Three orders from the same customer, and two of them have already cost you money. That’s usually the moment store owners start searching for a way to make WooCommerce block customers like this one.
The first order was delivered, then disputed as “unauthorized” weeks later. The second was cash on delivery, refused at the door, so you paid shipping both ways. This morning, a third order from that same email landed in your queue. Like many fake WooCommerce orders, it looks legitimate at first glance.
We’ve watched plenty of store owners reach this exact moment. The fix is simpler than it feels, as long as you choose the right kind of block, and we’ll guide you through it, starting with that order still waiting in your queue.
TL;DR: To block WooCommerce customers, use a blocklist plugin for a repeat offender’s email or phone, WooCommerce > Settings > General for countries, and our security plugin for bot traffic. Keep payment checks and order reviews running as part of your WooCommerce security, because a determined person can return with new details.
Stop the order in your queue
Before you set up any block, deal with the order that’s already there. A new rule only stops future orders, so this one will ship unless you step in.
- Put the order on hold so nothing leaves your warehouse while you decide.
- Cancel and refund it if the payment looks suspicious, using your payment provider’s process.
- Keep the records from the earlier disputed order, because you may need them to fight the chargeback.
Once a parcel ships, getting it back is rarely worth the effort. With this one safely paused, you can turn to the bigger question: how to stop the fourth order before it ever arrives.
Can WooCommerce block customers on its own?
Here’s what most store owners discover the moment they start looking:
- WooCommerce has no built-in “block customer” button. Its core settings control which countries you sell and ship to, so blocking a specific person takes a plugin.
- A block stops a detail, not a person. Blocking an email tells your store to refuse that email, but the customer behind it can come back with a new address, a different phone number, or a VPN.
We’ve seen blocked customers return the very next day with a fresh Gmail address. Most repeat offenders don’t bother, though, and the ones who do usually leave patterns you can spot. Think of a block as your first line of defense, with payment checks and order reviews standing behind it.
Choose the right way to block customers
Your situation shapes the right tool. Use the narrowest block that solves it, because broad rules catch innocent shoppers too.
| What you know | Where to start | Example |
|---|---|---|
| A specific email or phone keeps causing trouble | A blocklist plugin | The same buyer orders, receives the goods, then files a chargeback |
| You don’t sell to a certain country | WooCommerce’s selling location setting | Orders keep arriving from a region you can’t legally ship to |
| Bots keep attacking from changing addresses | A firewall | Hundreds of fake checkout attempts arrive from new addresses each hour |
| Something feels off, but you can’t prove it | Hold the order and review it | A large first order ships to an address that doesn’t match the billing details |
The customer in your queue fits the first row. You have their email, their phone number, and a clear pattern, so that’s where to begin.
Block customers by email or phone
The email and phone number on those three orders are your strongest leads. They’re specific enough to stop one person without touching anyone else.
Pick a blocklist plugin. Compare WooCommerce fraud prevention plugins for supported identifiers and checkout compatibility. WooCommerce’s marketplace has a few options.
- Blacklist for WooCommerce blocks orders based on email, full name, or phone number.
- Blacklist and Block Customers and Orders combines conditions such as name, email, phone, IP address, country, and order total in one rule.
Install it and open its settings. These plugins usually add a tab inside WooCommerce settings. Blacklist and Block Customers and Orders, for example, adds a Blacklist Manager tab with a Quick Blacklist area for emails and phone numbers.
Copy the details straight from the order. Retyping from memory invites typos, and one wrong character means the block never triggers.
Record why you blocked them. Note the order numbers, the chargeback, the refused delivery, and the date, so anyone on your team can understand the decision months from now.
Test the block. Place one test order with the blocked email to confirm it’s refused, and another with a different email to confirm real customers still get through. Use a staging site, a private copy of your store, if you have one.
Consider a soft block for unpaid cash-on-delivery orders. That refused parcel is a common pattern, and the StoreFence plugin offers a gentler fix. It lets the customer still check out, but only with the payment methods you choose, usually card gateways. If the buyer was genuine, they can still order, and if they weren’t, they have to pay upfront.
📝 Note: Phone numbers are where most blocks quietly fail, because “+1 555 0100” and “5550100” look different to a plugin. Check whether your plugin standardizes phone formats, or add each version the customer has used.
Block by country
Now picture a slightly different version of the same morning. The problem orders don’t share one email, but they all come from a country you can’t ship to. If your business can’t sell somewhere, WooCommerce handles it without a plugin.
Open your general settings. Go to WooCommerce > Settings > General and find the Selling location(s) dropdown, which offers:
- Sell to all countries
- Sell to all countries, except for…
- Sell to specific countries
Set your restriction. Choose “Sell to all countries, except for…” and add the countries to exclude, or choose “Sell to specific countries” and list only the ones you serve. Then check the Shipping location(s) setting below so your delivery rules match.
Know what customers will see. A restricted customer who tries to check out sees a notice saying no shipping options are available for their location.
It’s tempting to reach for this setting when one person from abroad causes trouble. We’ve seen store owners block an entire country to stop one buyer, then watch legitimate orders from that country vanish too. Keep country restrictions for real business limits, and use an email or phone block for one person.
📝 Note: This setting controls who can buy, and visitors from excluded countries can still browse your store.Blocking visits based on country requires a separate control such as WordPress geoblocking.
Why blocking an IP address often backfires
When an email block feels too easy to dodge, blocking the customer’s IP address seems like the stronger option. An IP address is the network address a visitor connects from, and it’s one of the least reliable ways to stop a specific person:
- Home addresses change regularly.
- Mobile networks share addresses among thousands of people.
- Offices, schools, hotels, and cafes put everyone behind one address.
- A VPN can make anyone appear to be anywhere.
Block one of those and you might stop the troublemaker for a day while locking out a whole building of potential customers. Save IP blocks for short, obvious attacks, such as hundreds of checkout attempts from one address in an hour, and remove them once the attack ends.
Be careful with guides that tell you to paste IP lists into your .htaccess file, a server settings file. One typo can take your site offline, and if your host uses Nginx, the rule won’t work at all.
When the problem is bots
Sometimes the morning looks different again. Instead of one familiar name, you find dozens of failed orders from strangers, each with a different address. That pattern usually means bots, not a person, and bots switch addresses faster than anyone can block them by hand. If the burst includes repeated small payments and declines, investigate a possible WooCommerce card testing attack.
A WordPress firewall checks incoming traffic before it reaches your store and filters out requests that look automated or malicious. Our WordPress security plugin includes one, so it handles the shifting bot traffic while your blocklist keeps stopping the specific people you’ve identified.
Each tool covers a different job:
- Your blocklist stops known people.
- Your location settings stop countries you don’t serve.
- Your firewall stops bots.
Stores that deal with ongoing fraud usually end up using all three.
What blocked customers will see
Back to the customer from your queue. When they try to place that fourth order, they should see a short, polite message that doesn’t reveal the reason. If you tell them their email is blocked, you’ve just told them to use a different one.
This wording works well: “We’re unable to complete this order. Please contact our support team if you think this is a mistake.”
Most blocklist plugins let you write it yourself. Blacklist for WooCommerce shows a standard error that doesn’t mention a blacklist, and Blacklist and Block Customers and Orders lets you set a custom message. Use the same wording everywhere so it reads like any normal store message.
That support line also protects you, because sometimes a block lands on the wrong person.
If you blocked the wrong person
A shared phone number, a family email, or a country rule that catches a traveler can all stop someone who did nothing wrong. When a genuine customer reaches out, fix the broadest rule first.
- Replace a country or IP rule with a specific email or phone block, if your evidence supports it.
- Remove the incorrect entry from your blocklist.
- Place a test order with the customer’s details to confirm they can buy again.
- Update your notes so your team knows what changed and why.
A quick apology email goes a long way. Customers tend to be understanding when a store owns the mistake and fixes it fast.
📝 Note: Give every temporary exception a review date. Quick fixes made during a busy week have a habit of becoming permanent gaps.
If orders still get through
Say the block is in place, but another suspicious order arrives a week later. Work through these checks in order:
- Did they use the blocked details? A new email, a different phone format, or a second account will slip past the rule even when it’s working.
- Does the plugin support your checkout? WooCommerce has a classic checkout and a newer block-based one, and some plugins only check one of them.
- Are real customers still getting through? A rule that’s too broad is harder to notice than one that misses, because the people it blocks just leave quietly.
Test with one blocked detail and one allowed detail every time you change a rule.
Build a safety net around every block
Even a perfect blocklist can’t catch a customer who arrives with all-new details. Addressing broader WooCommerce security issues helps protect your store beyond individual blocks. Other checks fill the gaps:
- Payment fraud checks: AVS compares the billing address with the bank’s records, CVV checks the card’s security code, and 3-D Secure asks the cardholder to confirm with their bank.
- Order reviews: Check for signs of fake WooCommerce orders, including large first orders, rushed shipping to new addresses, and several orders in quick succession.
- Account protection: Use two-factor authentication to protect existing accounts, and CAPTCHA to help reduce automated registrations.
- Updates: Apply WordPress security updates and keep WooCommerce and plugins current to close known security gaps.
With these in place, a blocked customer who switches details still has several checks to get past.
FAQs
Will a customer know WooCommerce has blocked them?
Not if you use a neutral message. A wording like “We’re unable to complete this order” tells them something went wrong without revealing that their details are on a blocklist.
Should I delete the blocked customer’s account?
Usually not, because the order history may help you fight a chargeback. Keep the account and its records, and let the blocklist stop new orders.
Can I block someone before they place an order?
Yes, you can add an email or phone number to your blocklist at any time. Some plugins, such as Blacklist and Block Customers and Orders, can also stop matching people from registering.
Should I tell my payment provider about a problem customer?
Yes, especially when chargebacks or suspected CNP fraud are involved. Your provider can see payment patterns your store can’t, and their fraud tools may flag the same customer on future attempts.
How long should a block stay in place?
Email and phone blocks for proven abuse can stay until you have a reason to remove them. Review IP blocks and temporary exceptions regularly, because those details change hands over time.
Conclusion
That third order no longer has to be a guessing game. Hold it first, then block the email and phone number behind it, and save country rules and firewalls for the problems they’re built to solve. When you set up WooCommerce to block customers this way, test every rule with a real and a blocked detail, and keep a note explaining why each one exists.
With payment checks and order reviews standing behind your blocks, the next repeat offender gets stopped at checkout instead of at your doorstep.
