If your Orders screen just filled with dozens of failed orders in a few minutes, small amounts, names you have never seen, and payment attempts firing faster than any human could type, you are probably not looking at bad luck. You are looking at a card testing attack. Here is how to tell it apart from ordinary declines, how to stop the bleeding today, and how to clear the wreckage it leaves in your dashboard.
Ordinary declines are quiet and slow. A regular customer mistypes a card, or hits their limit, and you get one failed order every so often, spread across the day, with a real name and a normal cart total. Card testing looks nothing like that once you know the shape of it.
The tell is volume and pattern together. You will see a burst of failed orders stacked within the same minute or two, sometimes many per minute, far more than your store ever produces on its own. The amounts are small or strange: a run of identical low totals, or odd figures that do not match anything you actually sell, because the attacker only cares whether the charge clears, not what it buys. The names and email addresses are strangers, often gibberish or slight variations on the same string, and the order attribution reads Unknown because these requests never came from a real browsing session. You will often notice a lot of Discover cards, or foreign-issued cards, clustered in a way your normal customers never produce.
Put simply, ordinary declines are your regulars having a bad moment. Card testing is a crowd of strangers hammering the same door in seconds. If you sort your failed orders by time and see them arriving in tight clusters from people you do not recognize, that is the signature, and it is worth acting on the same day.
None of this is personal, and it is not a sign your store is insecure. Attackers buy long lists of stolen card numbers that may or may not still be live, and they need somewhere cheap and automatic to check which ones work. Any WooCommerce checkout with a working payment gateway is a perfect test bench: it takes a card, tries a charge, and tells the bot instantly whether it succeeded or failed. Your store becomes the machine they use to validate someone else's stolen cards.
The reason it matters, beyond the clutter, is that you pay for their testing. Many gateways charge a fee per authorization attempt whether it clears or not, so a thousand attempts can quietly run up a bill. The cards that do clear may later turn into chargebacks when the real cardholder disputes them, and each chargeback carries its own fee. And a flood of failures and disputes damages your standing with the gateway, which can lead to holds or a closed account. The bots move on either way. You are left with the fees, the chargebacks, and the reputation hit.
Work these in order. The first two do the most and cost you the least, so start there and only go further if the attack keeps coming.
Once the attack is throttled, you are left with a dashboard full of failed orders that will never be paid. Do not delete them one at a time. Select them in bulk from the Orders screen and move them to the trash, which keeps them recoverable in case a real failure got swept up by mistake. If hundreds arrived, a scheduled cleanup that trashes stale unpaid failures on its own is far less painful than clicking through pages of them.
We packaged exactly that into a tiny free plugin: download Quiet Failed Orders, upload it under Plugins, Add New, Upload Plugin, and it mutes the per-failure emails and trashes old unpaid failures on a schedule with a recovery window built in. For the full walkthrough, including a copy-paste snippet if you would rather not add a plugin, read the failed orders cleanup guide. Cleanup is tidiness, though, not defense. It clears what the attack left behind and does nothing about the attack itself, so do the steps above first.
Card testing tends to repeat. The same lists get resold, and a store that answered cleanly once often gets probed again weeks later. Your best protection is not staring at the Orders screen all day, it is knowing your normal failure rate so a spike stands out. A handful of failures a day is baseline for most stores. Twenty in a single minute is not, and that gap is exactly what early detection watches for.
Set yourself up to catch the failure-rate spike rather than the individual failure. A jump well above your usual daily rate, arriving in a tight cluster, is the earliest reliable sign the bots are back, often before the fees show up on your statement. The failed payment alerts guide covers how to get told the moment failures surge, from a Gmail filter to an outside watcher, so the next attempt reaches you in minutes instead of on next month's bill.
Want to know your checkout is loading right now? Run the free checkout checker, no signup. And if you'd like failed payments and stopped orders to reach you within minutes without any setup on your side, Store Guardian is free while it's in beta.
WooCommerce orders suddenly stopped? Work through these 7 checks
WooCommerce checkout not working: find the cause in 15 minutes
How to get alerted the minute a WooCommerce payment fails
Stop failed WooCommerce orders from cluttering your dashboard