Order notes need an order to exist. The attempts that never became one live in logs or nowhere, and logs only record what was running at the time.

A WordPress nonce is not used once. It is valid for a window, and a cached checkout page carries one minted for somebody else. Your own test order passes because you are signed in.

One key is meant to be read by anyone, the other by nobody. Google’s error codes say which half is wrong, so guessing is never necessary.

The decline reason your gateway gave is rarely on the order screen. It is in the notes panel beside it, written by machinery rather than by a person.

WooCommerce reads the shopper’s address from a forwarded header. Behind a proxy that is either the proxy itself or a value the client chose, and both break rules.

Google gives a token two minutes and one verification. A checkout that takes longer than that fails honest shoppers, and the error code says so.