Duplicate and rogue WooCommerce checkout pages: how they happen and how to find them
WooCommerce treats one page as the checkout. Any other page carrying the form can still place orders, and a captcha wired to the assigned page never sees them.
Notes
What we find in real checkouts, and what a shop owner can check for themselves.
How to choose a reCAPTCHA v3 score threshold for your checkout
Google says the score is a risk signal, not a verdict. Here is how to read reCAPTCHA v3 scores on your own traffic and pick a threshold that does not cost you real orders.
How to tell if your store is actually being card tested
Bursts of small failed authorisations, repeated addresses and throwaway emails look nothing like ordinary declines. Here is how to tell them apart with evidence you already have.
WooCommerce captcha not stopping failed orders? Check the Store API path
A captcha on the checkout page only covers the request it is wired to. The block checkout places orders through the Store API, where classic checkout hooks never fire.