WooCommerce card-testing protection

WooCommerce Card Testing Protection That Sees the Whole Attack

Card testers use your checkout to find out which stolen card numbers still work. They spread their attempts over hundreds of IP addresses, so no single address looks busy. WP SecureGate watches failed payments across the whole shop, raises an alarm when they climb far above normal, and tightens checkout for every address until the attack is over.

See plans & pricingAll features
  • ✓ Alarm on by default
  • ✓ Works on classic and block checkout
  • ✓ Paying customers are left alone

What card testing does to a shop

A card-testing bot posts small orders straight to your checkout, often without loading a single page. Most attempts fail, and each failure costs you: payment processors count the declines against your account, gateway fees can apply to failed attempts, and a flood of failed orders buries the real ones.

Per-address limits alone miss it, because a modern attack sends each card from a different address. The signal that does show is the shop's total number of failed payments.

The card-testing alarm

WP SecureGate counts failed payments at checkout across the whole shop. The alarm goes up when they reach at least 8 in 15 minutes, or four times your shop's usual 15 minutes over the past week, whichever is higher. A busy shop's normal declines don't set it off.

While the alarm is up, for the next 6 hours:

  • each address may try checkout 5 times in 10 minutes;
  • an address's second failed payment pauses its checkout for an hour, so one mistyped card does not;
  • signed-in customers who have paid before are never held to these tighter limits;
  • one alert is recorded, "Card testing on your shop", and emailed to you if you have switched email alerts on.

On by default. The WooCommerce screen shows the alarm, with a button to end it early.

Only real checkout failures count

The alarm counts a payment only when it was tried at checkout in the same request. Subscription renewals, scheduled actions, gateway webhooks and orders an admin marks as failed never count, so your own work can't raise it. A successful payment clears an address's failures.

No orders from throwaway billing emails

Fake orders and most card testers use disposable or made-up email addresses. WP SecureGate refuses an order whose billing email is a known throwaway inbox or a domain that cannot receive mail, on both the block checkout and the classic checkout. The buyer is asked to check the address, since their order confirmation goes there. Shop managers are never checked, and if the email lookup itself fails, the order goes through.

More on this in stopping fake orders.

On by default.

Everyday checkout limits

Outside an attack, three per-address limits keep a single source from hammering your checkout: 10 checkout attempts in 10 minutes, a one-hour pause after 3 failed payments, and a cap of 10 coupon tries against coupon guessing.

On from day one on new installs. Existing shops get a one-click "Protect checkout from card testing" recommendation.

A CAPTCHA at checkout, if you want one

You can also put a CAPTCHA on the classic and block checkout and on the Store API route that bots post to, using Cloudflare Turnstile, hCaptcha, Google reCAPTCHA or a built-in challenge. A separate option asks for the CAPTCHA only while the card-testing alarm is up.

It is your choice because of one trade-off: wallet buttons such as Apple Pay, Google Pay and PayPal cannot show a challenge, so they stop working while it applies. See WooCommerce CAPTCHA for the details.

Off by default. Needs a CAPTCHA provider.

Part of WP SecureGate: WooCommerce CAPTCHA →

Related protection

WooCommerce securityCheckout protection for WooCommerce shops plus the firewall, scanning and login security the store runs on.Fake ordersRefuses orders with throwaway billing emails and limits card-testing and coupon abuse at WooCommerce checkout.WooCommerce CAPTCHATurnstile, hCaptcha or reCAPTCHA on WooCommerce login, sign-up and checkout, always or only during an attack.Spam registrationsSign-up limits, throwaway-inbox checks and an unused-accounts review for WordPress and WooCommerce.

Questions about card-testing protection

Card testing is when a bot uses your checkout to check which stolen card numbers still work, usually with many small orders sent from many different IP addresses. Most attempts fail, and the declines can hurt your standing with your payment processor.

It is built not to. It goes up only when failed payments run far above your shop's normal rate, a first failed payment never pauses anyone, and signed-in customers who have paid before are never held to the tighter limits. The alarm ends on its own after 6 hours, or you can end it from the WooCommerce screen.

Not necessarily. The alarm, the per-address limits and the billing-email check work without one. A checkout CAPTCHA is an extra layer you can add, but it stops wallet buttons such as Apple Pay and Google Pay from working while it applies.

Yes. The alarm, the checkout limits and the billing-email check work on both the block checkout and the classic checkout, and the optional CAPTCHA covers both, including the Store API route the block checkout uses.

Every feature, in every plan

One licence covers the firewall, malware scanner, login protection, WooCommerce checkout protection and everything else. Plans differ only in the number of sites, and every charge has a 7-day refund.

Choose a planAsk a question