Reading your checkout events after an attack
After a card-testing attack, your events export shows when it ran, which route it used, and whether real buyers got blocked. Here is how to read it.
Notes
What we find in real checkouts, and what a shop owner can check for themselves.
Guest checkout, account creation, and where bots slip through
Turning off guest checkout rarely stops card testing. It often hands bots an account and the add payment method page, which never shows in your orders.
What Cloudflare rules can and cannot do for a WooCommerce checkout
Cloudflare can drop crude checkout floods at the edge. It cannot see cart or gateway state, and a challenge on the checkout submit breaks real orders.
Stripe Radar and a checkout captcha do different jobs
Radar judges the card after your site sends it. A checkout captcha judges the request before anything reaches Stripe. You want both.
Run monitor mode for a week before you block anything
A new checkout rule is a guess about normal traffic. Monitor mode checks that guess against a week of real orders before it can turn a buyer away.
Who pays for declined authorizations during card testing
Card testing brings in no revenue, but it still costs you. Here is where the bill lands: gateway fees, disputes, and the health of your merchant account.
REMOTE_ADDR, X-Forwarded-For, and why an IP allowlist can be spoofed
X-Forwarded-For is a header the client writes. Here is why trusting it turns an IP allowlist or rate limit into a bypass, and how to fix it.
Why a low reCAPTCHA score is not proof of a bot
A low reCAPTCHA v3 score is doubt, not proof. Why real customers score low, and why checkout should fail open when Google is slow.
Duplicate checkout pages left behind by theme demos and staging copies
Theme demos, page builder tests, and staging pushes leave extra WooCommerce checkout pages that still take orders. How to find and remove them.
Add payment method: the card-testing route with no order at all
Bots can test stolen cards through the WooCommerce add payment method page and never create an order. How to spot it and close it.