WooCommerce card testing attack: stop it and clean up

If your Orders screen just filled with dozens of failed orders in a few minutes, small amounts, names you have never seen, and payment attempts firing faster than any human could type, you are probably not looking at bad luck. You are looking at a card testing attack. Here is how to tell it apart from ordinary declines, how to stop the bleeding today, and how to clear the wreckage it leaves in your dashboard.

How to recognize it

Ordinary declines are quiet and slow. A regular customer mistypes a card, or hits their limit, and you get one failed order every so often, spread across the day, with a real name and a normal cart total. Card testing looks nothing like that once you know the shape of it.

The tell is volume and pattern together. You will see a burst of failed orders stacked within the same minute or two, sometimes many per minute, far more than your store ever produces on its own. The amounts are small or strange: a run of identical low totals, or odd figures that do not match anything you actually sell, because the attacker only cares whether the charge clears, not what it buys. The names and email addresses are strangers, often gibberish or slight variations on the same string, and the order attribution reads Unknown because these requests never came from a real browsing session. You will often notice a lot of Discover cards, or foreign-issued cards, clustered in a way your normal customers never produce.

Put simply, ordinary declines are your regulars having a bad moment. Card testing is a crowd of strangers hammering the same door in seconds. If you sort your failed orders by time and see them arriving in tight clusters from people you do not recognize, that is the signature, and it is worth acting on the same day.

Why stores get hit

None of this is personal, and it is not a sign your store is insecure. Attackers buy long lists of stolen card numbers that may or may not still be live, and they need somewhere cheap and automatic to check which ones work. Any WooCommerce checkout with a working payment gateway is a perfect test bench: it takes a card, tries a charge, and tells the bot instantly whether it succeeded or failed. Your store becomes the machine they use to validate someone else's stolen cards.

The reason it matters, beyond the clutter, is that you pay for their testing. Many gateways charge a fee per authorization attempt whether it clears or not, so a thousand attempts can quietly run up a bill. The cards that do clear may later turn into chargebacks when the real cardholder disputes them, and each chargeback carries its own fee. And a flood of failures and disputes damages your standing with the gateway, which can lead to holds or a closed account. The bots move on either way. You are left with the fees, the chargebacks, and the reputation hit.

Stop the bleeding now

Work these in order. The first two do the most and cost you the least, so start there and only go further if the attack keeps coming.

  1. Turn on your gateway's fraud filters. This is the single highest-value step, because it stops the attack where the charge actually happens. In your processor account, set address and card-code checks to hard-decline: an AVS mismatch or a bad CVV should fail the transaction outright rather than let it through. In Authorize.net this lives in the Advanced Fraud Detection Suite (AFDS), where you can reject on AVS and CVV failures and throttle repeated attempts from one source. In Stripe, use Radar rules to block on CVC or postal-code failure and to rate-limit repeated attempts. Card testing leans on guessing, so failing every card that cannot pass these basic checks kills most of the traffic immediately.
  2. Add a challenge to checkout. Bots hate anything that asks them to prove they are human. Put a challenge in front of the payment step, either Cloudflare Turnstile or reCAPTCHA, added through your gateway's own setting if it offers one or through a checkout captcha plugin. The honest tradeoff: a challenge adds a small step for real buyers, and an invisible one like Turnstile keeps that friction close to zero while still stopping automated runs. During an active attack the tradeoff is clearly worth it, and you can dial the strictness back down once things are quiet.
  3. Rate limit at the host or WAF level. If attempts are still landing, cap how many checkout or payment requests one address can make in a short window. Cloudflare and most managed WooCommerce hosts offer rate limiting rules that will throttle or block a source firing far faster than a person could. This catches the requests before they ever reach your gateway, which also spares you the per-attempt fees.
  4. Block the heaviest BIN countries, but only if your business allows it. As a last measure, if the attack is clearly coming from card-issuing countries you never legitimately sell to, block those BIN ranges or shipping regions in your gateway or firewall. Do this carefully and only when you are certain you have no real customers there, because it is a blunt tool that can turn away genuine buyers along with the bots.

Clean up the mess

Once the attack is throttled, you are left with a dashboard full of failed orders that will never be paid. Do not delete them one at a time. Select them in bulk from the Orders screen and move them to the trash, which keeps them recoverable in case a real failure got swept up by mistake. If hundreds arrived, a scheduled cleanup that trashes stale unpaid failures on its own is far less painful than clicking through pages of them.

We packaged exactly that into a tiny free plugin: download Quiet Failed Orders, upload it under Plugins, Add New, Upload Plugin, and it mutes the per-failure emails and trashes old unpaid failures on a schedule with a recovery window built in. For the full walkthrough, including a copy-paste snippet if you would rather not add a plugin, read the failed orders cleanup guide. Cleanup is tidiness, though, not defense. It clears what the attack left behind and does nothing about the attack itself, so do the steps above first.

Watch for the next one

Card testing tends to repeat. The same lists get resold, and a store that answered cleanly once often gets probed again weeks later. Your best protection is not staring at the Orders screen all day, it is knowing your normal failure rate so a spike stands out. A handful of failures a day is baseline for most stores. Twenty in a single minute is not, and that gap is exactly what early detection watches for.

Set yourself up to catch the failure-rate spike rather than the individual failure. A jump well above your usual daily rate, arriving in a tight cluster, is the earliest reliable sign the bots are back, often before the fees show up on your statement. The failed payment alerts guide covers how to get told the moment failures surge, from a Gmail filter to an outside watcher, so the next attempt reaches you in minutes instead of on next month's bill.

Two quiet tools, if you want them

Want to know your checkout is loading right now? Run the free checkout checker, no signup. And if you'd like failed payments and stopped orders to reach you within minutes without any setup on your side, Store Guardian is free while it's in beta.

More guides

WooCommerce orders suddenly stopped? Work through these 7 checks

WooCommerce checkout not working: find the cause in 15 minutes

How to get alerted the minute a WooCommerce payment fails

Stop failed WooCommerce orders from cluttering your dashboard

WooCommerce order emails not sending: fix it in 20 minutes