CardFence

Settings reference

CardFence → Settings. Changes apply once you click Save changes in the bar at the bottom. Reset to recommended fills in the default values but leaves your keys and lists alone; it saves nothing until you click Save changes.

Protection

Setting Default What it does
Mode Protect Protect blocks card testing. Monitor only blocks nothing and logs what it would have blocked as Suspicious → Would block: …. Use it to try the plugin safely.
Client IP source Direct connection Where the buyer's real IP comes from. Choose Cloudflare, X-Forwarded-For or X-Real-IP only if your site is really behind that proxy. Cloudflare's header is only trusted on requests that arrive from Cloudflare's own addresses. For X-Forwarded-For the right-most address is used, because that's the one your proxy added.
Trust returning customers On Logged-in customers who have paid before are never limited or challenged.

Limits

Setting Default What it does
Checkout attempts per IP 8 per 10 min Then the IP is blocked for the rate-limit block time. Halved during attack mode. Form errors such as a missing address field don't count.
Rate-limit block 60 min How long an IP that hit the attempt limit stays blocked.
Failed payments per IP 5 per 60 min Declines from one IP before it is blocked.
Failed payments per email 5 (same window) Declines for one email address, from any IP, before it is blocked.
Failure block 12 hours How long an IP or email with too many declines stays blocked.

IPv6 addresses are counted and blocked per /64 network, the block a single customer line or attacker normally controls.

Attack mode

Setting Default What it does
Switch on automatically On Turns attack mode on when failed payments spike across the whole store.
Trigger 10 failures within 15 min The store-wide threshold. Raise it for very busy stores where 10 declines in 15 minutes is normal.
Stay on for 60 min Extended automatically while failures continue.
Pause failed-order emails On Holds WooCommerce's Failed order and Customer failed order emails during attack mode.
Email me when an attack starts On One email to the site admin address, at most every 6 hours.

Bot checks

Setting Default What it does
Browser check Log only Off: not checked. Log only: missing or invalid tokens are logged as Suspicious. During attacks: enforced while attack mode is on. Always: always enforced. While it's enforced, express buttons on product pages are refused.
Fastest human checkout 2 s An order submitted sooner than this after the page loaded counts as a bot (only when the browser check is enforced).
Cloudflare Turnstile challenge During attacks Off, During attacks or Every checkout. It has no effect until both keys are entered. If Cloudflare can't be reached, or the secret key is wrong, checkouts are allowed and the problem is logged. An outage never stops your sales.
Site key / Secret key empty From your Cloudflare dashboard → Turnstile → your widget.

Allow and block lists

One entry per line. These are permanent; for temporary blocks use the Blocks screen.

Setting Accepts
Never limit these IPs IPs (203.0.113.10) and CIDR ranges (198.51.100.0/24, 2001:db8::/32). Beats every other rule.
Always block these IPs IPs and CIDR ranges.
Always block these emails Full addresses, or @domain.com to block a domain and all its subdomains.
Also rate-limit these gateway endpoints wc-ajax action names. Defaults: ppc-create-order, ppc-approve-order (PayPal Payments). Add a gateway's own AJAX order endpoint here if it has one.

Invalid lines are dropped when you save.

Merchant tools (Pro)

On the free plan these are visible but locked. Saving on the free plan never erases them, so a renewed license brings your setup back.

Setting Default What it does
Clean up attack orders automatically Off Once a day, flagged attack orders over a day old are moved to the trash.
Weekly email report Off Every Monday at 08:00 (site time zone).
Cost per card-testing attempt 30 cents Your gateway fee per attempt, in cents of your store currency. Used for the "fees avoided" estimate.
Report recipients site admin One email per line.
Slack or webhook alerts empty A Slack incoming-webhook URL or any HTTPS endpoint that accepts JSON. Must be https://.
Also alert on every automatic block Off One message per blocked IP or email. All alerts are capped at 30 an hour.
Block disposable email addresses Off Refuses about 170 built-in throwaway domains (Mailinator, YOPmail, 10MinuteMail…) and their subdomains.
Also treat as disposable empty Extra domains, one per line.
Block checkouts from these countries empty Two-letter codes (NG, RU…), one per line. Unknown codes are dropped. See Pro for how the country is detected.

The Send a test report and Send a test alert buttons use the saved settings, so save first.

Data

Setting Default What it does
Keep activity for 30 days How long events are kept. Free: up to 30 days. Pro: up to 365. Older events are deleted once a day.