“How do I stop fake orders and card testing in WooCommerce?”

How do I stop fake orders and card testing in WooCommerce?

Updated October 18, 2026By the CaptchaKit team

Short answer

Turn on layers, not one tool. WooCommerce ships Store API rate limiting that is optional and off by default; when enabled it allows a maximum of 3 requests per 60 seconds on checkout POST requests and the Place Order flow. Add your payment gateway's fraud tools, watch for spikes in failed payments, and put a CAPTCHA on checkout and login. CaptchaKit's WordPress plugin covers WooCommerce checkout, classic and Blocks. A CAPTCHA alone will not stop bots that call the Store API directly.

What card testing looks like

Card testing is a script validating stolen card numbers against your checkout: many small attempts, often on cheap or digital products, and the ones that pass get used somewhere bigger. You see it as a burst of failed payments, gateway fees for declines, and occasional chargebacks. Fake orders without payment, from bots probing the checkout form, usually ride the same scripted path: the Store API endpoint that powers the checkout block.

Both patterns matter because WooCommerce checkout is an API, not just a form. Anything that only guards the visible form leaves the API path open.

WooCommerce rate limiting, off by default

WooCommerce documents rate limiting for Store API endpoints as an optional feature that is disabled by default. You enable it in the admin under WooCommerce, Settings, Advanced, Features, with the setting named Rate limiting Checkout block and Store API. When enabled, checkout allows a maximum of 3 requests per 60 seconds for POST requests to the /checkout endpoint and the Place Order flow. The default for Store API endpoints is a maximum of 25 requests per 10-second window.

Those limits are a direct brake on scripted checkout traffic, and they cost nothing to switch on. They are the first thing to check.

Where a CAPTCHA fits

A CAPTCHA adds a challenge a plain script cannot pass, at the point the order is placed. CaptchaKit's WordPress plugin covers login, registration, comments and WooCommerce checkout, both the classic shortcode checkout and the checkout block, configurable from Settings, CaptchaKit. The plugin runs the server-side token verification for you.

Put the challenge where the abuse enters: checkout and the login form in front of it. For login-only abuse, see how to replace reCAPTCHA on WordPress.

What else helps

Your payment gateway's own fraud tools, such as card verification and velocity rules, catch the payment side. Watch your reports for bursts of declines from one IP range, and keep failed payment logs long enough to spot a test run. If fake accounts precede the orders, close that door too: see stop fake user registrations in WordPress.

Layered defenses work because each one raises the attacker's cost. No single layer, CAPTCHA included, claims to stop everything, which is the honest framing in are game CAPTCHAs secure.

Questions

Does WooCommerce include rate limiting?

Yes, for Store API endpoints. It is optional and disabled by default.

Where do I enable it?

WooCommerce, Settings, Advanced, Features, then the setting named Rate limiting Checkout block and Store API.

What are the default limits?

With it on, checkout allows up to 3 requests per 60 seconds for POST requests and the Place Order flow; Store API defaults to 25 requests per 10-second window.

Will a CAPTCHA stop card testing?

It stops scripted submissions of the checkout form. Bots that call the Store API directly need the rate limiting and gateway rules too.

Does CaptchaKit cover the WooCommerce Blocks checkout?

Yes. The plugin covers WooCommerce checkout in both the classic and Blocks versions.

What about fake registrations?

The plugin covers registration forms as well. See stop fake registrations.