Card testing is when someone runs small purchases on your store with stolen card numbers, to find out which cards still work. The cards that pass are then used for fraud, and your store is left with a pile of failed orders, fake customers and possible disputes. On WooCommerce, some attacks skip your checkout page altogether.

How it shows up

  • Bursts of small orders, often for the same cheap product, with many failing at payment.
  • Customer names and addresses that don't make sense, or repeat with small variations.
  • Orders with no real browsing behind them. WooCommerce reports attacks aimed at its Store API directly, even on stores that don't use the Checkout block, so the “shopper” may never have loaded a page.

What WooCommerce gives you

The Store API has rate limiting built in, but it is switched off by default. WooCommerce's developers describe it plainly: it slows an attack immediately but doesn't prevent it fully.

  • Turn it on. Developers can enable it with the woocommerce_store_api_rate_limit_options filter. From WooCommerce 9.6, far stricter rules for the place-order endpoint can be switched on from the admin.
  • Behind a proxy or CDN, enable proxy mode, so you don't block genuine shoppers who share the proxy's address.
  • Identify attackers by more than IP. From WooCommerce 9.8, a developer can replace the IP-based rate-limit key with a custom fingerprint through the woocommerce_store_api_rate_limit_id filter.

Your payment provider's card checks, such as CVV, address verification and 3-D Secure, are the other half: they help decline stolen cards before a charge goes through.

Source: WooCommerce Developer Blog, Card Testing Attacks and the Store API (December 2024).

What AdProtektor adds on WooCommerce

  • Checkout protection. A visitor AdProtektor has flagged on hard evidence, meaning detected automation, a block you set yourself, or a visit from outside the area you allow, can't add to the cart or place an order. They see a reference to quote if they think it's a mistake. Everyone else checks out as normal.
  • A server-side check before the order exists. With the AdProtektor plugin and your site key, each order placed through the classic checkout, the Checkout block or a payment button that uses them is checked on your server before WooCommerce creates it. Orders that store managers place are not checked.
  • It fails open. If AdProtektor can't be reached, the order goes through, so an outage never costs you a real sale. You can switch checkout protection off for a site in the dashboard.
  • The attempts stay visible. Every blocked attempt is recorded in the dashboard with its reference, so you can see who was stopped and why.

Use both layers

Checkout protection acts on visitors AdProtektor has evidence against. Rate limiting also covers requests that never load a page. Run WooCommerce's rate limiting, your payment provider's card checks and checkout protection together.

A short checklist

  1. Switch on Store API rate limiting, with the stricter place-order rules on WooCommerce 9.6 or later.
  2. Enable proxy mode if your store sits behind a proxy or CDN.
  3. Keep CVV, address verification and 3-D Secure on with your payment provider.
  4. Install the AdProtektor plugin with your site key, so flagged visitors can't reach the order stage.
  5. Watch failed orders: a sudden burst is the signal to tighten the limits.
You can't stop someone from trying stolen cards. You can stop your store from being the easy place to try them.

The WordPress and WooCommerce integration page walks through the plugin setup. To protect your store, start a free trial.