FAILED ORDERS
Dozens or thousands of failed orders in minutes
Order numbers jump, admin fills with failures, and notifications flood in.
Codeprint · WooCommerce checkout security
Stop WooCommerce card testing before it reaches your payment gateway.
Checkout Firewall combines signed checkout-flow proof, local automation evidence, multidimensional velocity limits, provider-neutral challenges, and failed-payment feedback across Classic Checkout, Checkout Blocks, and protected WooCommerce Store API routes.
Challenge suspicious checkout traffic. Block clear abuse. Let real customers purchase.
- Version 1.0.0 live
- No Codeprint account
- No local usage cap
- PHP 8.0+
POST /?wc-ajax=checkoutflow-proof valid · velocity ok · returning customerALLOWPOST /?wc-ajax=checkoutflow-proof missing, recoverable → TurnstileCHALLENGEPOST /wp-json/wc/store/v1/checkoutip velocity exceeded · repeated gateway declinesBLOCKPOST /wp-json/wc/store/v1/checkoutsame email across rotating sessionsBLOCKIllustration of the kind of output the event log produces. Not a product screenshot—real interface captures replace this at launch.
01 — Recognize it
Does your store look like this right now?
Card testing turns a real checkout into a test harness for stolen card details. Not every failed order is card testing—but these patterns together deserve attention.
TINY TOTALS
Repeated attempts on your cheapest product
Small amounts are cheap to test and less likely to be noticed.
PROCESSOR CONTACT
Your processor warns about decline volume
Abnormal authorization-to-decline ratios can put the merchant account at risk.
INVISIBLE TRAFFIC
Attempts never load your checkout page
Requests hit WooCommerce Store API checkout routes directly.
ROTATION
New email and IP on every attempt
One blocked address changes little when the next request uses a different identity.
STILL HAPPENING
It continues after a simple bot blocker
A token check stops naive scripts, not automation that walks the normal checkout flow.
02 — How it works
Six layers, evaluated before the gateway is asked to charge anything.
No single layer is sufficient. The combination keeps cheap checks first, uses a recoverable challenge for uncertainty, and reserves hard blocks for clear abuse.
Layer 1
Checkout-flow proof
A legitimate checkout requests a short-lived signed token bound to its session, cart, and checkout surface. Direct requests that skip the expected flow can be challenged or blocked.
Limit: It proves the expected flow—not a human—and is not enough by itself.
Layer 2
Local automation evidence
A randomized honeypot and signed render-time evidence add supporting signals without contacting a third party or blocking by themselves.
Limit: Sophisticated browser automation can imitate these signals, so they stay low weight.
Layer 3
Velocity across several dimensions
Repeated behavior is evaluated by keyed IP, billing email, WooCommerce session, and combined identity—not by one address alone.
Limit: Free uses conservative fixed thresholds; Premium adds distributed-rotation detection.
Layer 4
Challenge when risk calls for it
The account-free local check works immediately. Merchants may instead configure Cloudflare Turnstile or Google reCAPTCHA v2; only the selected provider loads on a challenged checkout.
Limit: Every challenge has limits and can add friction; ordinary low-risk checkout sees none.
Layer 5
Failed-payment feedback
Recorded gateway declines raise local suspicion and can create a temporary lockout. Form errors and broad gateway outages are treated differently.
Limit: This signal follows a gateway attempt, but helps shorten an active attack.
Layer 6
Explain, intervene, and recover
Decisions carry stable reason codes. Free provides Observe Mode, temporary blocks, trusted exemptions, and manual Emergency Mode; Premium can escalate and recover automatically.
Limit: Checkout Firewall never automatically disables the entire payment gateway.
03 — Under attack now
The first fifteen minutes matter more than the plugin you install.
Preserve evidence, contact your processor, verify safe controls, and avoid handing the attacker a new opening.
Open the 15-minute guide →IMMEDIATE CHECKLIST
- 01Preserve logs and attack evidence
- 02Contact the payment processor
- 03Verify safe or test-mode options
- 04Inspect Store API and traffic patterns
- 05Add layered checkout protection
Do not delete evidence or blindly disable the entire checkout.
04 — Free and Pro
Free is the whole protection engine, not a trial.
Use Free to stop the obvious burst. Choose Pro when rotating identities, automation, and team response demand adaptation.
FREEManual control
- Observe Mode by default before checkout enforcement
- Classic Checkout, Checkout Blocks, and protected Store API routes
- Signed checkout-flow proof, randomized honeypot, and timing evidence
- Account-free local challenge; optional Turnstile or reCAPTCHA v2
- Fixed IP, email, session, and IP + email velocity controls
- Failed-payment feedback without reading payment details
- Trusted exact-IP, narrow-CIDR, and authenticated-user exemptions
- Manual Emergency Mode, local activity, blocks, health, and alerts
- No Codeprint account and no local usage cap
PRO 1.0Automatic response
- Automatic Normal, Elevated, Attack, and Recovery states
- Adaptive thresholds and recoverable challenge escalation
- Distributed identity-rotation detection
- Gateway-aware outage and flash-sale safeguards
- 90-day incident analytics, timelines, and CSV export
- Slack, Discord, and generic webhook alerts
- Policy import/export and privacy-bounded diagnostics
- Same Premium features on every paid plan
05 — Product modes
Three postures: everyday, emergency, and automatic.
The plugin changes posture, not your whole payment gateway. Each state is explainable and designed to recover.
Quiet by default
Conservative local controls. Low-risk traffic proceeds with minimal friction.
One switch, with an expiry
Fresh guest challenges, tighter limits, and an automatic end time.
Escalate and recover
Normal → Elevated → Attack → Recovery → Normal.
06 — Privacy and resilience
Protection you can reason about, and audit.
No card data, ever
No raw card numbers, CVCs, or gateway payment payloads are inspected.
The engine runs on your site
A Codeprint outage does not take local checkout protection offline.
Minimized data
Long-term identifiers are hashed or masked; repeated events are aggregated.
Protection stays
If a Pro license lapses, the Free core and Emergency Mode remain active.
07 — Compatibility
Classic, Blocks, and Store API—without invented gateway claims.
Exact-package evidence covers WooCommerce’s core checkout surfaces. Specific live gateways and checkout replacements remain unverified until their exact integrations are tested.
View the compatibility matrix →QUALIFIEDClassic Checkout
QUALIFIEDCheckout Blocks
QUALIFIEDStore API checkout
VERIFYSpecific live gateways
08 — Premium plans
Same Premium features. Plans differ by production sites.
Annual billing through Freemius. Fourteen-day refund period. Recognized local, development, and staging installs do not consume production activations.
Free
$0 forever
No local usage cap
The complete local protection engine for one store or many.
Get Free on WordPress.orgMOST POPULAR
Pro
$59 per year
1 production site
Automatic response and distributed-abuse detection.
Choose ProBusiness
$119 per year
5 production sites
The same Premium engine for a growing store portfolio.
Choose BusinessAgency
$199 per year
25 production sites
The same Premium engine across client stores.
Choose Agency09 — FAQ
Straight answers, including the ones about limits.
What is card testing?
Card testing is an attacker sending stolen card details through a real checkout to learn which cards still work. Not every failed order is card testing, so patterns matter.
Is this a general fraud platform?
No. Checkout Firewall is focused on automated checkout abuse. It is not KYC, AML, chargeback management, a web application firewall, or a guarantee against every fraudulent transaction.
Does Free actually stop attacks?
Free includes the complete local protection engine, Observe Mode, fixed velocity controls, provider-neutral challenges, failed-payment lockout, trusted exemptions, Emergency Mode, activity, and recovery tools. It is not a timed or usage-capped trial.
Do I need a Codeprint account?
No. Free protection works locally without a Codeprint account or per-order Codeprint API. Freemius connection is optional for Free and explicit.
Must I use Cloudflare?
No. The default challenge is local. You may optionally choose Turnstile or reCAPTCHA v2. Cloudflare CDN use is separate and also optional.
Does it inspect card numbers?
No. Checkout Firewall does not read, store, log, transmit, hash, inspect, or analyze card numbers, CVCs, or gateway payment payloads.
Does it protect Checkout Blocks and the Store API?
Yes. Version 1.0.0 covers normal Classic Checkout, Checkout Blocks, and protected Store API checkout routes. The legacy Classic order-pay retry endpoint is a documented version 1 limitation.
Will legitimate customers be blocked?
Any automated protection can be wrong. New installs begin in Observe Mode, uncertain traffic prefers a recoverable challenge, narrow trusted exemptions are available, and temporary blocks can be released.
Version 1.0.0 · Available on WordPress.org
Put a control between checkout abuse and your payment gateway.
Install the complete Free edition from the official WordPress.org Plugin Directory. New installations begin safely in Observe Mode.