Card testing attacks on WooCommerce: stopping them without blocking customers
Card testing is when bots use your checkout to check which stolen card numbers still work. You see a flood of small failed orders, your payment provider sees a flood of declines — and may restrict your account before you notice.
How to recognise it
Many failed or pending orders in a short time, often for the same cheap product, with random names and addresses, from many IPs. The payment provider’s dashboard shows a spike of declines. Sometimes the attack goes straight to the Store API without loading the checkout page.
Beyond fees, the real risk is the gateway: providers can suspend accounts with unusual decline rates, turning an attack into a payment gateway that fails for everyone.
Stopping it
Enable the fraud tools your payment provider offers, add rate limiting for checkout requests (WooCommerce supports rate limiting for its Store API), and consider a CAPTCHA that only challenges suspicious sessions. Block obvious sources at the firewall or CDN.
Remove the cheapest product from public view if it is the target, and require account creation temporarily during an active attack.
Find out your checkout broke before your customers do.
Real checkout checks for Magento and WooCommerce · 14 days free · no card requiredWithout blocking real buyers
Every protection is a new way for checkout to fail for real customers: a CAPTCHA that never loads, a rate limit that blocks a busy office network, a security plugin rule that catches payment callbacks.
After adding protection, walk the checkout yourself and keep a scheduled check running. If a check is blocked, it is marked UNKNOWN rather than a failure — which tells you your protection is also stopping legitimate automated traffic you rely on.
Check your own store now with the free WooCommerce checkout checker: it walks the checkout in a real browser and shows the step where it stops.
Why WooCommerce stores get picked
Card testers look for a checkout that answers fast, takes small amounts and returns a clear decline reason. A WooCommerce store with guest checkout, a cheap product and no rate limit on the Store API (`/wp-json/wc/store/v1/checkout`) fits that profile, and bots skip the visible checkout page entirely.
The Blocks checkout and some gateway plugins expose endpoints that legacy anti-spam plugins never see. Check your server log for bursts of POSTs to `wc/store`, `?wc-ajax=checkout` or the gateway's own endpoint from many IPs with the same user agent.
Clean-up after an attack
Cancel the failed and pending orders in bulk so stock is released, then check the gateway dashboard: Stripe, for example, can flag the account and raise fees after a spike in declines. Contact the gateway early and tell them what you changed.
Review what you added in panic. A CAPTCHA that blocks the bots can also block Apple Pay, Google Pay or mobile buyers; run a real test order on desktop and on a phone after every change, or let a daily checkout check do it for you.
Common questions
What is a card testing attack?
Bots use a store’s checkout to try stolen card numbers with small payments, leaving many failed orders and gateway fees.
How do I stop card testing on WooCommerce?
Rate-limit orders per IP and session, add a CAPTCHA or Turnstile on checkout, turn on the gateway’s fraud rules, and protect the Store API endpoints the bots call.
Will a CAPTCHA hurt real customers?
An invisible challenge such as Cloudflare Turnstile or reCAPTCHA v3 shown only on risk keeps the friction low; test the checkout after adding it.