When the firewall blocks the checkout: WAF rules for Magento and WooCommerce
A web application firewall is the right call for any store. It is also one of the most common reasons a checkout breaks for some customers and not others: a bot challenge on an AJAX call, a rule that flags an address with an apostrophe, a payment provider callback treated as an attack. The store looks fine to you; the firewall log tells a different story.
How it shows up
Buyers see a spinner that never ends, an "error processing your order" message, or a payment that succeeds at the bank while the order stays pending. In the browser console, the checkout request returns 403, or an HTML challenge page where JSON was expected.
It is often partial: only some countries, only mobile networks, only customers behind a VPN or a carrier-grade NAT that shares one IP with thousands of others.
Paths that must not be challenged
WooCommerce: `?wc-ajax=*` (update_order_review, checkout, apply_coupon), `/wp-json/wc/store/v1/*` for the Blocks checkout, `/wc-api/*` and the gateway webhook paths. Magento: `/rest/*/V1/carts/*`, `/rest/*/V1/guest-carts/*`, `/checkout/*`, `/customer/section/load` and each payment module's callback URL.
These calls come from JavaScript or from the payment provider's servers, so they cannot solve a challenge page. Use a skip rule for the bot challenge on those paths, and keep the managed rules on.
Payment provider callbacks
Banks and gateways call your store back from their own servers to confirm a payment. If a country block, bot rule or rate limit stops that call, the customer is charged and the order stays in pending payment. See Magento orders stuck in pending payment and card redirect failures.
Allow the provider's published IP ranges or the exact callback path, and log every block on it so you notice when the provider adds new addresses.
Rules that fire on real customer data
OWASP core rule set signatures can match ordinary input: an apostrophe in O'Brien, a street name with SQL keywords, long order notes, or a coupon with special characters. In ModSecurity, find the rule id in the audit log and add a targeted exclusion for that parameter on the checkout path instead of turning off the whole rule set.
Wordfence and similar plugins can rate-limit or block AJAX calls when many buyers share one IP. Raise those limits for checkout endpoints and whitelist your own monitoring.
Test from outside after every rule change
Firewall changes are invisible from inside the admin. Test the full checkout from a clean browser on another network after each rule change, or let an external monitor do it. The free WooCommerce checkout checker and Magento checkout test run from outside your network and show the step a block hits.
For card-testing protection that does not hurt buyers, see card testing attacks.
Common questions
Can Cloudflare block my checkout?
Yes. Bot challenges or rules on AJAX and REST checkout calls, or on payment callbacks, return a challenge page where the checkout expects JSON.
Which WooCommerce paths should skip the bot challenge?
?wc-ajax= calls, /wp-json/wc/store/ for the Blocks checkout, /wc-api/ and your payment gateway webhook paths. Keep managed rules on.
How do I know the firewall is the cause?
Look for 403 responses or challenge HTML in the browser network tab and match the time in the firewall event log.