# Hundreds of failed orders in WooCommerce: card testing, spam bots, or a real AI agent?

A sudden pile of Failed or Pending payment orders with odd names, tiny totals and the same product is almost always automation: card testing, where someone uses your checkout to check stolen cards, or a bot creating fake orders. A real AI shopping agent looks different. It places one order, for a product a person asked for, and it can prove who sent it. Check the count, the cart and the identity before you block anything.

## What a failed-order flood looks like

You open the orders list and the morning is full of orders you did not expect. Most of them share a few traits:

- **Status Failed or Pending payment.** [WooCommerce's guide to card testing](https://woocommerce.com/document/how-do-i-prevent-and-respond-to-card-testing-attacks/) names a large rise in Failed orders as a common sign, often with order notes about declined cards.
- **Many orders in minutes.** WooCommerce describes testers running hundreds or thousands of cards in a short period.
- **Tiny or identical totals.** [Visa's merchant guidance](https://usa.visa.com/content/dam/VCOM/global/support-legal/documents/anti-enumeration-and-account-testing-best-practices-merchant.pdf) says attack transactions are often less than 10 US dollars, and [Visa's guidance on account testing](https://usa.visa.com/content/dam/VCOM/global/support-legal/documents/visa-guidance-to-guard-against-enumeration-attacks.pdf) lists identical or similar amounts as a pattern to watch.
- **Random names and throwaway emails, on guest checkout.** Turning off guest checkout is on WooCommerce's own list of responses, which tells you where these orders usually come in.
- **The same cheap product every time.** Visa says testers favor low-priced, donation, or name-your-price items because small charges get less attention.

WooCommerce adds two things worth knowing. These Failed orders are not lost sales, and they do not mean your checkout is broken for real buyers.

## Card testing or spam bots: two different floods

### Card testing

Card testers have a list of stolen card numbers and need to know which still work. Your checkout answers that question for them: a declined payment means a dead card, an approved one means a card worth selling or using. So they run many small orders, each with a different card. WooCommerce warns that this raises your decline rate and, later, your disputes, and Visa notes fees on both approved and declined attempts. The full response, step by step, is in [how to stop a card-testing attack on WooCommerce](/blog/woocommerce-card-testing-attack).

### Spam and fake-order bots

Not every flood is about cards. Some bots create junk accounts and fake orders with no real payment behind them, so you see Pending payment orders that never move, or Failed orders with no decline note at all. Whatever the motive, the fix overlaps with card testing: the same checkout limits, the same captcha, and the same care not to block buyers you want. If your gateway's decline report is busy, treat it as card testing first, because that is the case that costs you fees and disputes.

## What a real AI agent order looks like

An AI shopping agent buying for a person is also "not a person clicking", but it behaves like a customer. It places one order, pays with the shopper's card, and fills the cart with the product its person asked for.

It can also prove who sent it. A shopping agent can sign each request with a key its maker publishes, using HTTP Message Signatures ([RFC 9421](https://www.rfc-editor.org/rfc/rfc9421)), and your server can check that signature. The IETF's [Web Bot Auth working group](https://datatracker.ietf.org/wg/webbotauth/about/) is standardizing this, and its charter notes that user-agent strings have significant limits. A name in the user-agent is a claim. A valid signature tells you which company sent the request. [Why a user-agent name is not proof.](/blog/signature-or-name)

The risk runs the other way too. [Visa's Trusted Agent Protocol specification](https://developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications/) says stores and their site protection could confuse shopping agents with bots or attackers.

## Three checks to sort them in the orders list

Open WooCommerce, then Orders, and look at three things.

- **Count.** A flood is many attempts in a short window, most of them failed. An agent order is one order.
- **Cart.** A flood hits the cheapest item, a donation, or a name-your-price product, at the same small total. An agent order holds the product a person wanted, at its normal price.
- **Identity.** A flood comes from scripts that cannot prove who sent them, often under one connection or one email. An agent can carry a verified signature from a company that publishes its key.

| Signal | Failed-order flood | Real AI agent order |
| --- | --- | --- |
| Count | Many orders in minutes, most Failed | One order |
| Cart | Cheapest, donation or name-your-price item, same small total | The product a person asked for |
| Identity | Unsigned script, no way to check who sent it | Can carry a verified signature |
| Payment | Declined cards, one after another | Paid with the shopper's card |

One order that fails once is not a flood. A real shopper, or a real agent, can have a card declined too. Look for the pattern.

## Stop the flood without blocking real buyers (or agents)

- **Rate-limit checkout.** Go to WooCommerce > Settings > Advanced > Features and turn on Rate limit Checkout. [WooCommerce's rate-limiting docs](https://developer.woocommerce.com/docs/apis/store-api/rate-limiting/) say this applies to the Checkout block's place-order request, at a maximum of 3 requests per 60 seconds. [WooCommerce says](https://developer.woocommerce.com/2024/12/18/card-testing-attacks-and-the-store-api/) rate limiting slows an attack right away but does not fully prevent it.
- **Turn on your payment gateway's fraud rules.** WooCommerce advises reviewing the anti-fraud measures on your payment provider account. Visa recommends requiring the card security code (CVV), the address check (AVS) and 3-D Secure.
- **Add a challenge on checkout, and check that it covers the Store API.** WooCommerce found popular captcha plugins that let Store API checkouts through unchecked. [How a captcha treats AI shopping agents.](/blog/captcha-and-agents)
- **Turn off guest checkout for now.** In WooCommerce > Settings > Accounts and Privacy, untick Enable guest checkout, as described in [WooCommerce's settings docs](https://woocommerce.com/document/configuring-woocommerce-settings/accounts-and-privacy/). Turn it back on when the flood stops.

The point of all four is to limit the pattern, not the whole category. A blanket "block all bots" rule also stops shoppers who buy through AI agents. [Visa's Trusted Agent Protocol page](https://developer.visa.com/use-cases/trusted-agent-protocol) puts it plainly: without a way to recognize agents, merchants must choose between blocking potentially valuable agent-driven traffic and accepting the risk. Cap failed payments per connection, challenge unsigned automation, and let agents with a verified signature through. [How to tell a bot order from an agent order.](/blog/bot-or-agent)

You can also run the free store check at [/check](/check) to see whether a captcha or firewall sits in front of your checkout.

## Clean up after

- **Refund or void any test payment that went through.** Visa's merchant guidance says to void or refund fraudulent payments to avoid disputes, and WooCommerce calls refunding urgent.
- **Expect disputes.** WooCommerce warns that disputes rise when real cardholders see charges they did not make.
- **Keep evidence before you delete anything.** Save the order number, time, amount, billing details, email, IP address, user agent and decline notes. WooCommerce stores the customer's IP address and user agent on each order, per its [REST API docs](https://woocommerce.github.io/woocommerce-rest-api-docs/).
- **Check Retain failed orders.** Under Accounts and Privacy, this setting moves old Failed orders to the trash in WooCommerce's daily cleanup.

More on the aftermath is in [After the attack](/blog/woocommerce-card-testing-attack) on the card-testing note.

## FAQ

### Should I delete the failed orders?

Not straight away. Failed orders are unpaid and need no fulfilment, but they hold the evidence you need for your payment gateway and for any dispute: IP address, user agent, email and decline notes. Save those first, then let the Retain failed orders setting under Accounts and Privacy clear them, or move them to the trash yourself.

### Does a captcha stop spam orders?

It helps, but not on its own. WooCommerce found captcha plugins that left the Store API checkout unprotected, and says rate limiting slows attacks without fully preventing them, so use both along with your payment gateway's fraud rules. A captcha also stops AI shopping agents, so let agents with a verified signature skip it.

### Can an AI agent be mistaken for a bot?

Yes. Visa's agent protocol says stores and their site protection could confuse shopping agents with bots or attackers. The differences are that a shopping agent places one order rather than many failed ones, fills its cart with what a person asked for, and can sign its requests with a key its maker publishes.

### Is it a problem if only a few orders failed?

Usually not. Real shoppers mistype card numbers and real cards get declined. A flood is the pattern: many Failed orders in a short window, tiny or identical totals, and the same cheap item. If you see that, rate-limit checkout and tell your payment gateway.

## Turn on the card-testing guard

The steps above slow testers down, but you still have to watch for them. Agent Stamp Pro adds a card-testing guard that refuses checkout from a connection once it has failed too many payments, and it never stops an AI agent with a verified signature. It is off until you turn it on, and you pick the limits.

![The WooCommerce orders list on a test store with Agent Stamp: twelve Failed $1.00 orders from made-up names within an hour, each marked Unattended or Unknown in the Buyer column, and one Processing $64.00 order marked Claude (signed).](/blog/img/failed-orders-flood.png)

*A test store with made-up data: a flood of Failed orders, and one real agent order, in the Buyer column.*

1. **Install Agent Stamp Pro.** Start the trial, then install Agent Stamp Pro next to the free Agent Stamp plugin.
2. **Open the Rules tab.** Go to WooCommerce, then Agent Stamp, then Rules, and tick Card-testing guard.
3. **Set your limit.** Choose how many failed payments a connection gets (5 to start) in how many minutes (60 to start), then save. If automated failures pile up across the whole store, automated checkouts wait too, whatever address they use.

[Start the 14-day Pro trial](/#pricing). No card needed. After the trial, Pro is $79 a year for one site. For the full response to an attack, read [how to stop a card-testing attack on WooCommerce](/blog/woocommerce-card-testing-attack).

## Sources

- WooCommerce: How do I prevent and respond to card testing attacks? https://woocommerce.com/document/how-do-i-prevent-and-respond-to-card-testing-attacks/
- WooCommerce developer docs: Rate Limiting for Store API endpoints. https://developer.woocommerce.com/docs/apis/store-api/rate-limiting/
- WooCommerce Developer Blog: Card Testing Attacks and the Store API. https://developer.woocommerce.com/2024/12/18/card-testing-attacks-and-the-store-api/
- WooCommerce: Accounts and Privacy Settings. https://woocommerce.com/document/configuring-woocommerce-settings/accounts-and-privacy/
- WooCommerce: Advanced Settings. https://woocommerce.com/document/configuring-woocommerce-settings/advanced/
- WooCommerce REST API documentation (order properties). https://woocommerce.github.io/woocommerce-rest-api-docs/
- Visa: Enumeration Mitigation and Considerations for Merchants (June 2026). https://usa.visa.com/content/dam/VCOM/global/support-legal/documents/anti-enumeration-and-account-testing-best-practices-merchant.pdf
- Visa: Guidance to Guard Against Enumeration Attacks and Account Testing Schemes. https://usa.visa.com/content/dam/VCOM/global/support-legal/documents/visa-guidance-to-guard-against-enumeration-attacks.pdf
- Visa Developer: Trusted Agent Protocol. https://developer.visa.com/use-cases/trusted-agent-protocol
- Visa Developer: Trusted Agent Protocol Specifications. https://developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications/
- IETF: Web Bot Auth (webbotauth) working group charter. https://datatracker.ietf.org/wg/webbotauth/about/
- IETF RFC 9421: HTTP Message Signatures. https://www.rfc-editor.org/rfc/rfc9421

Canonical page: https://getagentstamp.com/blog/woocommerce-failed-orders-spam