How to Stop WooCommerce Credit Card Testing Attacks

If your WooCommerce store is suddenly receiving a large number of failed orders or suspicious checkout attempts, your website may be the target of an automated card-testing attack.

As part of my SEO consulting services for Australian businesses, I recently helped several online WooCommerce stores stop these card testing attacks with two different methods.

The primary method involves creating a Cloudflare firewall rule that blocks suspicious requests to WooCommerce’s products API endpoint while allowing genuine customers to continue browsing and purchasing as normal.

If you don’t use Cloudflare, I have an alternative solution below ↓ using the WordPress functions.php file instead.

Cloudflare Firewall Rule

(http.request.method eq "GET" and http.request.uri.path eq "/wp-json/wc/store/products" and http.request.uri.query contains "stock_status=" and not http.referer contains "YOUR-DOMAIN")

Replace `YOUR-DOMAIN` with your website address.

This rule blocks suspicious requests to WooCommerce’s products API that are commonly used by bots carrying out card-testing attacks. In my experience, it has stopped the vast majority of fraudulent checkout attempts without affecting legitimate customers.

What Is Happening Behind the Scenes?

Over recent months, I have seen an increase in automated card testing attacks targeting WooCommerce stores.

These bots typically:

• Scrape the WooCommerce products endpoint: `/wp-json/wc/store/products`
• Use rotating IP addresses to avoid detection
• Send requests without a valid referrer header
• Attempt to automate the checkout process
• Test stolen or fraudulent card details

Because the attacks come from thousands of different IP addresses, blocking individual countries or addresses is often ineffective.

How the Firewall Rule Works

The Cloudflare rule blocks requests that:

• Use the `GET` method.
• Target WooCommerce’s product API endpoint.
• Query product stock information.
• Do not originate from your website.

By cutting off this traffic before the bots can interact with your store, the rule prevents many automated attacks from progressing any further.

Why This Matters

Card-testing attacks are a nuisance. They can:

• Flood your dashboard with failed orders.
• Trigger fraud warnings from payment providers.
• Increase the risk of disputes and chargebacks.
• Consume server resources and slow down your website.
• Create unnecessary administration and support work.

Adding targeted firewall rules can provide an extra layer of protection and significantly reduce malicious activity.

Not Using Cloudflare? Try Blocking the Checkout API in WordPress

If you are not using Cloudflare, another option is to disable direct access to WooCommerce’s checkout API endpoints within WordPress itself.

The following code can be added to your theme’s `functions.php` file or a custom plugin. It checks whether someone is attempting to access the WooCommerce checkout API and returns a 404 response instead.

Block the WooCommerce v1 Checkout Endpoint

 /** * Block direct access to the WooCommerce Store API checkout endpoint. * Intended to help reduce automated card-testing attacks. */ function mswd_block_wc_store_v1_checkout() { $request_uri = isset($_SERVER['REQUEST_URI']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'])) : ''; if (strpos($request_uri, '/wp-json/wc/store/v1/checkout') !== false) { status_header(404); nocache_headers(); exit; } } add_action('rest_api_init', 'mswd_block_wc_store_v1_checkout'); 

Block the WooCommerce Checkout Endpoint Without `/v1/`

If your logs show requests targeting the endpoint without `/v1/`, use this version instead, or run it alongside the first snippet.

 /** * Block direct access to the WooCommerce Store API checkout endpoint. * Intended to help reduce automated card-testing attacks. */ function mswd_block_wc_store_checkout() { $request_uri = isset($_SERVER['REQUEST_URI']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'])) : ''; if (strpos($request_uri, '/wp-json/wc/store/checkout') !== false) { status_header(404); nocache_headers(); exit; } } add_action('rest_api_init', 'mswd_block_wc_store_checkout'); 

A Few Important Notes

I have tested this approach on several WooCommerce websites and, in those cases, it successfully stopped fraudulent orders. However, it should only be used if your website does not rely on the WooCommerce API for legitimate checkout functionality.

Some themes, mobile apps, headless websites and third-party integrations use these endpoints to process orders. Before implementing either snippet, make sure your store does not depend on API-based checkout requests.

Prevention is Easier Than Dealing With Card Testing Bots

If you run a WooCommerce store, it is worth reviewing your security setup and Cloudflare configuration. Card-testing attacks are becoming increasingly common, and prevention is always easier than dealing with the consequences.

The Cloudflare rule has proven extremely effective in my own testing, but every WooCommerce store is different. Depending on your payment gateway, plugins and checkout setup, you may need to adjust the rule to suit your website.

If you need help securing your WooCommerce store or configuring Cloudflare, feel free to get in touch.