Where the classic WooCommerce checkout actually submits
The form is on the checkout page. The request that places the order is not, and anything wired to the page template never sees it.
Notes
What we find in real checkouts, and what a shop owner can check for themselves.
Block checkout submits somewhere else: the Store API route
The Checkout block posts JSON to a REST route. Code hooked to the classic checkout is never asked, which is why protection can look healthy and do nothing.
The pay for order page: a second way to take a card
WooCommerce ships a second payment surface for orders that already exist. It calls your gateway directly, and none of your checkout validation runs there.
The IP address on your WooCommerce order may not be the customer’s
WooCommerce reads the shopper's address from a forwarded header. Behind a proxy that is either the proxy itself or a value the client chose, and both break rules.
Why your checkout captcha turns away real customers
Google gives a token two minutes and one verification. A checkout that takes longer than that fails honest shoppers, and the error code says so.
What a wall of failed WooCommerce orders is really telling you
Failed orders are declines, not abandoned baskets. And the row count is not the attempt count, because WooCommerce reuses an order when the basket has not changed.
Duplicate and rogue WooCommerce checkout pages: how they happen and how to find them
WooCommerce treats one page as the checkout. Any other page carrying the form can still place orders, and a captcha wired to the assigned page never sees them.
How to choose a reCAPTCHA v3 score threshold for your checkout
Google says the score is a risk signal, not a verdict. Here is how to read reCAPTCHA v3 scores on your own traffic and pick a threshold that does not cost you real orders.
How to tell if your store is actually being card tested
Bursts of small failed authorisations, repeated addresses and throwaway emails look nothing like ordinary declines. Here is how to tell them apart with evidence you already have.
WooCommerce captcha not stopping failed orders? Check the Store API path
A captcha on the checkout page only covers the request it is wired to. The block checkout places orders through the Store API, where classic checkout hooks never fire.