What each WooCommerce order status actually claims
Eight labels, and most shops use three. Failed is a decline rather than an abandonment, and draft exists only because of the block checkout.
Notes
What we find in real checkouts, and what a shop owner can check for themselves.
Two reCAPTCHA keys, and what breaks when they swap places
One key is meant to be read by anyone, the other by nobody. Google's error codes say which half is wrong, so guessing is never necessary.
WooCommerce already ships a checkout limiter, and it is off
The Store API carries its own limiter, switched off out of the box. Turning it on takes one filter, and getting it right takes an accurate client address.
What your gateway tells you in the order notes panel
The decline reason your gateway gave is rarely on the order screen. It is in the notes panel beside it, written by machinery rather than by a person.
Where the classic WooCommerce checkout actually submits
The form is on the checkout page. The request that places the order is not, and anything wired to the page template never sees it.
Block checkout submits somewhere else: the Store API route
The Checkout block posts JSON to a REST route. Code hooked to the classic checkout is never asked, which is why protection can look healthy and do nothing.
The pay for order page: a second way to take a card
WooCommerce ships a second payment surface for orders that already exist. It calls your gateway directly, and none of your checkout validation runs there.
The IP address on your WooCommerce order may not be the customer’s
WooCommerce reads the shopper's address from a forwarded header. Behind a proxy that is either the proxy itself or a value the client chose, and both break rules.
Why your checkout captcha turns away real customers
Google gives a token two minutes and one verification. A checkout that takes longer than that fails honest shoppers, and the error code says so.
What a wall of failed WooCommerce orders is really telling you
Failed orders are declines, not abandoned baskets. And the row count is not the attempt count, because WooCommerce reuses an order when the basket has not changed.