What a WooCommerce security plugin has to cover
Attacks on a shop rarely look like attacks on a blog. Bots post orders straight to the checkout to try stolen cards, create customer accounts by the hundred, guess coupon codes and place orders with addresses nobody reads. At the same time the shop is still a WordPress site, with a login page, plugins and files that attackers probe like any other.
To protect a WooCommerce store properly, you need both layers covered: what happens at checkout and My Account, and what happens to the site itself.
WooCommerce bot protection against card testing
Card testers spread their attempts over many IP addresses, so watching one address at a time misses them. WP SecureGate counts failed payments at checkout across the whole shop. When they climb to at least 8 in 15 minutes, or four times the shop's usual rate over the past week if that is higher, an alarm goes up and checkout tightens for every address for 6 hours. Signed-in customers who have paid before are exempt from those tighter limits.
Read how the alarm decides, and what it ignores, on WooCommerce card-testing protection.
On by default. The alarm can be ended early from the WooCommerce screen.
Fake orders and throwaway billing emails
An order whose billing email is a known throwaway inbox, or a domain that can't receive mail, is refused on both the block and the classic checkout. The buyer sees a request to check their address. Shop managers are never checked, and a failed DNS lookup lets the order through rather than turning a customer away.
Everyday per-address limits sit alongside it: 10 checkout attempts in 10 minutes, a one-hour pause after 3 failed payments, and at most 10 coupon tries. A successful payment clears an address's failures.
Billing-email check on by default. Per-address limits are on for new installs; existing shops get a one-click Recommended item.
Spam accounts at My Account and checkout
Sign-up protection covers the WooCommerce My Account form and accounts created at checkout, as well as WordPress registration. Each address may open at most 3 accounts a day by default, throwaway inboxes are refused, and a buyer creating an account while paying is never limited.
The full set of sign-up checks, including the review of unused accounts, is on WordPress spam registrations.
On by default.
A CAPTCHA at checkout, only if you want it
You can add Cloudflare Turnstile, hCaptcha, Google reCAPTCHA or a built-in math challenge to the WooCommerce login, registration and checkout forms. There is also an option to ask for it at checkout only while the card-testing alarm is up.
The catch is express payment: Apple Pay, Google Pay and PayPal buttons have no place to display a challenge, and they go dead for as long as the checkout CAPTCHA is active. That is why it stays your decision. Details on WooCommerce CAPTCHA.
Off by default. Needs a CAPTCHA provider and the forms you choose.
WordPress security for ecommerce: the store's own site
The same plugin covers the WordPress side. Its WooCommerce firewall runs before the theme loads, and in Block mode it refuses SQL injection, remote code execution, local file inclusion and path traversal. The scanner compares WordPress core and WordPress.org plugins with their official files, watches themes and premium plugins for PHP files that appear or change, and checks the database for a hijacked site URL and injected code.
- Firewall: new installs start in Block mode with a 7-day learning week for the team's own work. Sites upgrading from an older version keep their previous mode.
- File and database scans: on by default, daily and a minute after a plugin or theme changes.
- Login lockout: on by default, 5 failed tries in 15 minutes locks an address for 15 minutes.
- Two-factor authentication: authenticator-app codes, which you can require for chosen roles, such as Shop Manager and Administrator. No role is required by default.
Firewall Block mode, scans and lockout are on for new installs. 2FA needs setup by role.
Part of WP SecureGate: Card-testing protection →