CardFence for WooCommerce
Stop card testers at every door to your checkout.
Card testers are bots that try thousands of stolen card numbers on your checkout to find the ones that still work. Each attempt can cost you a gateway fee and leave fake orders behind, and enough of them can get your payment account frozen. CardFence stops them on every payment route, including the block checkout, without slowing down real buyers.
Features
Every payment route
The block checkout pays through the Store API, which many security plugins never watch. CardFence covers it, plus the classic checkout, pay-for-order, add payment method and gateway AJAX endpoints.
Rate limits real buyers never hit
8 checkout attempts per 10 minutes per IP by default. Scripts are blocked within seconds. IPv6 is counted per /64, so attackers can't rotate through their own address block.
Blocks after repeated declines
5 declined payments from one IP or email in an hour triggers a temporary block. Gateway webhooks, subscription renewals and staff edits are never mistaken for an attack.
Attack mode, by itself
When failed payments spike, limits tighten, the optional Cloudflare Turnstile challenge switches on and failed-order emails pause. You get one email, and it switches itself off afterwards.
Browser check
Confirms each order came from a browser that actually opened your checkout page, which catches scripts posting straight to the API.
Out of the way
Nothing loads on your home, shop or product pages. Store managers and customers who have paid before are never limited, and Monitor mode shows what would be blocked before you switch it on.
Pro
- One-click and daily fake-order clean-up
- Weekly “money saved” report
- Slack and webhook alerts
- Disposable-email and country rules
- 365 days of history and CSV export
- Priority support
Requires WordPress 6.4+ and PHP 7.4+. Tested up to WordPress 7.1.
Questions
Will this block real customers?
The defaults are set well above what a human does: 8 checkout attempts per 10 minutes and 5 declined payments per hour before a temporary block. Store managers, allow-listed IPs and customers who have paid before are never limited. To see the effect first, use Monitor mode.
Do I need Cloudflare?
No. Turnstile is optional and free, and it works on any site.
Will Apple Pay and Google Pay still work?
Yes. They're rate-limited like any checkout. Express buttons on product pages can't carry a challenge, so they're refused while the browser check or Turnstile is enforced, which with the recommended settings only happens during an attack.
Which payment gateways does it work with?
Every gateway that takes payment through WooCommerce's checkout, including Stripe, WooPayments, PayPal Payments, Square and Mollie. It complements your gateway's own fraud tools by stopping bots before they reach them.
My site is behind a proxy and everyone gets blocked together
Set Client IP source in Settings to match your proxy, then use Blocks → Remove all. Otherwise every buyer appears to come from the proxy's address.
Will it slow down my store?
No. It adds nothing to your home, shop and product pages: no files, no queries, no cookies. Cart and checkout get one 5 KB script, and checks only run when an order is submitted.
What happens when I uninstall?
Deleting the plugin removes its tables, settings, scheduled tasks and the flags it added to orders. Orders are never deleted.