Where WooCommerce fake orders come from
Fake orders come from a handful of sources. Card testers place cheap orders to see which stolen numbers go through. Spam bots submit the checkout form with junk details. Coupon hunters cycle through codes until one works. And some people place orders they never mean to pay for, using an email address they will never read.
The first three are automated and leave patterns a plugin can act on. The last one often looks like a normal customer, which matters for what you can expect from any tool.
Block disposable email at WooCommerce checkout
WP SecureGate checks the billing email when an order is placed. If it belongs to a known throwaway inbox service, or to a domain that cannot receive mail at all, the order is refused and the buyer is asked to check the address. That works on both the block checkout and the classic checkout.
Two exceptions keep real orders flowing. Shop managers placing an order are never checked, so staff testing the shop or ordering for a customer aren't held up. And if the mail lookup itself fails, the order is allowed rather than blocked on a technical hiccup.
On by default.
WooCommerce spam orders from card testers
A card-testing run produces dozens or hundreds of failed orders, each from a different IP address. WP SecureGate counts failed payments at checkout across the whole shop and raises an alarm when they run well above normal. For the next 6 hours every address gets tighter checkout limits, and a second failed payment pauses that address for an hour.
Customers who are signed in and have paid before are left out of those tighter limits. The full rules are on WooCommerce card-testing protection.
On by default.
Repeated checkout and coupon abuse from one address
Outside an attack, three standing limits apply to each address:
- 10 checkout attempts in 10 minutes;
- after 3 failed payments, a one-hour pause on that address's checkout;
- 10 coupon tries, which stops a bot from guessing codes.
On from day one for new installs. Existing shops get a one-click Recommended item to turn them on.
What WP SecureGate does not check
It does not verify names or postal addresses, it does not score orders for fraud risk, and it has no queue for reviewing orders by hand. An order placed with a real, working email address and a card that goes through will be accepted, even if the person behind it never intends to collect.
For that kind of fraud, turn on the fraud tools your payment gateway offers, which can see card and payment signals a WordPress plugin can't. It also helps to look over large or unusual orders before you ship them.
Fake accounts that come with fake orders
Bots that place junk orders often open junk customer accounts too. Sign-up protection limits new accounts per address, refuses throwaway inboxes at registration, and never limits a real buyer creating an account during checkout. See WordPress spam registrations for how it works, or the WooCommerce security plugin overview for everything the shop gets.
On by default.
Part of WP SecureGate: Card-testing protection →