*How-to › Fix common problems*

# How to Stop Card-Testing Bots at Checkout

Stop bots from testing stolen cards at your checkout. You read the status, choose a level, add a human check, set the attack reaction and review flagged orders. 9 parts.

Quick links

- [What card testing is and how the protection works](https://docs.wpeasycart.com/docs/how-to-guides/how-to-stop-card-testing-bots-at-checkout/#how-it-works)
- [Step 1. Read the last 7 days](https://docs.wpeasycart.com/docs/how-to-guides/how-to-stop-card-testing-bots-at-checkout/#status)
- [Step 2. Choose how strict](https://docs.wpeasycart.com/docs/how-to-guides/how-to-stop-card-testing-bots-at-checkout/#level)
- [Step 3. Set up the human check in three steps](https://docs.wpeasycart.com/docs/how-to-guides/how-to-stop-card-testing-bots-at-checkout/#human)
- [Step 4. Decide what happens in an attack](https://docs.wpeasycart.com/docs/how-to-guides/how-to-stop-card-testing-bots-at-checkout/#attack)
- [Review flagged orders](https://docs.wpeasycart.com/docs/how-to-guides/how-to-stop-card-testing-bots-at-checkout/#orders)
- [What to do during an attack](https://docs.wpeasycart.com/docs/how-to-guides/how-to-stop-card-testing-bots-at-checkout/#during)
- [If a real customer is paused](https://docs.wpeasycart.com/docs/how-to-guides/how-to-stop-card-testing-bots-at-checkout/#shoppers)
- [If it does not work](https://docs.wpeasycart.com/docs/how-to-guides/how-to-stop-card-testing-bots-at-checkout/#troubleshooting)

**Where to find it:** WP Admin › EasyCart › Settings › Cart & Checkout › Checkout protection

*Before you start*

## What card testing is

What bots do, what it costs you and how WP EasyCart stops it.

### What card testing is and how the protection works

What you need and what it costs you

**What you need.** An up to date WP EasyCart. Checkout protection is free on every edition and is on by default at the Standard level for every store. The human check needs a free Cloudflare or Google account.

**The attack.** Bots use checkouts to find out which stolen card numbers still work. They try many cards, often for a very small amount, such as a $1 donation. Every attempt costs you a gateway fee. The tests that succeed become disputes, and enough disputes can get your payouts held.

**The defence.** WP EasyCart counts failed payments from each device, network address, email and card. Too many in a short time pauses that source. When declines spike across the whole store, it calls an attack. Every shopper then gets a quick human check until things calm down, and you get an email.

You set it up in five steps: read the status, choose a level, add the human check, set what happens in an attack and know what to do when one starts.

> **💡 Note:** A bot does not need to buy anything. A declined test still costs you a gateway fee, so stopping the attempts is worth more than refunding the sales.

*Set it up*

## Four steps

Read the status, choose a level, add the human check and set the attack reaction.

### Step 1. Read the last 7 days

Settings › Cart & Checkout › Checkout protection

Open **EasyCart › Settings**, then **Checkout protection** under Cart & Checkout. The line at the top says where you stand, such as **Standard · a human check when something looks wrong**. **Worth a look** appears only when something needs you, such as a human check with no keys or attack emails turned off, each with a button that fixes it.

The status card shows **Protected** with your level, **Holding off an attack**, **Watching only** or **Not protected**. Beside it are four counts for the last 7 days: **card tests stopped**, **payments declined by the bank**, **attacks held off** and **paused shoppers who later paid**, and a chart of each day. The last count is the one to watch: it counts real customers your limits caught. Zero is good.

**Turn on extra checks now** starts attack mode by hand. During an attack the card offers **End it now** and **Keep extra checks on for 24 hours**.

![Checkout protection with the EasyCart menu: Protected at the Standard level and the last 7 days.](https://docs.wpeasycart.com/wp-content/uploads/2026/11/checkout-protection-overview-607.jpg)

### Step 2. Choose how strict

Standard suits almost every store

In **How strict**, **Protection level** has six choices: Off, Watch only, Relaxed, Standard, Strict and Custom. Under the one you pick, the card spells out its rules with the real numbers.

**Standard** ( recommended ): a shopper can fail 5 payments in 10 minutes, then waits 1 hour, and 10 in a day. A card that fails 5 times in a day is refused until tomorrow; another card still works, so a real shopper is never stuck. An attack starts at 8 declines in 15 minutes, 3 times the usual.
**Relaxed** ( many shoppers on one network, such as a school or an office ): 8 fails in 10 minutes, a 30 minute wait, 20 a day.
**Strict** ( attacked before ): 3 fails in 10 minutes, a 24 hour wait, 6 a day, and a payment that never opened your checkout page gets a human check.
**Watch only** stops nothing and lists what Standard would stop as “Would stop” under Activity. **Off** checks nothing. **Custom** takes your own numbers.

**Limit gift card and coupon guessing**: 10 wrong codes in 10 minutes pauses code entry for that shopper for an hour. Bots guess gift card numbers the same way they test cards.

![How strict on Standard, with its rules in plain words.](https://docs.wpeasycart.com/wp-content/uploads/2026/11/checkout-protection-level-607.jpg)

> **💡 Note:** Start on Standard. Change it only if real customers are being paused ( Relaxed ) or attacks are still getting through ( Strict ).

### Step 3. Set up the human check in three steps

Cloudflare Turnstile ( free ) or Google reCAPTCHA

Limits slow a bot down. A human check stops it. Most shoppers never tick anything: it passes by itself.

**When to ask**: **Never** ( the limits only ), **When something looks wrong** ( after a decline, during an attack ) or **Every payment** ( each shopper, once ).

Under **The check comes from**, pick **Cloudflare Turnstile ( free )**, free with no monthly limit, then follow its three steps:
**1. Get your keys.** Press **Open Cloudflare Turnstile**. In your free Cloudflare account choose Add widget, enter this site’s domain and pick Managed mode. Your site does not need to use Cloudflare otherwise.
**2. Paste them here.** Paste the **Site key** and the **Secret key** and press **Save keys**. The secret stays hidden once saved.
**3. Test them.** Press **Test the keys**. The check is drawn with your site key and Cloudflare confirms it with your secret key. When it passes, the chip reads **Keys work**.

Or pick **Google reCAPTCHA**, which uses the keys saved under Settings › Store › Accounts › Sign-in protection. Beside the steps, **What a shopper sees at payment** shows the payment form at first try, after a decline, during an attack and when paused.

If the check service is down, payments are never blocked: they carry on under stricter limits, half the tries before a pause and a pause of at least an hour. Without keys, protection still works, but during an attack payments that did not come from your checkout page are refused instead of checked.

![The human check with Cloudflare Turnstile: the three steps done, keys masked.](https://docs.wpeasycart.com/wp-content/uploads/2026/11/checkout-protection-human-607.jpg)

> **💡 Note:** The Payments must come from your checkout page switch in Fine-tune is safe with caching plugins, because the checkout always loads fresh.

### Step 4. Decide what happens in an attack

When an attack starts: four steps, in order

**When an attack starts** shows what the store does by itself when declines spike:

**1 · It starts**: at the number of declines in 15 minutes your level sets, such as 8 declines, 3 times the usual, so a busy store does not trip it on a normal day.
**2 · Every shopper** gets the human check and the number of failed payments you set here. With the human check on, bots are stopped by the check, so this mainly protects customers who mistype.
**3 · You hear**: **Email me** sends an email when an attack starts and ends, to the address under **Send to**. Press **Send a test alert** to see one.
**4 · Back to normal** after a calm spell of 30 minutes, 1 hour, 4 hours or 24 hours.

**Flag orders that might be card tests**: a paid order during an attack, from a shopper with declines, gets **Possible card test** on the orders list and on the order.

While an attack is on, a banner runs across every WP EasyCart screen with buttons to see what is happening or keep extra checks on for 24 hours.

![When an attack starts: the four steps in order, and the order flag.](https://docs.wpeasycart.com/wp-content/uploads/2026/11/checkout-protection-attack-607.jpg)

*Keep it running*

## When it happens

Review flagged orders, what to do in an attack, real customers who get paused and what to check when it misbehaves.

### Review flagged orders

Refund a suspected test before it becomes a dispute

A flagged order shows a red **Possible card test** notice at the top of its order screen: this payment went through during a card-testing attack, after declined payments from the same shopper. If you do not recognise the customer, refund it before you ship anything. A quick refund stops it becoming a dispute.

Once your store has flagged an order, Orders gains a **Card tests** tile, which counts flagged orders from the last 30 days that are not yet refunded, cancelled or declined. There is also a **Checkout protection** filter with **Possible card tests**. The status card links to the same list as Orders flagged as possible card tests. The flag clears once the order is refunded or cancelled.

> **⚠️ Careful:** Do not ship a flagged order until you have checked it. Shipping to a stolen card is a lost product and a dispute.

### What to do during an attack

A short checklist

Protection is already working. You do not need to do anything right now. If you want to help it:

**1.** Open Checkout protection and read the status card. Press **Keep extra checks on for 24 hours** if the attack looks set to continue.
**2.** Check that the human check has working keys. Press Test the keys. An attack without keys is handled by refusing suspect payments, which is harsher on real customers.
**3.** Open **Activity** and press See all to filter the whole list, such as to Declined. Each row shows what happened, where, and a shortened form of the shopper. Add network addresses, addresses and email domains such as `@example.com` to **Always block** under Never limit, always block, in Trusted and blocked. Blocked shoppers only ever see the simple declined message.
**4.** Review the Card tests tile and refund what you do not recognise.
**5.** Look at your payment processor’s dashboard. Stripe, Square and PayPal all screen payments on their side, and their fraud tools, such as Stripe Radar and security-code and address checks, add a second layer. Ask your processor what it recommends if fees are rising. Leave the WP EasyCart webhook working, so declines in the payment form reach the Activity list.
**6.** Raise minimums. The page warns you when a donation product has a minimum under 5. Bots love $1 donations, and a higher minimum makes your store a poor target.
**7.** Afterward, look at **paused shoppers who later paid**. If it is not zero, consider Relaxed.

![Settings › Checkout protection › Trusted & blocked.](https://docs.wpeasycart.com/wp-content/uploads/2026/11/checkout-protection-lists-607.jpg)

### If a real customer is paused

Unpause, allow and reword

A paused shopper sees a friendly message and can pay again after the pause, or straight away after passing the human check. If they contact you:

**Unpause them.** In Trusted & blocked, the **Paused right now** list shows every source that hit a limit and when it ends. Press Unpause. **Clear all pauses**, under Start again, lets everyone try again at once.
**Never limit your own network.** Add your office or phone-order desk address to **Never limit** under Never limit, always block, one per line, ranges such as `198.51.100.0/24` allowed. Signed-in store staff are never limited.
**Trust returning customers** ( on ) gives signed-in customers who have paid you before double the limits.
**Reword the messages.** Edit the declined, paused and human-check wording in the Language editor, section Checkout Protection, or press Change the wording in every language. In **What shoppers see**, **Declined payment message** is Simple by default. Keep it, because a bank’s reason tells a card tester about a card.

### If it does not work

Symptoms and fixes

**Real shoppers keep getting paused.** Check the address WP EasyCart sees for visitors, under Fine-tune, **How visitors reach your site**. If your site is behind a proxy or a CDN and the address is wrong, every shopper looks like the same person. Leave it on Automatic unless your host told you otherwise. If many shoppers share a network, choose Relaxed.

**The check does not appear.** The keys are not saved, or the provider is unreachable. Press Test the keys. With When to ask on the middle choice, the check only shows when something looks wrong.

**Declines are not being counted.** Stripe reports declines through its webhook, so make sure the webhook works. See the payment errors guide.

**Activity and the status card are empty.** A store with no declines has nothing to show. If the page says its database table has not been created, load any WP EasyCart admin screen, or use the repair link on Diagnostics.

**You want the defaults back.** Press **Reset to recommended**, under Start again. It goes back to Standard with the recommended choices and keeps your keys and lists.

Need us? [Open a request in your account](https://wpeasycart.com/my-account).

*Keep going*

## Related panels

- [Payments](https://docs.wpeasycart.com/docs/administrative-console-guide/payments-setup/): Gateway setup, the second layer of defence.
- [Order Management](https://docs.wpeasycart.com/docs/administrative-console-guide/order-management/): Find, review and refund flagged orders.
- [Accounts](https://docs.wpeasycart.com/docs/administrative-console-guide/account-settings/): Where the reCAPTCHA keys live.
- [Language](https://docs.wpeasycart.com/docs/administrative-console-guide/language-settings/): Reword the declined and paused messages.

## Ready to run your store on WP EasyCart?

Everything in this guide works with the free plugin. PRO and Premium add subscriptions, memberships, wholesale pricing and more. Try every PRO feature free for 14 days.

[Start your free trial](https://www.wpeasycart.com/wp-easycart-professional-14-no-risk-trial/) · [See what is included](https://www.wpeasycart.com/wordpress-shopping-cart-pricing/)

![The WP EasyCart admin: orders and offers](https://docs.wpeasycart.com/wp-content/uploads/2026/09/cta-wpeasycart-pro-v2.jpg)

---

Source: https://docs.wpeasycart.com/docs/how-to-guides/how-to-stop-card-testing-bots-at-checkout/ ( updated 2026-11-06 )