CardFence documentation

CardFence stops card-testing attacks on every WooCommerce payment route, without slowing down real buyers.

Card testers are bots that try stolen card numbers on small stores to find the ones that still work. Every attempt can cost a gateway fee. An attack leaves hundreds of fake orders and bounced emails behind, and enough of them can get a payment account frozen. CardFence sits in front of your payment gateway. It lets real buyers through and stops the bots.

Built by Warcal.

Start here

At a glance

• Covers every payment route:
  • the block checkout (Store API), including batch requests
  • the classic checkout
  • pay-for-order
  • My Account → Add payment method
  • gateway AJAX endpoints such as PayPal Payments
• Rate limits and automatic blocks:
  • per-IP limits (IPv6 counted per /64)
  • temporary blocks after repeated declines from one IP or email
• Attack mode: switches on by itself when failed payments spike across the store. While it's on, limits tighten, the optional Cloudflare Turnstile challenge is required and "Failed order" emails pause. You get one alert, and it switches itself off afterwards.
• No friction for real buyers: store managers, allow-listed IPs and customers who have paid before are never limited. Monitor mode shows what would be blocked before you switch protection on.
• Free: every layer of protection.
• Pro: fake-order cleanup, a weekly "money saved" report, Slack and webhook alerts, disposable-email and country rules, and a year of history with CSV export.

Requirements

Compatible with HPOS (High-Performance Order Storage) and the Cart and Checkout blocks.