BOT PROTECTION FOR TICKETING

Waiting Room Throughput Math: How Many Shoppers Per Minute Without Breaking Checkout

A waiting room that admits shoppers faster than checkout can process them is not a queue, it is a crowd at the door. The admission rate has to match the checkout rate, and the checkout rate is the number to measure first.

A virtual waiting room works by admitting shoppers to the store at a controlled rate, and the rate that matters is the one checkout can sustain. If checkout processes 40 orders a minute and the waiting room admits 200 shoppers a minute, 160 of them will hit a checkout that cannot serve them, and the drop collapses into the same failure the queue was supposed to prevent. The right admission rate is the checkout throughput measured under load, minus a margin for the payment step, because payment authorization is the slowest part of the flow and the part that fails first. Queue-it's Shopify connector and CrowdHandler both describe the same shape: a branded waiting room, a controlled admission rate, and server-side checkout validation that confirms a visitor passed through the queue before they can buy the protected product. The validation is what makes the rate real. Without it, a shopper who bypasses the waiting room JavaScript can walk straight to checkout, and the admission rate becomes a suggestion.

Measure checkout first, then set the rate

Run a load test on checkout before the drop, not during it. The number to find is completed checkouts per minute at the payment step, with the real payment provider in the loop, because a test that skips payment measures nothing. If checkout sustains 40 completed orders a minute, set the admission rate at 30 to 35, and let the queue absorb the difference. The margin is not waste. It is the room for the shopper who pauses on the shipping page, the card that needs a retry, and the address that fails validation twice.

The second number is the queue length at the door. A drop with 10,000 shoppers and 500 units does not need a queue that admits 500 a minute. It needs a queue that admits 30 a minute and tells the other 9,500 where they stand. The waiting room's job is not to move people fast. It is to move them fairly, at a rate the store can keep, with a position and an estimated wait that are honest. A shopper who sees position 4,200 and a 2-hour wait will leave, and that is fine. A shopper who sees position 12 and waits 2 hours will never come back.

Related reading on this site: Home and How to Stop Bots on a Shopify Store During a Drop cover the neighbouring problems in more depth.

Randomized starts and the fairness problem

For a scheduled drop, early visitors are randomized when the sale starts, while later visitors join in first-in-first-out order. The randomization exists because the alternative is worse: a pure first-in-first-out queue rewards the shopper with the fastest connection and the best script, which is another way of saying it rewards bots. Randomizing the early arrivals gives every visitor who showed up on time an equal chance of being first in line, and it removes the speed advantage that bots are built to exploit.

The fairness has to be visible to work. A waiting room that shows a position, an estimated wait, and a progress indicator is making a promise the shopper can check. A room that shows a spinner and nothing else is asking for trust it has not earned, and the shopper's next move is to open a second tab, which is the behaviour that breaks fairness from the other side. Show the stock level too, where the integration supports it: CrowdHandler's Shopify integration syncs real-time inventory into the waiting room, so shoppers see the number tick down as people check out, and a sold-out message triggers the moment it hits zero.

What breaks when the rate is wrong

Admit too fast and checkout falls over, the payment step times out, and the shoppers who did everything right get an error page. Admit too slow and the queue becomes the story: shoppers abandon, screenshots of the wait spread on social media, and the drop is remembered for the queue instead of the product. Both failures come from the same mistake, setting the rate from the traffic number instead of the checkout number.

The fix is a rehearsal with real numbers. Run the drop configuration against a test product a week before, with the same admission rate, the same checkout validation, and a simulated load. Watch the payment step, not the waiting room, because the waiting room will look fine right up until checkout stops. If the rehearsal shows checkout sustaining 40 a minute, set the rate at 30 and leave it there. A drop that sells out slowly is a drop that sold out. A drop that crashed is a refund queue.

Frequently asked questions

How do you set a waiting room admission rate?

From measured checkout throughput, not from traffic. If checkout completes 40 orders a minute under load, admit 30 to 35 shoppers a minute and let the queue absorb the difference. The margin covers slow payments, retries, and address validation failures.

Why randomize early visitors instead of first-in-first-out?

Because pure first-in-first-out rewards the fastest connection and the best script, which is how bots win. Randomizing early arrivals gives every visitor who showed up on time an equal chance of being first in line.

What is checkout validation in a waiting room?

Server-side confirmation that a visitor passed through the queue before they can buy the protected product. If a shopper bypasses the waiting room JavaScript, the token is missing from their session and the purchase is blocked or the item is removed from the cart.

What happens if the admission rate is too high?

Checkout falls over. The payment step times out, shoppers who did everything right get an error page, and the drop collapses into the failure the queue was supposed to prevent. The admission rate must match what checkout can process, not how many people are waiting.