The pay-for-order page is a checkout too
Bots test cards on the WooCommerce pay-for-order page by retrying a failed order. Here is how it works and how to protect or close it.
Notes
What we find in real checkouts, and what a shop owner can check for themselves.
Choosing a reCAPTCHA v3 score threshold for checkout
What a reCAPTCHA v3 score of 0.5 or 0.7 means at checkout, and how to pick a threshold from your own store data instead of a forum post.
The Store API checkout route, and why a bot does not need your checkout page
Bots can place WooCommerce orders through the Store API checkout route without ever loading your checkout page. Here is how, and what protects it.
The first hour of a card-testing attack, in order
What to do in the first hour of a card-testing attack on WooCommerce, step by step, from confirming it to talking to your gateway.
reCAPTCHA classic and reCAPTCHA Enterprise: which one your keys are for
Google runs two products under the reCAPTCHA name, in two consoles, with two different verification APIs. Here is how to tell which one your keys belong to, and what follows from that.
Velocity checks, and choosing what to count
A velocity check counts repeated events and reacts when a threshold trips. The interesting part is not the counting, it is choosing what counts as the same thing.
WooCommerce order attribution: what it records, and what it proves
WooCommerce records where each order came from, but the browser collects that data and submits it with the order. What the fields are, and what an odd profile is actually worth.
Your logs cannot reach backwards
Order notes need an order to exist. The attempts that never became one live in logs or nowhere, and logs only record what was running at the time.
Why the WooCommerce checkout nonce fails on a cached page
A WordPress nonce is not used once. It is valid for a window, and a cached checkout page carries one minted for somebody else. Your own test order passes because you are signed in.
What a BIN attack looks like in a WooCommerce order list
A BIN attack fixes one bank's card range and varies everything else. Here is what that leaves behind in your own order data, and what it does not.