FAQ and troubleshooting

Frequently asked questions

Will this block real customers?

Not with the default settings. They allow 8 checkout attempts per 10 minutes and 5 declined payments per hour from one IP before a temporary block, far more than a human ever needs. Form mistakes such as a missing address field don't count as attempts. Store managers, allow-listed IPs and customers who have paid before are never limited. To be sure, run in Monitor only mode for a few days first.

Do I need Cloudflare?

No. Everything works without it. Cloudflare Turnstile is an optional, free challenge that works on any site, whoever hosts it.

Do Apple Pay and Google Pay still work?

Yes. Express buttons are rate-limited like any checkout. Only while the browser check or Turnstile is enforced are express buttons on product pages refused, because they can't carry a challenge. With the recommended settings that happens during an attack only. Buttons on the cart and checkout pages keep working.

Which payment gateways are supported?

All of them, as long as they take payment through WooCommerce's checkout: Stripe, WooPayments, PayPal Payments, Square, Authorize.net, Mollie and others. Some gateways also expose their own AJAX order endpoints. PayPal Payments' are covered by default; add others under Settings → Allow and block lists → Also rate-limit these gateway endpoints.

Does it conflict with other plugins?

Each release is tested next to 20 popular plugins, with no conflicts found:

• Gateways: Stripe, PayPal Payments.
• Checkout builders and field editors: CartFlows, FunnelKit, Checkout Field Editor, Flexible Checkout Fields.
• Security: Wordfence, Solid Security, All-In-One Security, Shield Security, Simple Cloudflare Turnstile.
• Caching and optimization: Autoptimize with JavaScript combining and deferring on, WP-Optimize, W3 Total Cache, WP Super Cache, LiteSpeed Cache.
• Others: Yoast SEO, Elementor, MailPoet, WooCommerce Shipping & Tax.

It also runs on every combination of PHP 7.4–8.5, WordPress 6.4–7.1 and WooCommerce 8.6–11.2, with both order-storage types.

Does it work with the block checkout and with HPOS?

Yes. Both are fully supported and tested, along with the classic checkout and legacy order storage.

Does it replace my gateway's fraud tools (Stripe Radar etc.)?

No, it complements them. Radar scores payments that reach Stripe. CardFence stops bots before they reach Stripe, saving the fees, failed orders and account risk. Use both.

Does it slow down my store or hurt my PageSpeed score?

No. Measured on a clean store with the plugin on and off (median of 25 requests per page, and Lighthouse mobile runs):

Cloudflare's Turnstile script (third-party, about 100 KB) only loads on checkout pages while the challenge is active: during attack mode by default, never if you haven't set it up.

Can CardFence crash my site?

It's built not to. Every piece of CardFence that runs on your store is wrapped in an error guard. If anything goes wrong inside it (a bug, or a conflict with another plugin):

• the page loads normally and the checkout fails open: the order goes through as if CardFence weren't there, so you never lose a sale;
• the error is written to your PHP error log;
• store managers see one notice in wp-admin with the details to send to support.

The same applies to its admin screens, its licensing (Freemius) and its checkout script. Each release is tested by deliberately injecting errors into its checkout and page code. The only failures no plugin can catch are PHP-level ones such as the server running out of memory.

Will it work with page caching?

Yes. WooCommerce already excludes cart and checkout pages from caching, and those are the only pages where CardFence adds anything.

What happens if I uninstall it?

Deleting the plugin removes both of its database tables, its settings, its scheduled tasks and the flags it added to orders. Orders themselves are never deleted. Deactivating keeps everything, in case you reactivate.

Troubleshooting

Every buyer is being blocked or rate-limited together

Your site is behind a proxy or CDN and Client IP source is set to Direct connection, so every buyer looks like the same IP: the proxy's.

1. Settings → Protection → Client IP source: choose the matching proxy (see Getting started).
2. Blocks → Remove all, to lift the blocks that hit real buyers.

A customer says checkout refused them

1. Open Activity and look for their email or IP. The Details column says why.
2. Still blocked / Too many…: unblock them on the Blocks screen.
3. On your block list: remove them from Settings → Allow and block lists.
4. If they keep running into a rule, add their IP to Never limit these IPs.

The message buyers see is deliberately generic, so it never tells a bot which rule it hit.

Attack mode keeps switching on, but there's no attack

The store-wide trigger (10 failures in 15 minutes by default) is too low for your volume, or a gateway problem is failing real payments. Check Activity → Payment failed:

• Real customers' declines with a gateway error: fix the gateway; CardFence is reporting a real problem.
• Normal volume for your store: raise Settings → Attack mode → Trigger.

The Turnstile widget doesn't appear

• Both keys must be entered under Settings → Bot checks.
• With During attacks, it only appears while attack mode is on. Switch attack mode on from the dashboard to test.
• The widget's domain list in Cloudflare must include your site's domain.

Activity shows "Cloudflare unreachable, allowed"

Your server couldn't reach Cloudflare, or the secret key is wrong. Checkouts were let through so you didn't lose sales. Check the secret key, and that your host allows outgoing HTTPS requests.

Lots of "No browser token" entries

This is normal at a low level: express buttons on product pages and some headless or app checkouts don't load your checkout page. In bulk from a few IPs it's a strong bot signal. Consider setting Browser check to During attacks (the default is Log only).

I don't get the attack email or the weekly report

Check that WordPress can send email at all, for example with a password reset. Many hosts need an SMTP plugin. The attack email is sent at most once every 6 hours.

Pro features are still locked after buying

Install the Pro zip from your purchase email, not the free version, and activate your license when asked. The badge next to CardFence in the header must say PRO. See Licensing.

Still stuck?

Contact support via warcal.dev/contact. Include:

• your WordPress, WooCommerce and PHP versions;
• your payment gateway;
• a screenshot of the relevant Activity rows.

Pro customers get priority support.