Using the dashboard
CardFence has its own menu item, next to WooCommerce, with these screens:
- Dashboard
- Activity
- Blocks
- Settings
- Help
- Go Pro, on the free plan only
Only users who can manage WooCommerce (shop managers and administrators) can see or change anything.
Dashboard
The hero at the top shows the current state:
| State | Shield | Meaning |
|---|---|---|
| Protected | Green, with a check | Normal operation. |
| Monitoring | Blue, with an eye | Monitor-only mode: nothing is being blocked. |
| Under attack | Red, pulsing | Attack mode is on. The text says whether it started automatically or by hand, and how long is left. |
Use Turn attack mode on (choose 1 hour, 6 hours, 24 hours or 3 days) if you know an attack is coming or want maximum protection, and Turn attack mode off to end it early.
Below the hero:
- Four stat cards:
- Blocked attempts, Failed payments and Checkouts allowed (last 24 hours, with the 7-day total)
- Active blocks
- Attack-order clean-up (Pro): a bar appears when flagged attack orders are waiting to be cleaned up.
- Recent activity: the last notable events (allowed checkouts are left out).
- Active protection: a summary of the key settings, with a link to change them.
- What's covered: every payment route being protected.
- Most blocked IPs: the IPs blocked most in the last 24 hours.
Activity
Every event, newest first, 50 per page. Use the filter bar to show one type:
| Event | Meaning |
|---|---|
| Allowed | A checkout attempt passed every check. Counted towards the rate limit. |
| Blocked | An attempt was refused before the gateway was called. Repeats from the same IP for the same reason within 5 minutes are folded into one row with a ×N counter. |
| Payment failed | The gateway declined a card. Linked to the order when there is one. |
| Auto-block | An IP or email was blocked automatically. The details say why and for how long. |
| Suspicious | Logged but not acted on: a missing browser token in Log-only mode, a Cloudflare outage, or what Monitor mode would have blocked. |
| Attack mode | Attack mode switched on or off, or attack orders were cleaned up. |
Each row shows:
- When: hover to see the exact time.
- Details: the reason, and the gateway's message for declines.
- Where: which payment route.
- IP, Email and Order: the order number links to the order.
Export CSV (Pro) downloads the log, or just the filtered type, for your payment provider, accountant or a spreadsheet.
Clear the activity log deletes every event. Rate limits and failure counts start again from zero; active blocks stay.
Common reasons
| Reason | What happened |
|---|---|
| Too many checkout attempts | The IP hit the attempt limit and was blocked. |
| Still blocked: … | A request from an IP or email that is already temporarily blocked. |
| Too many failed payments | The IP or email hit the decline limit. |
| IP / Email on your block list | Matched one of your permanent lists. |
| No browser token (scripted request?) | The order didn't come from a browser that opened your checkout page. Normal for express buttons on product pages; a strong bot signal in bulk. |
| Submitted faster than a human could | The order arrived within seconds of the page loading. |
| Challenge not completed / failed | Turnstile was required and not passed. |
| Disposable email address / Country on your block list | A Pro rule matched. |
Blocks
Block an IP or email: enter an IP or an email, pick a duration (1 hour to 30 days) and click Block. Use it when you spot a bad actor in the activity log.
Active blocks lists every temporary block: what is blocked, why, since when and until when. Unblock lifts one early; Remove all lifts every block. Use it after fixing a proxy setting that blocked real buyers.
Blocks lift by themselves when they expire. For permanent blocks, use the lists in Settings → Allow and block lists.
Help
A short guide inside wp-admin:
- the setup steps
- the order of checks
- what each event type means
- frequently asked questions
- links to these docs and to support