Agent Stamp

Card testing on WooCommerce ·

How to stop a card testing attack on WooCommerce without blocking real buyers

A card-testing attack is bots running stolen card numbers through your checkout, usually with small orders, to learn which cards still work. Three signs give it away: a burst of failed orders, many tiny or same-amount orders, and many different cards coming from one connection or one email address.

Is it card testing?

Check your orders against these signs. The more of them you see at once, the likelier it is card testing.

  • A burst of Failed orders. WooCommerce's guide to card testing names a large rise in Failed orders as a common sign, often with order notes about declined cards, because testers can run hundreds of stolen numbers in a short time.
  • Tiny or same-amount orders. Testers make low-value purchases, each with a different card, so the cardholder and the bank do not notice. Visa's merchant guidance says attack transactions are often less than 10 US dollars, and Visa's guidance on account testing lists identical or similar amounts as a pattern to watch.
  • Many cards from one connection or one email. Visa tells merchants to watch payment attempts per IP address, and to flag several transactions with different cards that share one email address and one device.
  • Guest checkouts with no account behind them. Turning off guest checkout is on WooCommerce's own list of responses to an attack.
  • A spike against your normal day. Visa says sudden spikes in daily volume and in declines should be investigated, and treats a connection whose time zone or browser language does not fit the cardholder as higher risk. A burst at an hour your store is usually quiet is worth a closer look.
  • A warning from your payment gateway. WooCommerce notes that card testing raises your decline rate and, later, your disputes, so a message from your payment gateway about either is a sign too.

Two notes from WooCommerce. These Failed orders are not lost sales, and they do not mean your checkout is broken for real buyers. And an attack can run without a wave of Failed orders, for example when testers add cards to customer accounts, so read the order notes and your gateway's decline report, not only the order count.

Stop it today

Work down this list in order.

  1. Rate-limit checkout and the Pay page. Go to WooCommerce > Settings > Advanced > Features and turn on Rate limit Checkout. WooCommerce's rate-limiting docs say this switch applies only to the Checkout block's place-order request, at a maximum of 3 requests per 60 seconds. The Pay page for pending orders is a separate route at /checkout/order-pay/, per WooCommerce's endpoint docs, so ask your host or firewall for a limit on repeated submissions there too, and on the classic checkout if your store uses it. Visa's guidance also recommends limiting page submissions and repeat actions at the firewall. If your store sits behind a proxy or CDN, have your developer turn on the rate limiter's proxy support, so it does not block genuine shoppers. WooCommerce says rate limiting slows an attack right away but does not fully prevent it, and since WooCommerce 9.8 a developer can group requests by something other than the IP address.
  2. Turn on your payment gateway's own fraud rules. WooCommerce advises reviewing the anti-fraud measures on your payment provider account. In your gateway's dashboard, require the card security code (CVV) and the address check (AVS) on every payment, and turn on 3-D Secure if your gateway offers it. Visa recommends all three against card testing.
  3. Require an account, or hide guest checkout, during the attack. In WooCommerce > Settings > Accounts and Privacy, untick Enable guest checkout, as described in WooCommerce's settings docs. This adds a step for real buyers, so turn it back on when the attack ends. If your gateway shows declines but you see few Failed orders, testers may be adding cards to accounts, and WooCommerce suggests turning off saved cards for your payment methods where supported. Make any donation or name-your-price product private for now too. WooCommerce says these are more likely to be tested, and Visa says testers have specifically targeted payments with no set amount.
  4. Add a challenge on checkout. WooCommerce and Visa both recommend a captcha at checkout. Check two things. It has to cover the Checkout block and the Store API: WooCommerce found popular captcha plugins that let Store API checkouts through unchecked. And it has to validate every request that can take a payment, which Visa spells out, so the Pay page counts too. Then let AI agents with a verified signature skip it. How a captcha treats AI shopping agents.
  5. Cancel the test orders and do not fulfil them. Set test orders to Cancelled, and check any order that was paid before you ship it. WooCommerce describes Failed orders as unpaid and not needing fulfilment, and Visa notes that card testing can leave merchants fulfilling orders that have nothing to do with real customers. Refund any test payment that went through (see below).
  6. Tell your payment gateway. Contact them, say you are under a card-testing attack, and ask them to review the protection on your account. WooCommerce gives the same advice, and adds that if you want the fees on fraudulent transactions back, your payment provider may be able to help.

Don't block the buyer

A blanket captcha, a bot block, or a firewall rule against all automation also stops AI shopping agents that pay with a real card for a real person. Visa's Trusted Agent Protocol page puts the problem plainly: without a way to recognize agents, merchants must choose between blocking potentially valuable agent-driven traffic and accepting the risk. The same protocol lets an agent carry the shopper's payment details. Its specification says stores and their site protection could confuse shopping agents with bots or attackers.

Three things separate a card-testing script from an agent buying for a person.

  • Named and signed, or nameless. A shopping agent can sign each request with a key its maker publishes, using HTTP Message Signatures (RFC 9421), and your server can check it. The IETF's Web Bot Auth working group is standardizing this, and its charter notes that user-agent strings have significant limits. A name in the user-agent is a claim. A valid signature tells you which company sent the request.
  • One real order, or many failed tiny ones. An agent buying for a person is after one order. A tester places many, most of them fail, and each uses a different card.
  • What is in the cart. Testers go for small charges, donations, and name-your-price items. An agent's cart holds the product its person asked for.

So limit the pattern, not the whole category: cap failed payments, challenge unsigned automation, and let verified agents through. How to tell a bot order from an agent order in WooCommerce.

After the attack

  • Refund or void every test payment that went through. Visa's merchant guidance says to void the transaction or refund it, and to refund fraudulent payments to avoid disputes. WooCommerce calls refunding urgent. Your payment provider may still keep the transaction fees.
  • Expect disputes. WooCommerce warns that disputes rise when real cardholders see charges they did not make. Answer each one with the order record and proof of any refund.
  • Keep evidence for each order. Save the order number, time, amount, billing name and address, email, IP address, user agent, and the decline notes. WooCommerce stores the customer's IP address and user agent on each order, per its REST API docs, and Visa asks for exactly these details (source IP, billing name and address, email, user agent) to trace testers. Before you clean up, check Retain failed orders under Accounts and Privacy: if it is set, WooCommerce moves old Failed orders to the trash in its daily cleanup.
  • Undo the temporary steps. Once Failed orders are back to your normal level, turn guest checkout back on and make paused products public again. Keep the rate limit and your gateway's fraud rules on.

FAQ

How do I know my WooCommerce store is under a card testing attack?

Look for a burst of failed orders, many tiny or same amount orders, and many different cards from one connection or one email address.

Why would anyone target my store?

Card testers need a checkout that will tell them whether a stolen card works. Visa says the most common target is a legitimate online store with weak fraud controls, and testers favor low-priced, donation, or name-your-price items because small charges get less attention.

Will a card-testing attack hurt my merchant account?

It can. WooCommerce warns that card testing raises your decline rate and your disputes, and Visa notes fees on both approved and declined attempts, plus the risk of being flagged in its monitoring programs. Refunding test payments quickly and telling your payment gateway limits the damage.

Does a captcha stop card testing?

It helps, but not on its own. WooCommerce found captcha plugins that left the Store API checkout unprotected, and says rate limiting slows attacks without fully preventing them, so use both along with your payment gateway's fraud rules. A captcha also stops AI shopping agents, so let agents with a verified signature skip it.

Can an AI shopping agent be mistaken for a card tester?

Yes. Visa's agent protocol says stores and their site protection could confuse shopping agents with bots or attackers. The differences are that a commerce agent can sign its requests with a key its maker publishes, places one order rather than many failed ones, and fills its cart with what a person asked for.

How long does a card-testing attack last?

There is no set length, and we found no public figure we could verify. WooCommerce describes testers running hundreds or thousands of cards in a short period. Keep the rate limit and gateway rules on, and turn guest checkout back on only once Failed orders are back to your normal level.

Check your store

Run the free store check at /check. It looks at your store from outside in about 10 seconds, with no sign-up, and shows whether a captcha or firewall sits in front of your checkout.

Turn on the card-testing guard

The steps above slow testers down, but you still have to watch for them. Agent Stamp Pro adds a card-testing guard that refuses checkout from a connection once it has failed too many payments, and it never stops an AI agent with a verified signature. It is off until you turn it on, and you pick the limits.

  1. Install Agent Stamp Pro. Start the trial, then install Agent Stamp Pro next to the free Agent Stamp plugin.
  2. Open the Rules tab. Go to WooCommerce, then Agent Stamp, then Rules, and tick Card-testing guard.
  3. Set your limit. Choose how many failed payments a connection gets (5 to start) in how many minutes (60 to start), then save. If automated failures pile up across the whole store, automated checkouts wait too, whatever address they use.

Start the 14-day Pro trial. No card needed. After the trial, Pro is $79 a year for one site. Agencies running several stores can pick a 5-site or 20-site plan at /#pricing.

Sources

  • WooCommerce: How do I prevent and respond to card testing attacks? https://woocommerce.com/document/how-do-i-prevent-and-respond-to-card-testing-attacks/
  • WooCommerce developer docs: Rate Limiting for Store API endpoints. https://developer.woocommerce.com/docs/apis/store-api/rate-limiting/
  • WooCommerce Developer Blog: Card Testing Attacks and the Store API. https://developer.woocommerce.com/2024/12/18/card-testing-attacks-and-the-store-api/
  • WooCommerce developer docs: Understanding WooCommerce endpoints. https://developer.woocommerce.com/docs/best-practices/urls-and-routing/woocommerce-endpoints.md
  • WooCommerce: Accounts and Privacy Settings. https://woocommerce.com/document/configuring-woocommerce-settings/accounts-and-privacy/
  • WooCommerce: Advanced Settings. https://woocommerce.com/document/configuring-woocommerce-settings/advanced/
  • WooCommerce REST API documentation (order properties). https://woocommerce.github.io/woocommerce-rest-api-docs/
  • Visa: Enumeration Mitigation and Considerations for Merchants (June 2026). https://usa.visa.com/content/dam/VCOM/global/support-legal/documents/anti-enumeration-and-account-testing-best-practices-merchant.pdf
  • Visa: Guidance to Guard Against Enumeration Attacks and Account Testing Schemes. https://usa.visa.com/content/dam/VCOM/global/support-legal/documents/visa-guidance-to-guard-against-enumeration-attacks.pdf
  • Visa Developer: Trusted Agent Protocol. https://developer.visa.com/use-cases/trusted-agent-protocol
  • Visa Developer: Trusted Agent Protocol Specifications. https://developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications/
  • IETF: Web Bot Auth (webbotauth) working group charter. https://datatracker.ietf.org/wg/webbotauth/about/
  • IETF RFC 9421: HTTP Message Signatures. https://www.rfc-editor.org/rfc/rfc9421

All notes