Guest checkout, account creation, and where bots slip through

During a card-testing attack, someone usually suggests turning off guest checkout. The idea is simple. If every buyer needs an account, bots have to make one first, and that should slow them down.

Sometimes it helps. Often it just moves the attack. The way WooCommerce handles accounts opens a few doors that a guest-only checkout does not have, and one of them is a favorite with card testers.

The settings involved

WooCommerce keeps these options under WooCommerce, Settings, Accounts & Privacy. The labels shift a little between versions, but the choices are the same:

• Whether customers can place orders without an account (guest checkout).
• Whether customers can create an account during checkout.
• Whether customers can create an account on the My Account page.
• Whether WooCommerce generates the username and password for new accounts, or asks the shopper to choose.

Each one is a separate route into your store. Changing one does not close the others.

What turning off guest checkout actually does

With guest checkout off and account creation at checkout on, a bot fills in an email and password on the checkout form, and WooCommerce creates the account and the order in the same request. The bot did not have to do anything new. You gained one more user row per attempt.

With guest checkout off and account creation only on the My Account page, the bot posts the registration form first, then uses the logged-in session to check out. That is one extra request. Scripts handle it without trouble.

Either way, you now have to clean up hundreds of fake customer accounts after the attack, on top of the failed orders.

The route nobody watches: add payment method

Logged-in customers can save a card from the Payment methods section of My Account. Gateways that support saved cards, Stripe among them, check the card with the issuer when it is saved. That check does not create an order.

This is why card testers like it. They register an account, open the add payment method page, and submit card after card. Each one gets checked by the issuer, and none of them shows up in your WooCommerce order list. You may only notice from the gateway dashboard, a spike in new user registrations, or a warning email from your provider.

Forcing account creation makes this route easier to reach, not harder. Every bot that registers to buy can also save cards.

Where else accounts help bots

• Pay-for-order links. An order with a pay link can be paid again and again if the payment keeps failing. Some stores require login for this page, some do not.
• Saved cards at checkout. Once a card is saved, a logged-in bot can test with it from the checkout page, and some security tools skip extra checks for logged-in users.
• Staff bypass rules. A rule that trusts any logged-in user, instead of only staff roles, trusts every bot that registered a minute ago.

What to do instead

1. Leave guest checkout on unless you have a business reason to require accounts. It keeps the user table clean and removes a reason for bots to register.
2. If you require accounts, turn off registration on the My Account page and let accounts be created only at checkout, so there is one route to protect instead of two.
3. Protect the registration form with a bot check, the same way you protect checkout.
4. Protect the add payment method page. If your customers rarely save cards outside checkout, consider disabling that page entirely.
5. Make sure any bypass for logged-in users checks for a staff role, not just a session.
6. After an attack, look for user accounts created in the attack window with no paid orders, and remove them.

Finding fake accounts after the fact

In the Users screen, sort by registration date and look at the attack window. Bot accounts often share a pattern: random strings for names, disposable or nonsense email domains, and registrations seconds apart.

Check the gateway too. If the gateway shows card verification attempts with no matching order, the add payment method page is the likely route. Your gateway may show these as setup attempts or card verifications instead of charges.

Delete fake accounts in batches after you confirm they have no real orders. If a real customer was caught in the same filter, their order history will show it.

How Checkout Bouncer covers these routes

Checkout Bouncer puts a reCAPTCHA v3 check on the add payment method page and pay-for-order, not only on checkout. Each route gets its own Protect or Block setting, and the Checkout Scanner finds stray duplicate checkout pages you may have forgotten.