CardFence

Getting started

CardFence works as soon as it's activated. The four steps below take about two minutes and make sure it's tuned to your site.

1. Install and activate

  1. In WordPress, go to Plugins → Add New, search for CardFence, then click Install and Activate. If you have the zip file, upload it under Plugins → Add New → Upload Plugin instead.
  2. WooCommerce must be active. CardFence shows a notice and does nothing until it is.
  3. You land on the CardFence → Dashboard screen. The hero should say Your checkout is protected.

At this point every payment route is already rate-limited and watched. The default limits are set far above anything a real buyer does:

  • 8 checkout attempts per IP per 10 minutes
  • 5 declined payments per IP or email per hour

2. Check your client IP source (important behind a proxy)

CardFence limits and blocks by the buyer's IP address. If your site sits behind Cloudflare, a load balancer or a host's reverse proxy, every request can look like it comes from the proxy. Then all your buyers would share one limit.

  1. Go to CardFence → Settings → Protection.
  2. Under Client IP source, the description shows Your IP as CardFence sees it right now. Compare it with your real IP (search "what is my IP").
  3. If they differ, choose the matching source:
    • Cloudflare: your domain's DNS is proxied through Cloudflare (orange cloud). Only requests that really come from Cloudflare's addresses are trusted.
    • Reverse proxy / load balancer (X-Forwarded-For): managed hosts and load balancers.
    • Reverse proxy (X-Real-IP): some Nginx setups.
  4. Click Save changes and check that the IP shown now matches yours.

Only choose a proxy header if your site really is behind that proxy. Otherwise attackers can send a fake header and pretend to be anyone.

If CardFence sees proxy headers while the source is still Direct connection, it warns you on the Settings screen and once on the Plugins screen.

Cloudflare Turnstile is a free, privacy-friendly "are you human?" check. It works on any site, and you don't need to host with Cloudflare. CardFence only shows it while an attack is running, so normal shoppers never see it.

  1. Sign in to (or create) a free Cloudflare account and open Turnstile.
  2. Click Add widget, enter your site's domain and choose the Managed widget mode.
  3. Copy the Site key and Secret key.
  4. In CardFence → Settings → Bot checks, paste both keys. Leave Cloudflare Turnstile challenge on During attacks, then click Save changes.

4. Allow-list yourself (optional)

Store managers who are logged in are never limited, so you can test your own checkout. If you test while logged out, or another system places orders for you, add those IPs under Settings → Allow and block lists → Never limit these IPs.

Try it safely first: Monitor mode

If you'd rather see the effect before anything is blocked:

  1. Set Settings → Protection → Mode to Monitor only.
  2. Leave it for a few days and review the Activity screen. Anything that would have been blocked shows as Suspicious with the reason Would block: ….
  3. Switch back to Protect when you're happy.

What next