 minutes.

---

What It Does #

When Panic Freeze is active:

• Every checkout submission is rejected at the Request Gate before reaching the payment gateway — whatever the payment method
• Classic checkout, Blocks / Store API checkout, and the pay-for-order page are all covered
• The shopper sees “Checkout is temporarily paused. Please try again shortly.”
• VIP customer bypass does not apply — the freeze is checked before the bypass, so every shopper is frozen
• Users who can manage WooCommerce (admins, shop managers) and, on Pro, allowlisted fingerprints and IP ranges are not stopped, because they skip the gate entirely
• Admin-side actions (refunds, order edits, etc.) continue normally

The freeze lasts for the duration you selected (15 minutes by default) and then ends on its own. You can end it early at any time: while a freeze is active, the button is replaced by Deactivate Freeze.

---

Where to Find It #

Location	Notes
TrustLens → Card-Testing Defense page	The Panic Freeze box at the top of the page: duration dropdown and Engage button, or Deactivate Freeze while active
Command palette	“Engage panic freeze” in the TrustLens header search jumps to the Panic Freeze box
TrustLens Dashboard alert band	While a freeze is active, a “Panic Freeze Active” band shows when it expires, with a Manage button to the Card-Testing Defense page

There’s only one freeze state. While it’s active, the TrustLens header status chip reads “Panic Freeze” and the WordPress Dashboard widget shows “Active attack — panic freeze in effect”.

---

When to Use It #

Panic Freeze is the right tool when:

• Velocity rules aren’t catching the attack. An attack distributed across many fingerprints can stay below per-fingerprint thresholds while still causing damage. Freeze stops it cold.
• You need time to investigate. Tuning thresholds, setting up the Browser Challenge, or adding allowlists takes a few minutes — Panic Freeze buys you that time.
• You’re seeing rapid chargeback or decline spikes. Even if you’re not sure it’s a card-testing attack, the freeze is a safe stop.
• You’ve been notified of a breach. Your processor or a payment partner has flagged unusual activity.

It’s the wrong tool when:

• You have a legitimate flash-sale spike — that’s not an attack
• One or two customers are reporting checkout issues — investigate individually first
• You suspect an issue but haven’t checked the Card-Testing Defense page for evidence

---

What Happens During the Freeze #

Use the freeze time productively:

1. Open the Card-Testing Defense page and look at the 24-hour declines, decline rate, and the Targeted now list
2. If on Pro, review the 24-hour intelligence card — hourly decline timeline, decline-code breakdown, and top attacking fingerprints
3. Identify whether the attack is bursty (single fingerprint, fast) or distributed (many fingerprints)
4. If bursty, the per-fingerprint lockout should already be catching it. Verify the attacking fingerprint is in the Targeted now list.
5. If distributed, tighten the velocity thresholds and set up the Browser Challenge; block the source IP ranges at your firewall or CDN if they’re concentrated
6. Document the attack pattern for future reference

When you’re ready, deactivate the freeze and watch the next few minutes carefully. If the attack resumes, you can freeze again.

---

VIP Bypass During a Freeze #

VIP customer bypass doesn’t apply during a freeze: the freeze is checked first and blocks everyone, including established customers. If you need specific traffic to keep flowing during a freeze — a test device, an integration partner — add its fingerprint or IP range to the Pro allowlists, which bypass the freeze along with every other gate rule.

---

Auto-Escalation (Pro) #

Pro can trigger Panic Freeze automatically when an attack escalates beyond what per-fingerprint lockouts can handle. The trigger:

• 3 distinct fingerprints newly trip velocity detection within a 10-minute window
• Geo-diversity safeguard confirms the pattern looks like an attack, not legitimate viral traffic

When auto-escalation fires, a 15-minute freeze activates automatically and, if Pro card-testing alerts are configured, an auto_escalated alert is sent. The dashboard and header show the same Panic Freeze state as a manual freeze.

See Auto-Escalation (Pro) for the details.

---

What the Customer Sees #

During a freeze, customers attempting checkout see:

“Checkout is temporarily paused. Please try again shortly.”

The wording is deliberately neutral — it doesn’t say why checkout is paused or that a defense mechanism tripped. It’s a fixed message, separate from the Block Message in Settings → General (which is shown only to blocked customers).

---

Activation Records #

TrustLens doesn’t keep a log of freeze activations and deactivations. Each activation fires the trustlens/panic_button_activated action (manual) or trustlens/card_testing/auto_escalated (automatic), which custom code can record. On Pro, the card-testing alert dispatcher sends an email and/or Slack message on each activation if it has been configured.

---

Limits and Edge Cases #

• Maximum duration: 30 minutes. The dropdown offers 5, 15, or 30 minutes, and the server caps any freeze at 30 minutes to prevent an admin from accidentally leaving the store frozen for too long. (The ceiling is filterable via trustlens/card_testing/panic_max_duration for sites that genuinely need longer.) You can freeze again immediately after one expires.
• Extending a freeze: Only one freeze state exists at a time. While a freeze is active the page shows Deactivate Freeze instead of Engage; to change the duration, deactivate and engage again.
• Subscription orders: Renewal orders processed automatically by WooCommerce Subscriptions don’t go through the checkout and aren’t frozen. Verify your subscription plugin’s behavior if this matters.
• API orders: Orders created via the WooCommerce REST API (custom integrations) are not subject to the freeze; only the classic checkout, the Store API checkout, and pay-for-order go through the Request Gate.
• Module off: The freeze is enforced by Card-Testing Defense, so it has no effect while the module is disabled.

---

Alerting #

Pro sends a panic_activated alert to the configured email address and/or Slack Incoming Webhook when a freeze is engaged manually. The alert includes the event name and the freeze duration in seconds. There is no settings screen for these alerts in this version: they use the trustlens_card_testing_alert_email and trustlens_card_testing_alert_slack_webhook options, which a developer can set (for example with WP-CLI).

This is useful for distributed teams — the operations engineer who hits the button might not be the same person investigating, and the alert keeps everyone aligned.