You open your orders page expecting an ordinary day. Instead, you find a long list of tiny payments from strangers, most of them marked as failed, with more arriving while you watch.
That pattern is one of the clearest signs of a WooCommerce card testing attack, and if it has your heart racing a little, that’s a fair reaction.
We’ve seen this pattern a handful of times, and it follows a predictable script. Once you understand that script, you can stop the attempts, check affected payments, and address the WooCommerce security issues that leave your store exposed.
We’ll guide you through it from the first alarm to the day things feel normal again, with no technical background needed.
TL;DR: Pause the payment method being abused, then check which payments actually went through before you delete any orders. A security plugin adds bot blocking and monitoring, while your payment provider’s checks protect the payments themselves.Follow WooCommerce security best practices to make repeat attacks harder.
Why did your store take a hit?
The first question most store owners ask is “why me?” Usually, the attacker has nothing against your store in particular.
Criminals buy lists of stolen card numbers, Those details may have been stolen through payment skimming attacks on other websites; their use here does not by itself mean your store was hacked. Many of those cards could be already cancelled or blocked.
To find the ones that still work, they use a bot, which is an automated program, to try small payments on real online stores. A store with an open checkout makes a convenient testing ground.
Speed is what makes these attacks hard to catch. Some merchants have seen attempts arrive about once per second, which means a few minutes can produce hundreds of tries. That speed also leaves a trail, and the trail is how you’ll recognize the attack.
The signs to look for
A single strange order rarely means much. The pattern is what gives the attack away, so look for several of these at once:
- A burst of very small payments, often a few cents or a dollar
- A sudden jump in failed orders with the same decline message
- Many attempts from the same source or email address, or from countries you don’t usually sell to
- Activity at odd hours, such as the middle of the night
- Attempts on your cheapest product or a donation option
A few declines on a normal afternoon are part of everyday store life. When two or three of these signs show up together, you’re very likely looking at an attack, and the next question is what it could cost you.
What’s really at risk
The failed orders grab your attention because there are so many of them. The bigger risk usually sits somewhere quieter: a single successful fraudulent payment can cost you more than many failed ones.
A successful payment can turn into a chargeback, which is when the real cardholder disputes the charge and the money is taken back from you. Beyond that, an attack can:
- Slow your site down for real customers, or even take it offline
- Eat up your time as you review and reverse transactions
- Draw a review of your payment account, which can lead to suspension after repeated failures and chargebacks
- Cost you products and postage if a fraudulent order ships
Successful payments may appear only in your payment provider’s dashboard, such as Stripe or PayPal, rather than in WooCommerce. Keep that in mind, because it shapes your next steps. First, though, the attempts need to stop.
Stop the attempts first
Every minute adds more attempts, so your first goal is simple: stop the bots from reaching your payment provider.
- Pause the abused payment method. Go to WooCommerce > Settings > Payments and switch it off. If you accept payments in more than one way, keep the unaffected methods running so real customers can still buy.
- Write down every change. Note what you changed and when, so you know exactly what to turn back on later.
- Contact your payment provider. They can see fraud signals your store can’t, and they may be able to block the activity on their side.
📝 Note: Pausing every payment method stops the attack fastest, but it also stops genuine sales. Treat it as an emergency brake, and turn each method back on once you’ve checked it.
With the attempts paused, you have room to breathe. Now you can find out what actually happened.
Check what actually got paid
Your instinct may be to delete all those failed orders so the dashboard looks normal again. Hold off for now, because they’re evidence. They help answer the most important question: did any payment succeed?
Open your provider’s dashboard and your WooCommerce orders side by side for the time of the attack. For each order, compare the status, amount, time, customer details, and whether it has shipped.
Your provider may show two kinds of successful payments. An authorized payment means the bank approved the charge but hasn’t collected the money yet, while a captured payment means the money is being collected. Ask your provider how to handle each one.
If a suspicious payment went through, follow your provider’s fraud and refund steps right away. A refund may not return the processing fee, and refund tools differ between providers, so check your own provider’s help pages.
📝 Note: Download your order list and your provider’s transaction report before you change anything. If a dashboard updates later, you’ll still have the original record.
A suspicious payment leads straight to an urgent follow-up question: has that order already left your hands?
Hold suspicious orders before they ship
Put every order from the time of the attack on hold before you ship it or send a digital download. A held order is easy to cancel. A shipped one can cost you the product, the postage, and a dispute fee, and a refund won’t bring a parcel back.
When reviewing the batch, check for other signs of fake WooCommerce orders before deciding which orders to release.
With the risky orders safely on hold, you can turn to the question of how the bots got in.
Find out which door they used
Before you change any security settings, it helps to know which route the bots took. Most shoppers pay through your regular checkout page, but WooCommerce also has a hidden route for payments called the Store API. Bots can send payment attempts through it without ever loading your checkout page, and it doesn’t require a login.
Ask your hosting company or developer to check server access logs and identify which route the attempts are using. Their answer tells you which of the fixes below will actually help, so you don’t spend time guarding the wrong door.
Should you turn off guest checkout?
Guest checkout lets people buy without creating an account. Requiring an account adds an extra step, which can slow down automated attempts.
The same step also slows down your real first-time shoppers, and some of them may leave rather than sign up. That’s why we suggest using it as a short-term measure while you investigate. You’ll find the setting under WooCommerce > Settings > Accounts and Privacy.
Keep in mind that this setting leaves some routes open, such as express payment buttons and the Store API. That limitation explains why the most popular fix often falls short as well.
Why a CAPTCHA alone won’t stop it
Most advice stops at “add a CAPTCHA,” the “I’m not a robot” check you’ve probably clicked on other sites. It can slow down bots that fill in your checkout form.
A CAPTCHA only protects the page it sits on, though. If the bots are using the Store API, they never load that page, so the CAPTCHA never gets a chance to stop them. That’s why knowing which door they used matters so much.
A CAPTCHA works best as one layer among several. Fortunately, WooCommerce includes a tool built for that hidden route.
Slow the bots down with rate limiting
Rate limiting caps how many checkout attempts one visitor can make in a short time. In WooCommerce, you’ll find it under WooCommerce > Settings > Advanced > Features, labelled Rate limiting Checkout block and Store API. It’s switched off by default.
When it’s on, WooCommerce documents a limit of three attempts per 60 seconds from one visitor. Most real shoppers won’t come close to that, while a bot trying card after card gets slowed down sharply. Check how the setting behaves in your WooCommerce version before you rely on it.
There’s one catch. WooCommerce tells visitors apart by their internet address, called an IP address. If your store uses a service that sits in front of it, such as Cloudflare, every shopper may look like the same visitor. Ask your host to set up proxy support as described in WooCommerce’s rate limiting documentation, or the limit may block real customers while the bots carry on.
📝 Note: Write down how to switch the rate limit off and who can do it. If it starts blocking real buyers during a sale, you’ll want that answer quickly.
Rate limiting slows the bots down. Some store owners then wonder whether they should shut the hidden route entirely.
Should you block the API completely?
Blocking the Store API can feel like the safest move. We’d suggest pausing first, because the same route often powers mobile apps, marketplace connections, shipping tools, and order emails, and shutting it off can quietly break them.
A narrower fix usually works better. Ask your host or developer to block only the traffic pattern the bots are using, and rely on the rate limit and your paused payment method in the meantime. If you identify repeat abusive sources, consider blocking specific customers or IP addresses rather than blocking the entire API.
If an emergency forces a broader block, list what depends on the route first and switch each service back on one at a time. At this point, the attack is under control. The next job is making a repeat less likely.
Make your store a harder target
A store that has been tested once can be targeted again. Several layers working together catch what any single tool misses:
- Limit repeated attempts from the same visitor, account, or product, based on what normal traffic looks like for your store.
- Protect every way customers can pay, including your regular checkout, express payment buttons, and saved cards.
- Turn on your provider’s fraud checks, such as AVS, which checks that the billing address matches the bank’s records, and CVV, which checks the security code on the card.
- Add bot blocking and monitoring. Choose a WordPress security plugin with bot blocking and activity monitoring. MalCare identifies and blocks harmful bots and keeps an activity log of changes on your site.It works alongside your payment provider and doesn’t process payments or issue refunds.
- Watch your activity log and analytics for sudden spikes, and test WordPress security updates on a staging site first. A staging site is a private copy of your store where changes can’t affect real customers.
Saved cards deserve extra care. If you see suspicious payments but very few failed orders, an attacker may be using a customer account with a saved card. Changes here affect your returning customers and subscriptions, so make small adjustments and test each one.
If a customer account was compromised, reset its password and apply strong password practices before restoring access. If the activity points to compromised customer accounts, review WordPress account access and user roles as part of your investigation.
With these layers in place, you’re ready for the last step: letting real customers pay again.
Turn payments back on safely
Restore payments one step at a time. That way you can see which change is working and undo it quickly if the attempts return. Before you switch each payment method back on, check that:
- Your provider has confirmed the next steps for any affected payments
- Suspicious successful orders are on hold, refunded, or passed to your provider
- A test purchase works, both as a guest and while logged in
- Your rate limit sees real shoppers, not just your Cloudflare or proxy address
- Someone knows how to undo each change you made
Keep an eye on your orders for a few days afterward. No setting can promise zero attempts, but you’ll now know the signs and the steps if another wave arrives. Maintain routine WordPress security alongside these checkout controls to protect administrator accounts and keep site software secure.
FAQs
Do failed orders always mean my store is under attack?
No, a few failed orders are normal, because real customers mistype details or get declined by their bank. A sudden burst of small failures with the same decline message is what points to card testing.
Should I turn off guest checkout permanently?
Usually not, since it adds an extra step for first-time shoppers and can lower sales. Use it temporarily while you set up your other defenses.
Will a CAPTCHA stop card testing on its own?
No, because it only protects the page it sits on. Bots can use WooCommerce’s Store API without loading that page, so pair a CAPTCHA with rate limiting, your provider’s fraud checks, and monitoring.
Can I get my processing fees back after an attack?
Sometimes, depending on your provider and the state of each payment. Contact your provider early and ask about fees, refunds, and disputes for the time of the attack.
Should I delete the failed orders afterward?
Not until you’ve compared them with your provider’s records and downloaded a copy. Those orders show what happened and whether any fraudulent payment got through.
Conclusion
A card testing attack feels overwhelming at first, but it follows a pattern you can now recognize.
Stop the attempts first, then check which payments went through before you delete anything. Close the route the bots used, and turn payments back on one method at a time.
With these steps in place, you’ll be ready to act quickly if another wave arrives.
