How-to › Fix common problems
How to Stop Card-Testing Bots at Checkout
Stop bots from testing stolen cards at your checkout. You read the status, choose a level, add a human check, set the attack reaction and review flagged orders. 9 parts.
Quick links
Where to find it:WP Admin › EasyCart › Settings › Cart & Checkout › Checkout protection
Before you start
What card testing is
What bots do, what it costs you and how WP EasyCart stops it.
What card testing is and how the protection works
What you need and what it costs you
What you need. An up to date WP EasyCart. Checkout protection is free on every edition and is on by default at the Standard level for every store. The human check needs a free Cloudflare or Google account.
The attack. Bots use checkouts to find out which stolen card numbers still work. They try many cards, often for a very small amount, such as a $1 donation. Every attempt costs you a gateway fee. The tests that succeed become disputes, and enough disputes can get your payouts held.
The defence. WP EasyCart counts failed payments from each device, network address, email and card. Too many in a short time pauses that source. When declines spike across the whole store, it calls an attack. Every shopper then gets a quick human check until things calm down, and you get an email.
You set it up in five steps: read the status, choose a level, add the human check, set what happens in an attack and know what to do when one starts.
💡 Note: A bot does not need to buy anything. A declined test still costs you a gateway fee, so stopping the attempts is worth more than refunding the sales.
Set it up
Four steps
Read the status, choose a level, add the human check and set the attack reaction.
Step 1. Read the last 7 days
Settings › Cart & Checkout › Checkout protection
Open EasyCart › Settings, then Checkout protection under Cart & Checkout. The line at the top says where you stand, such as Standard · a human check when something looks wrong. Worth a look appears only when something needs you, such as a human check with no keys or attack emails turned off, each with a button that fixes it.
The status card shows Protected with your level, Holding off an attack, Watching only or Not protected. Beside it are four counts for the last 7 days: card tests stopped, payments declined by the bank, attacks held off and paused shoppers who later paid, and a chart of each day. The last count is the one to watch: it counts real customers your limits caught. Zero is good.
Turn on extra checks now starts attack mode by hand. During an attack the card offers End it now and Keep extra checks on for 24 hours.
Step 2. Choose how strict
Standard suits almost every store
In How strict, Protection level has six choices: Off, Watch only, Relaxed, Standard, Strict and Custom. Under the one you pick, the card spells out its rules with the real numbers.
Standard ( recommended ): a shopper can fail 5 payments in 10 minutes, then waits 1 hour, and 10 in a day. A card that fails 5 times in a day is refused until tomorrow; another card still works, so a real shopper is never stuck. An attack starts at 8 declines in 15 minutes, 3 times the usual.
Relaxed ( many shoppers on one network, such as a school or an office ): 8 fails in 10 minutes, a 30 minute wait, 20 a day.
Strict ( attacked before ): 3 fails in 10 minutes, a 24 hour wait, 6 a day, and a payment that never opened your checkout page gets a human check.
Watch only stops nothing and lists what Standard would stop as “Would stop” under Activity. Off checks nothing. Custom takes your own numbers.
Limit gift card and coupon guessing: 10 wrong codes in 10 minutes pauses code entry for that shopper for an hour. Bots guess gift card numbers the same way they test cards.
💡 Note: Start on Standard. Change it only if real customers are being paused ( Relaxed ) or attacks are still getting through ( Strict ).
Step 3. Set up the human check in three steps
Cloudflare Turnstile ( free ) or Google reCAPTCHA
Limits slow a bot down. A human check stops it. Most shoppers never tick anything: it passes by itself.
When to ask: Never ( the limits only ), When something looks wrong ( after a decline, during an attack ) or Every payment ( each shopper, once ).
Under The check comes from, pick Cloudflare Turnstile ( free ), free with no monthly limit, then follow its three steps:
1. Get your keys. Press Open Cloudflare Turnstile. In your free Cloudflare account choose Add widget, enter this site’s domain and pick Managed mode. Your site does not need to use Cloudflare otherwise.
2. Paste them here. Paste the Site key and the Secret key and press Save keys. The secret stays hidden once saved.
3. Test them. Press Test the keys. The check is drawn with your site key and Cloudflare confirms it with your secret key. When it passes, the chip reads Keys work.
Or pick Google reCAPTCHA, which uses the keys saved under Settings › Store › Accounts › Sign-in protection. Beside the steps, What a shopper sees at payment shows the payment form at first try, after a decline, during an attack and when paused.
If the check service is down, payments are never blocked: they carry on under stricter limits, half the tries before a pause and a pause of at least an hour. Without keys, protection still works, but during an attack payments that did not come from your checkout page are refused instead of checked.
💡 Note: The Payments must come from your checkout page switch in Fine-tune is safe with caching plugins, because the checkout always loads fresh.
Step 4. Decide what happens in an attack
When an attack starts: four steps, in order
When an attack starts shows what the store does by itself when declines spike:
1 · It starts: at the number of declines in 15 minutes your level sets, such as 8 declines, 3 times the usual, so a busy store does not trip it on a normal day.
2 · Every shopper gets the human check and the number of failed payments you set here. With the human check on, bots are stopped by the check, so this mainly protects customers who mistype.
3 · You hear: Email me sends an email when an attack starts and ends, to the address under Send to. Press Send a test alert to see one.
4 · Back to normal after a calm spell of 30 minutes, 1 hour, 4 hours or 24 hours.
Flag orders that might be card tests: a paid order during an attack, from a shopper with declines, gets Possible card test on the orders list and on the order.
While an attack is on, a banner runs across every WP EasyCart screen with buttons to see what is happening or keep extra checks on for 24 hours.
Keep it running
When it happens
Review flagged orders, what to do in an attack, real customers who get paused and what to check when it misbehaves.
Review flagged orders
Refund a suspected test before it becomes a dispute
A flagged order shows a red Possible card test notice at the top of its order screen: this payment went through during a card-testing attack, after declined payments from the same shopper. If you do not recognise the customer, refund it before you ship anything. A quick refund stops it becoming a dispute.
Once your store has flagged an order, Orders gains a Card tests tile, which counts flagged orders from the last 30 days that are not yet refunded, cancelled or declined. There is also a Checkout protection filter with Possible card tests. The status card links to the same list as Orders flagged as possible card tests. The flag clears once the order is refunded or cancelled.
⚠️ Careful: Do not ship a flagged order until you have checked it. Shipping to a stolen card is a lost product and a dispute.
What to do during an attack
A short checklist
Protection is already working. You do not need to do anything right now. If you want to help it:
1. Open Checkout protection and read the status card. Press Keep extra checks on for 24 hours if the attack looks set to continue.
2. Check that the human check has working keys. Press Test the keys. An attack without keys is handled by refusing suspect payments, which is harsher on real customers.
3. Open Activity and press See all to filter the whole list, such as to Declined. Each row shows what happened, where, and a shortened form of the shopper. Add network addresses, addresses and email domains such as @example.com to Always block under Never limit, always block, in Trusted and blocked. Blocked shoppers only ever see the simple declined message.
4. Review the Card tests tile and refund what you do not recognise.
5. Look at your payment processor’s dashboard. Stripe, Square and PayPal all screen payments on their side, and their fraud tools, such as Stripe Radar and security-code and address checks, add a second layer. Ask your processor what it recommends if fees are rising. Leave the WP EasyCart webhook working, so declines in the payment form reach the Activity list.
6. Raise minimums. The page warns you when a donation product has a minimum under 5. Bots love $1 donations, and a higher minimum makes your store a poor target.
7. Afterward, look at paused shoppers who later paid. If it is not zero, consider Relaxed.
If a real customer is paused
Unpause, allow and reword
A paused shopper sees a friendly message and can pay again after the pause, or straight away after passing the human check. If they contact you:
Unpause them. In Trusted & blocked, the Paused right now list shows every source that hit a limit and when it ends. Press Unpause. Clear all pauses, under Start again, lets everyone try again at once.
Never limit your own network. Add your office or phone-order desk address to Never limit under Never limit, always block, one per line, ranges such as 198.51.100.0/24 allowed. Signed-in store staff are never limited.
Trust returning customers ( on ) gives signed-in customers who have paid you before double the limits.
Reword the messages. Edit the declined, paused and human-check wording in the Language editor, section Checkout Protection, or press Change the wording in every language. In What shoppers see, Declined payment message is Simple by default. Keep it, because a bank’s reason tells a card tester about a card.
If it does not work
Symptoms and fixes
Real shoppers keep getting paused. Check the address WP EasyCart sees for visitors, under Fine-tune, How visitors reach your site. If your site is behind a proxy or a CDN and the address is wrong, every shopper looks like the same person. Leave it on Automatic unless your host told you otherwise. If many shoppers share a network, choose Relaxed.
The check does not appear. The keys are not saved, or the provider is unreachable. Press Test the keys. With When to ask on the middle choice, the check only shows when something looks wrong.
Declines are not being counted. Stripe reports declines through its webhook, so make sure the webhook works. See the payment errors guide.
Activity and the status card are empty. A store with no declines has nothing to show. If the page says its database table has not been created, load any WP EasyCart admin screen, or use the repair link on Diagnostics.
You want the defaults back. Press Reset to recommended, under Start again. It goes back to Standard with the recommended choices and keeps your keys and lists.
Need us? Open a request in your account.
Keep going
Related panels
Gateway setup, the second layer of defence.
Find, review and refund flagged orders.
Where the reCAPTCHA keys live.
Reword the declined and paused messages.
Ready to run your store on WP EasyCart?
Everything in this guide works with the free plugin. PRO and Premium add subscriptions, memberships, wholesale pricing and more. Try every PRO feature free for 14 days.
