*Settings › Cart & Checkout*

# Checkout Protection

Stops bots from testing stolen cards at your checkout, without getting in real shoppers’ way. Free, and on at Standard from the start. The page card by card: the last 7 days, how strict, the human check in three steps, and what happens when an attack starts.

Quick links

- [The status and the last 7 days](https://docs.wpeasycart.com/docs/administrative-console-guide/checkout-protection/#status)
- [How strict](https://docs.wpeasycart.com/docs/administrative-console-guide/checkout-protection/#level)
- [Human check, in three steps](https://docs.wpeasycart.com/docs/administrative-console-guide/checkout-protection/#human)
- [When an attack starts](https://docs.wpeasycart.com/docs/administrative-console-guide/checkout-protection/#attack)
- [What shoppers see](https://docs.wpeasycart.com/docs/administrative-console-guide/checkout-protection/#shopper)
- [Trusted and blocked](https://docs.wpeasycart.com/docs/administrative-console-guide/checkout-protection/#lists)
- [Activity](https://docs.wpeasycart.com/docs/administrative-console-guide/checkout-protection/#activity)
- [Your payment processor, and Start again](https://docs.wpeasycart.com/docs/administrative-console-guide/checkout-protection/#gateway)
- [Fine-tune and All settings](https://docs.wpeasycart.com/docs/administrative-console-guide/checkout-protection/#advanced)
- [Card tests on the Orders screen](https://docs.wpeasycart.com/docs/administrative-console-guide/checkout-protection/#orders)

**Where to find it:** WP Admin › EasyCart › Settings › Cart & Checkout › Checkout protection

*At a glance*

## This week and how strict

What protection stopped in the last 7 days, and what each level really limits.

### The status and the last 7 days

What happened at your checkout this week

Card testing is a bot running stolen card numbers through your checkout to find the ones that work. Every try can cost you a processor fee, and your payment processor may hold your payouts because of it. This page stops it without getting in real shoppers’ way. It is free and on at the Standard level from the start.

The line at the top says where you stand, such as **Standard · a human check when something looks wrong**. **Worth a look** appears only when something needs you: nothing stops card testing, protection is only watching, the human check has no keys yet, the check provider is not answering, or attack emails are off. Each has a button that fixes it.

The status card shows **Protected** with your level, **Watching only**, **Not protected** when the level is Off, or **Holding off an attack**. Beside it are four counts for the last 7 days: **card tests stopped**, **payments declined by the bank**, **attacks held off** and **paused shoppers who later paid**. That last one should stay at 0: if it rises, real customers are being caught. A chart shows stopped and declined payments for each of the last 7 days.

**Turn on extra checks now** starts attack mode by hand. During an attack the card says until when every shopper gets the extra checks, with **End it now** and **Keep extra checks on for 24 hours**. Once an order has been flagged, **Orders flagged as possible card tests** opens them. **See activity** and **Checkout settings** sit beside the title.

For a step by step walkthrough, see [How to Stop Card-Testing Bots at Checkout](https://docs.wpeasycart.com/docs/how-to-guides/how-to-stop-card-testing-bots-at-checkout/).

![Settings › Cart & Checkout › Checkout protection with the EasyCart menu: Protected at the Standard level, the four counts and the last 7 days.](https://docs.wpeasycart.com/wp-content/uploads/2026/11/checkout-protection-overview-607.jpg)

### How strict

Six levels, and what each one really limits

**Protection level** has six choices. Under the one you pick, the card spells out what it does in plain rules, with the real numbers.

**Off**: nothing is checked or recorded.
**Watch only**: nothing is stopped. Everything Standard would stop is listed under Activity as “Would stop”, so you see what it would do first.
**Relaxed** ( many shoppers on one network ): 8 failed payments in 10 minutes, then a 30 minute wait; 20 in a day; a card is refused after 8 fails in a day; an attack starts at 12 declines in 15 minutes, 4 times the usual.
**Standard** ( recommended ): 5 failed payments in 10 minutes, then a 1 hour wait; 10 in a day; a card is refused after 5 fails in a day; an attack starts at 8 declines in 15 minutes, 3 times the usual.
**Strict** ( attacked before ): 3 failed payments in 10 minutes, then a 24 hour wait; 6 in a day; a card is refused after 3 fails in a day; an attack starts at 5 declines in 15 minutes, twice the usual; and a payment that never opened your checkout page gets a human check.
**Custom**: your own numbers for failed payments per shopper, the minutes they are counted over, the pause, failed payments per card per day, and when an attack starts.

Every try counts across the shopper’s device, network and email. A refused card does not stop the shopper: another card still works. **Limit gift card and coupon guessing** pauses code entry for a shopper for an hour after 10 wrong codes in 10 minutes.

![How strict on Standard, with its three rules in plain words and the code guessing limit.](https://docs.wpeasycart.com/wp-content/uploads/2026/11/checkout-protection-level-607.jpg)

> **💡 Note:** Not sure? Leave it on Standard. If real customers are being paused, the fourth count under Status rises above 0: try Relaxed. If attacks get through, try Strict.

*Stopping bots*

## The human check and attacks

The human check and its keys, what happens when declines spike, and what shoppers are told.

### Human check, in three steps

When to ask, where the check comes from, and its keys

A quick “are you human?” check that bots cannot pass. Most shoppers never tick anything: it passes by itself. **When to ask**: **Never** ( the limits only ), **When something looks wrong** ( after a decline, and during an attack ) or **Every payment** ( each shopper, once ).

**The check comes from** **Cloudflare Turnstile ( free )** or **Google reCAPTCHA**. Turnstile is set up here in three steps:
**1. Get your keys.** Free from Cloudflare, with no monthly limit. **Open Cloudflare Turnstile**, choose Add widget, enter this site’s domain and pick Managed mode.
**2. Paste them here.** Paste the **Site key** and **Secret key**, then **Save keys**. A saved secret key stays hidden; click the box to type a new one.
**3. Test them.** Press **Test the keys**. The check is drawn with your site key and Cloudflare confirms it with your secret key. When it passes, the chip says **Keys work** and the step says when they passed.

Google reCAPTCHA uses the keys saved under Settings › Store › Accounts › Sign-in protection.

**What a shopper sees at payment** shows the payment form at **First try**, **After a decline**, **During an attack** and **Paused**, for the level and check you chose. If the check service is down, payments carry on under stricter limits: half the tries before a pause, and a pause of at least an hour.

![The human check with Cloudflare Turnstile: the three steps done, keys masked, and what a shopper sees at payment.](https://docs.wpeasycart.com/wp-content/uploads/2026/11/checkout-protection-human-607.jpg)

> **💡 Note:** The reCAPTCHA keys used here are the ones saved under [Settings › Store › Accounts](https://docs.wpeasycart.com/docs/administrative-console-guide/account-settings/). Turnstile needs no Google account and has no monthly cap, which is why it is the default.

### When an attack starts

What the store does by itself when declines spike, in order

**1 · It starts**: at the number of declines in 15 minutes your level sets, such as 8 declines, 3 times the usual. Set by How strict.
**2 · Every shopper** gets the human check and the number of failed payments you choose here.
**3 · You hear**: **Email me** sends an email when an attack starts and ends, to the address under **Send to**. **Send a test alert** checks it arrives.
**4 · Back to normal** after a calm spell of 30 minutes, 1 hour, 4 hours or 24 hours.

**Flag orders that might be card tests** marks a paid order placed during an attack, by a shopper with declines, with **Possible card test** on the orders list and on the order.

![When an attack starts: the four steps in order, and Flag orders that might be card tests.](https://docs.wpeasycart.com/wp-content/uploads/2026/11/checkout-protection-attack-607.jpg)

### What shoppers see

When a payment is declined or a shopper is paused

**Declined payment message**: **Simple** ( recommended ) says the payment was not approved and to check the card or try another, so card testers learn nothing about which cards are real. **Bank’s reason** is clearer for shoppers but tells card testers which cards are real; “stolen card” reasons are never shown.

**When a shopper is paused** shows the message a paused shopper gets, with the time they can try again and your contact address. **Change the wording in every language** opens the phrases.

![What shoppers see: the Simple declined message and the paused message.](https://docs.wpeasycart.com/wp-content/uploads/2026/11/checkout-protection-shopper-607.jpg)

*Fine tuning*

## Lists, records and the rest

Who skips the limits, the activity log, a second layer at your processor, the technical settings, and where flagged orders show up.

### Trusted and blocked

People and places that skip the limits, or never get through

**Trust returning customers**: signed-in customers who paid before get double the limits and no human check unless there is an attack.

**Paused right now** lists every pause with what it is ( a browser session, a network address ) and when it ends. Pauses end by themselves; unpause someone who contacts you. Beside your own network address, **Never limit it** adds it to the never-limit list.

**Never limit, always block** opens the two lists. **Never limit**: network addresses or ranges, one a line. **Always block**: addresses, emails or whole email domains; they only ever see the declined message.

![Trusted and blocked, with nobody paused.](https://docs.wpeasycart.com/wp-content/uploads/2026/11/checkout-protection-lists-607.jpg)

### Activity

Every stop, decline, check and attack, with the reason

The latest five rows: when, what happened, where, the shopper and the card. **See all** opens the whole list in a drawer, with filters such as Declined and Human checks. Records are kept for the days set under Fine-tune. Network addresses and emails are stored hashed; only a shortened form is shown.

![Activity on a store with nothing stopped yet.](https://docs.wpeasycart.com/wp-content/uploads/2026/11/checkout-protection-activity-607.jpg)

### Your payment processor, and Start again

A second layer at your processor, and the reset buttons

**Your payment processor adds its own layer** gives the free settings in your processor’s own dashboard that stop card tests before they reach you. For Stripe: Radar screens every payment, and turning on the rule “Block if CVC verification fails” stops most tests that guess a security code. Make sure the EasyCart webhook is set up, so declines in the payment form reach this page. **Open** goes to the dashboard.

**Start again**: **Reset to recommended** goes back to Standard with the recommended choices; your keys and lists stay. **Clear all pauses** lets every paused shopper try again now.

![Your payment processor adds its own layer, with the Stripe advice.](https://docs.wpeasycart.com/wp-content/uploads/2026/11/checkout-protection-gateway-607.jpg)

### Fine-tune and All settings

You should not need to change these

**How visitors reach your site** tells the store how to read each visitor’s real network address. **Automatic** trusts Cloudflare only from Cloudflare’s own servers. **Direct** reads the connection as it is. Choose **Another proxy** only if your host told you to: a wrong choice lets bots fake their address. The line under it says what was detected and your address as the store sees it.

**Payments must come from your checkout page** ( on ) gives a human check to payments sent by bots that never opened your checkout, or refuses them when no check is set up. It is safe with caching plugins: the checkout always loads fresh. **Keep activity for** is 7, 30 or 90 days.

**All settings** links **Checkout protection, as one list**, Checkout, Accounts ( reCAPTCHA on sign-in and Create account ) and **Shopper wording**. Changes are listed under Recent changes here for 30 days, with Undo.

![Fine-tune: how visitors reach your site, payments from the checkout page, and how long activity is kept.](https://docs.wpeasycart.com/wp-content/uploads/2026/11/checkout-protection-fine-tune-607.jpg)

> **⚠️ Careful:** Choosing Another proxy when your site is not behind one lets a bot claim any network address it likes, which defeats the address limits. Leave it on Automatic unless your host says otherwise.

### Card tests on the Orders screen

Where flagged orders show up once there are any

Once an order has been flagged, the Orders list gains a **Card tests** tile with the count and a **Checkout protection** filter with **Possible card tests**. Flagged rows carry a **Possible card test** badge, and the order itself opens with a warning: the payment went through during an attack after declined payments from the same shopper, so refund it before you ship anything if you do not recognise the customer. None of this appears on a store that has never had a flagged order.

> **💡 Note:** Orders and their flags are covered in [Order Management](https://docs.wpeasycart.com/docs/administrative-console-guide/order-management/).

*Keep going*

## Related panels

- [Checkout](https://docs.wpeasycart.com/docs/administrative-console-guide/checkout-settings/): The checkout itself: one page or steps, the form and your policies.
- [Checkout fields](https://docs.wpeasycart.com/docs/administrative-console-guide/checkout-fields/): Your own questions at checkout.
- [Accounts](https://docs.wpeasycart.com/docs/administrative-console-guide/account-settings/): The Google reCAPTCHA keys the human check can use.
- [Order Management](https://docs.wpeasycart.com/docs/administrative-console-guide/order-management/): Reviewing and refunding orders flagged as possible card tests.
- [Payments](https://docs.wpeasycart.com/docs/administrative-console-guide/payments-setup/): The processor whose fees and disputes this protects you from.
- [Diagnostics](https://docs.wpeasycart.com/docs/administrative-console-guide/diagnostics/): Where the protection state is reported alongside the rest of the store.

## Ready to run your store on WP EasyCart?

Everything in this guide works with the free plugin. PRO and Premium add subscriptions, memberships, wholesale pricing and more. Try every PRO feature free for 14 days.

[Start your free trial](https://www.wpeasycart.com/wp-easycart-professional-14-no-risk-trial/) · [See what is included](https://www.wpeasycart.com/wordpress-shopping-cart-pricing/)

![The WP EasyCart admin: orders and offers](https://docs.wpeasycart.com/wp-content/uploads/2026/09/cta-wpeasycart-pro-v2.jpg)

---

Source: https://docs.wpeasycart.com/docs/administrative-console-guide/checkout-protection/ ( updated 2026-11-06 )