Pro features and licensing

Every layer of protection is free. CardFence Pro adds the tools a busy store needs once the bots have been stopped.

Fake-order clean-up

An attack can leave hundreds of failed and pending orders that clutter WooCommerce → Orders and your reports.

Which orders. CardFence flags an order as a card-testing attempt when its payment failed during attack mode, or from an IP or email that was then blocked for it. The flag adds an order note. An order is cleaned up only if all of these are true:

• it is flagged;
• its status is still Failed or Pending payment;
• it was never paid;
• it was placed through the checkout (block or classic), not created by staff;
• it is at least one hour old (a day old for the automatic run).

A real customer's one-off decline is never flagged, so it's never cleaned up.

How:

• By hand: a bar on the dashboard shows how many attack orders are waiting. Click Clean up attack orders.
• Automatically: switch on Settings → Merchant tools → Clean up attack orders automatically. It runs once a day.

Orders are moved to the trash, not deleted. Restore any of them from WooCommerce → Orders → Trash.

Weekly report

Every Monday at 08:00 (your site's time zone), the report goes to the recipients you set, or the site admin. It covers the last 7 days:

• attempts blocked
• estimated gateway fees avoided: blocked attempts × your Cost per card-testing attempt
• failed payments
• IPs and emails blocked
• how many times attack mode switched on
• the most-blocked IPs

Use Send a test report in Settings to see one straight away. A report is never sent twice in the same week.

Slack and webhook alerts

Paste a URL into Slack or webhook alerts:

• Slack: create an Incoming Webhook in your Slack workspace and paste its https://hooks.slack.com/… URL. Messages arrive as text with a link to the dashboard.
• Anything else (Zapier, Make, n8n, your own service): any https:// endpoint receives JSON:

{
  "event": "attack_started",
  "message": "Card-testing attack detected on My Store. CardFence switched attack mode on for 60 minutes.",
  "site": "My Store",
  "site_url": "https://example.com/",
  "dashboard": "https://example.com/wp-admin/admin.php?page=cardfence-for-woocommerce",
  "time": "2026-10-14T09:30:00+00:00",
  "data": { "source": "auto", "minutes": 60 }
}

Events:

• attack_started, always sent;
• auto_blocked, only with Also alert on every automatic block. Its data holds kind (ip/email), value, reason (rate_limit/failures) and minutes;
• test, from the Send a test alert button.

Alerts are sent in the background, so a slow endpoint never slows your checkout. They're capped at 30 an hour.

Disposable-email rule

Refuses checkouts that use a throwaway inbox. About 170 well-known disposable domains are built in, and their subdomains count too. Add more under Also treat as disposable. Developers can change the list with the cksh_disposable_domains filter.

Country rules

Refuses checkouts from the countries you list (two-letter codes). The country is worked out without calling any outside service:

1. If Client IP source is Cloudflare and the request really comes from Cloudflare, its CF-IPCountry header is used. Turn on IP Geolocation in Cloudflare.
2. Otherwise WooCommerce's own geolocation database is used. Set it up under WooCommerce → Settings → Integration → MaxMind Geolocation with a free MaxMind license key.

If the country can't be determined, the checkout is allowed. A missing database never blocks sales.

History and CSV export

Pro keeps up to 365 days of activity (set it under Settings → Data); the free plan keeps 7. Activity → Export CSV downloads the whole log, or the filtered type, as a spreadsheet-safe CSV.

Licensing

CardFence is sold and licensed through Freemius.

• Buy, or start the 14-day free trial (no card needed): from CardFence → Go Pro, or the Go Pro link on the Plugins screen.
• Activate: after purchase, install the Pro zip from your Freemius email or account and enter your license key when asked. The header badge changes from FREE to PRO and the merchant tools unlock.
• If a license lapses: protection keeps working, because it's all free. Pro tools lock again, but your Pro settings are kept, so renewing restores them exactly.
• Manage licenses, sites and invoices: in your Freemius customer account, or from Account in the plugin menu once the Freemius SDK is active.