What we find in real checkouts, and what a shop owner can check for themselves.
Google runs two products under the reCAPTCHA name, in two consoles, with two different verification APIs. Here is how to tell which one your keys belong to, and what follows from that.
A velocity check counts repeated events and reacts when a threshold trips. The interesting part is not the counting, it is choosing what counts as the same thing.
WooCommerce records where each order came from, but the browser collects that data and submits it with the order. What the fields are, and what an odd profile is actually worth.
Order notes need an order to exist. The attempts that never became one live in logs or nowhere, and logs only record what was running at the time.
A WordPress nonce is not used once. It is valid for a window, and a cached checkout page carries one minted for somebody else. Your own test order passes because you are signed in.
A BIN attack fixes one bank's card range and varies everything else. Here is what that leaves behind in your own order data, and what it does not.
Eight labels, and most shops use three. Failed is a decline rather than an abandonment, and draft exists only because of the block checkout.
One key is meant to be read by anyone, the other by nobody. Google's error codes say which half is wrong, so guessing is never necessary.
The Store API carries its own limiter, switched off out of the box. Turning it on takes one filter, and getting it right takes an accurate client address.
The decline reason your gateway gave is rarely on the order screen. It is in the notes panel beside it, written by machinery rather than by a person.
Pro waitlist
The free plugin stays free. Join the launch list for founding pricing on Pro and one email when it is ready. Nothing else.
Received
