When your security plugin blocks the checkout
Security plugins and web application firewalls are essential for WordPress. They also sit directly in front of your checkout, deciding which requests get through — and occasionally deciding wrong.
What gets blocked
Checkout form submissions that look suspicious to a rule (an address with unusual characters, a long order note), Store API requests from the block checkout, payment provider callbacks from IPs the firewall does not know, and customers from countries blocked “temporarily” and forgotten.
The result is either a checkout error for some customers, or orders stuck on pending because payment confirmations never arrive.
Finding it
Check the plugin’s or firewall’s block log for the checkout URL, `wc-ajax`, `wp-json/wc/store` and your gateway’s callback URL. Compare with the time customers reported problems or orders dropped.
Rate limiting and bot protection added during a card testing attack are common culprits weeks later.
Fixing it safely
Allow-list your payment providers’ webhook endpoints, exclude the checkout’s own endpoints from overly aggressive rules, and prefer targeted rules over whole-country blocks.
Keep a scheduled checkout check running from outside. If your firewall starts challenging it, the run is reported as UNKNOWN — a useful early warning that the same rules may be catching real people.
Check your own store now with the free WooCommerce checkout checker: it walks the checkout in a real browser and shows the step where it stops.
Common questions
Can a security plugin block WooCommerce checkout?
Yes. Firewall rules can block wc-ajax, Store API or payment callback requests, and rate limits or country blocks can stop real customers.
How do I find what the firewall blocked?
Check the plugin’s live traffic or block log at the time of the failed checkout, and the browser Network tab for 403 responses.
How do I fix it without lowering security?
Allowlist the specific endpoint or the payment provider’s callback IPs, not the whole site, and test the checkout after the change.