Checkout Load Tester & WAF Bypass

A robust, Playwright-powered synthetic load testing tool designed for modern e-commerce storefronts. This Actor simulates real human checkout flows, effortlessly bypasses advanced Web Application Firewalls (like Cloudflare Turnstile), and scales horizontally to stress-test your backend under heavy traffic.

Whether you are preparing for a massive holiday sale or validating anti-bot protections on a custom headless storefront, this tool delivers authentic, distributed checkout requests at scale.

Key Features

• WAF & Turnstile Bypass: Launches real headless Chromium browsers to natively execute JavaScript and solve Cloudflare Turnstile challenges before submitting checkout payloads.
• Residential Proxy Integration: Rotates unique residential IPs for every single order batch, bypassing network-level rate limits (HTTP 429) and session-linking throttles.
• Dynamic Payload Interception: Automatically scans your product page, submits the cart form, and intercepts the baseline checkout JSON template—no manual header configuration required.
• Custom or Synthetic Data: Upload your own JSON/CSV of customer details, or let the Actor automatically generate thousands of unique synthetic identities (names, addresses, emails) using Faker.js.
• Custom Concurrency: Control the exact flow of traffic to avoid accidentally DDoSing your own database.

How It Works

1. Session Acquisition: The Actor visits your target product URL, fills out the visible forms, and intercepts the exact POST payload your frontend sends to your backend.
2. Identity Generation: It merges this intercepted template with either your uploaded custom data or auto-generated fake customer profiles.
3. Distributed Execution: The script boots up isolated Playwright browser contexts routed through residential proxies.
4. Security Clearance: It waits for anti-bot tokens (e.g., cf-turnstile-response) to attach to the DOM, injects them into the payload, and fires the POST request directly to your checkout API.

Input Configuration

Note on Custom Payload Files

If you upload a custom JSON file, do not include security tokens like session_id, turnstile_token, or cf-turnstile-response in your file. The Actor must dynamically extract fresh tokens from the live browser session. Including hardcoded tokens in your JSON will overwrite the fresh ones and result in WAF blocks.

Output Structure

The Actor pushes the result of every individual checkout attempt to the default dataset.

{
  "payloadSent": {
    "customer": {
      "firstName": "John",
      "lastName": "Doe",
      "email": "johndoe@example.com"
    },
    "turnstile_token": "0.45789aBcDeF...",
    "order_lines": [
      {
        "quantity": 1,
        "product_variant": "956648a2-2a6a-4c13-9f3b-1be9ab9b4f8d"
      }
    ]
  },
  "statusCode": 201,
  "responseTimeMs": 1420,
  "attempts": 1
}