Estimated reading time: 6 minutes
One of my clients runs a lovely little handmade shop on WooCommerce. It’s not a big operation. It sells a few orders a week, mostly to regulars and people who’ve found her at local markets. It’s hardly the kind of place you’d expect criminals to target.
This week she sent me her failed orders. There were five in ten days, three of them in the last three days. Four had exactly the same order: two of her cheapest product, £10.50 with postage.
If you’ve looked after WooCommerce sites for any length of time, you’ll know what that means. Card testing bots had found her.
What is card testing?
Criminals buy stolen card details in bulk, and a lot of those cards are already cancelled or blocked. Before they use them for anything worth stealing, they need to know which ones still work.
So they run small purchases through real online shops. If the payment goes through, the card is live. If it’s declined, they move on to the next number. It’s all automated, and the bots pick the cheapest item they can find, because a small charge is less likely to catch anyone’s attention.
Small shops are ideal for this. They often have no bot protection at all, and nobody is watching the orders around the clock. A £3 product with a simple guest checkout is exactly what the bots are looking for.
Spotting the bots (and the real customer among them)
Once you know what to look for, the bot orders are easy to spot:
- Same product, same quantity, same total. Every one was 2 × the cheapest item, £10.50 with postage.
- Addresses that aren’t real. The house number and street were repeated in address line 2, and the same generic city-centre postcode turned up three times.
- Throwaway emails. They all followed the firstname.lastname plus a number pattern, at Yahoo or Outlook, with names that sounded like random picks from a list.
- A test message. One order had “hello world!” typed into both the company field and the order notes.
- Odd times of day. Several came in early in the morning, UK time.
The good news is that the payment gateway declined all of them, so no money went anywhere. That’s still no reason to relax. If testing keeps up, the payment provider can start to see the whole account as higher risk, and the attempts tend to increase once a shop is on a bot’s list.
The fifth order is where it got interesting. At first glance it looked suspicious too, because the email address was on an unusual overseas domain. But everything else looked like a real person. The address was genuine and matched its postcode, she’d bought a different product, and she’d typed her county and phone number the way people actually do. Her card had most likely been declined for an ordinary reason.
Sure enough, she was real. She came back the next day and placed an order successfully, paying with a different method. If I’d lumped her in with the bots and blocked her, that sale would have gone somewhere else. Not every failed order is a bot, and it’s worth checking before you block anything. Treat a real customer like a fraudster and you lose a sale, and probably a customer too.
The fix: Cloudflare Turnstile
I went with Cloudflare Turnstile on the checkout. It’s Cloudflare’s alternative to a CAPTCHA, and most genuine customers won’t even notice it. It checks the visitor in the background, and only shows a quick tick-box if something looks off. No picking out traffic lights.
You might be wondering why I didn’t use reCAPTCHA. I’ve been burned by it before. On another client’s shop, reCAPTCHA v3 was quietly blocking genuine orders, and it took some digging to work out why customers couldn’t check out. I’m not risking that again.
A few things I like about Turnstile:
- It’s free. The free plan gives you up to 20 widgets, each covering up to 10 domains, with no limit on checks.
- You don’t need to move your DNS. The site doesn’t have to run through Cloudflare. You just need a free account to create the keys.
- One lightweight plugin. I’m usually reluctant to add plugins, but this one earns its place. I used Simple Cloudflare Turnstile, which works with the classic WooCommerce checkout, including a checkout built with Elementor.
Setup takes about ten minutes. Create a widget in Cloudflare, paste the two keys into the plugin, and switch it on for the checkout only.
The one thing I’d really stress is testing every payment method afterwards. Express buttons like Apple Pay and Google Pay take a different route through the checkout and never go through the Turnstile check. This client has a lot of customers paying with Apple Pay, so I’m keeping a close eye on Apple Pay orders coming through.
What I didn’t do (yet)
There were a couple of bigger options I decided against for now:
- Moving the whole site behind Cloudflare. Switching the DNS to Cloudflare would stop bots before they ever reach WordPress. But the client’s email runs on the same domain, and one missed DNS record means her email stops working. That’s a lot of risk for five failed orders. I’ll keep it in reserve.
- Rate limiting. WooCommerce can limit how many checkout requests come in per second. That’s great against a flood of attempts, but it’s no use against a patient bot that tries once a day.
My approach is to start with the lightest fix that works, then watch what happens. If failed orders keep coming in with an order origin of “Unknown”, that suggests the bots are skipping the checkout page and going straight to WooCommerce’s checkout API. At that point I’d step things up.
If you run a small WooCommerce shop
- Look at your failed orders now and then. Watch for the same cheap item over and over, identical totals and fake-looking addresses.
- Check each one before blocking anything. Some of them will be real customers whose card was declined.
- Add bot protection to your checkout. Turnstile is free and doesn’t get in the way of real customers.
- Test every way people can pay after any change to your checkout, especially Apple Pay and Google Pay.
- Keep an eye on it for a couple of weeks, and only reach for the bigger fixes if you need them.
This has gone from an occasional nuisance to something I’m seeing across my clients’ sites, even the quiet ones. So I’m rolling Turnstile out to every shop I look after, and checking failed orders is now part of my monthly care routine.
If you’d like a hand protecting your own shop, get in touch.