Limit bursts of orders and registrations from one IP address without confusing the limit with a per-customer product allowance. PD Shield’s velocity control uses a rolling time window; Purchase Limits is a separate feature.

Choose a limit for your order flow

Review normal activity before enforcing a threshold. Several genuine customers can share an office, mobile-network or other public address. A low limit can affect these customers as well as automated attempts.

The reviewed defaults are a maximum of 5 with a 60-minute window. These are starting settings, not a promise that every site should use them. Orders and signups are counted separately and the higher count is used; an ordinary signup followed by an order is not simply added together as two events for the combined count.

Customers with both a paid invoice and an active service qualify for the established-customer exemption in the order velocity check. An account alone does not qualify. Exemption from this check does not bypass other PD Shield protections.

Save the settings

1. Open PD Modules → PD Shield → Settings.
2. Review Velocity limit (orders/signups per IP).
3. Set Max orders/signups per IP per window.
4. Set Velocity window (minutes).
5. Select Action when a rule matches and review Alert recipient email(s).
6. Press Save settings.

Choose the intended response

Flag permits the matched activity and records it. It lets you review observed matches before choosing stricter behaviour; it does not put every other rule into observation mode.

Hold allows a signup while recording a signup burst, and holds a matching order for review after it is placed. A signup itself is not a held order.

Block can refuse an over-limit signup. For orders, Blesta does not provide the same pre-checkout refusal: PD Shield holds the order for review after creation instead. Do not describe the choice as preventing an order record from being created.

Review a match

Open PD Shield → Activity and look for Too many from one address. Match the time and action to the order or registration being investigated. Check whether the visitor address is being identified correctly behind your existing proxy before changing thresholds; do not trust arbitrary forwarding headers or broaden proxy ranges to clear a match.

A missing event is not proof that the rule checked and allowed the request. A failure to read the counter can leave the count unavailable without blocking the customer. Do not treat a quiet Activity list as proof of protection.

Adjust one setting at a time

Use your controlled testing process, with an offering that cannot create a real resource or an unintended charge. Review genuine-customer behaviour as well as a match. Record the previous value and compare results before another adjustment.

Keep customer email addresses, full IP addresses and account data out of shared screenshots.

See the PD Shield Blesta guide for related setup, or explore PD Shield.