What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Stop spam orders in WooCommerce by layering controls instead of relying on one switch: put a checkout CAPTCHA in front of automated shoppers, observe fraud-risk scores before blocking, set velocity and payment-attempt limits based on your normal traffic, blacklist confirmed abusive identifiers, whitelist trusted buyers, and rate-limit Checkout Block and Store API requests when bots bypass the visible checkout. Keep your payment gateway’s fraud and chargeback controls enabled throughout.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What counts as a spam order?
Spam orders are orders created mainly to abuse the checkout rather than to complete a legitimate purchase. They include fake names and addresses, repeated low-value attempts, automated submissions, and card-testing activity in which criminals try payment details to discover which cards work. WooCommerce notes that “Many fake orders and card testing attempts are not placed by a person at all.” That distinction matters: a store can have an apparently normal checkout form while a script sends requests directly to checkout endpoints.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Your WooCommerce Store Is a Target: A Non-Technical Owner's Guide to Fraud, Security and Not Getting... | $9.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
There are two related problems to separate:
- Automated checkout abuse: bots submit forms or API requests at speed, creating fake orders, consuming stock, triggering emails, or burdening staff.
- Payment fraud and card testing: an attacker uses your checkout to test payment credentials. A request may look like a valid order until the gateway responds.
No fraud system catches every fraudulent transaction. WooCommerce explicitly states that “No fraud prevention system can identify every fraudulent transaction.” The practical objective is to make abuse expensive and slow, stop obvious patterns early, and route uncertain orders for review without blocking good customers.
Use this rollout order
Apply controls in the following order. It gives you evidence before you create rules that could reject legitimate buyers.
- Record examples of fake orders and identify repeated values.
- Enable a checkout CAPTCHA.
- Turn on fraud-risk scoring and watch the results.
- Set order-velocity and payment-attempt thresholds from your own baseline.
- Add narrow blacklist rules for confirmed abuse and whitelist trusted exceptions.
- Enable Checkout Block and Store API rate limiting if direct endpoint traffic continues.
- Retain payment-gateway fraud controls, test every checkout path, and monitor the result.
1. Build an evidence baseline before blocking
Start with a sample of fake, held, cancelled, or failed orders. The goal is not to guess a universal threshold; WooCommerce recommends store-specific settings because a busy retailer and a small specialist shop have very different normal behavior.
Record repeated identifiers
- Email addresses and email domains.
- Phone numbers.
- IP addresses, where your store records them reliably.
- Billing and shipping details, including repeated addresses or unusual location patterns.
- Countries and other shipping locations.
- Payment methods and repeated gateway responses.
- Order values, quantities, and the number of attempts in a short period.
Look for combinations rather than a single suspicious field. A disposable-looking address by itself may be legitimate; the same address paired with dozens of payment attempts is stronger evidence. Keep a record of legitimate customers who resemble a pattern so you can create a whitelist exception later.
Recommended Free Tools
Separate symptoms from causes
A burst of orders may be a bot, a marketing campaign, or a broken integration retrying requests. Check whether the activity appears in the normal checkout, Checkout Block, or Store API flow, and whether payment attempts actually reached the gateway. This distinction determines whether a CAPTCHA, a fraud rule, an API limit, or a gateway control should do the work.
2. Put a CAPTCHA on checkout
WooCommerce documents two checkout CAPTCHA options: Cloudflare Turnstile and Google reCAPTCHA v2. Both are intended to distinguish ordinary shoppers from automated submissions before the order is accepted.
| Option | Documented characteristic | Practical choice |
|---|---|---|
| Cloudflare Turnstile | Privacy-focused and low-friction | Use when you want bot screening with minimal visible challenge for customers. |
| Google reCAPTCHA v2 | Uses its established challenge model | Use when that challenge experience is acceptable for your audience and checkout design. |
Configure the CAPTCHA for the checkout surface your customers actually use. A CAPTCHA on a visible page will not by itself protect a custom integration that sends requests directly to an endpoint. After enabling it, place a normal test order with each payment method and confirm that the challenge does not prevent a legitimate completion.
When CAPTCHA helps—and when it does not
CAPTCHA is strongest against automated submissions that must interact with the protected checkout. It is not a substitute for gateway fraud screening, address checks, or rules for a known abusive email domain. It also cannot solve every attack in which a script talks directly to an API route that the CAPTCHA does not cover. Treat it as the first layer, not the complete policy.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match3. Observe fraud-risk scores before you auto-block
WooCommerce Anti-Fraud Protection combines fraud-risk scoring, order blacklisting, smart whitelisting, and Google reCAPTCHA. High-risk orders can be moved automatically to Pending Risk Review. This gives staff a chance to inspect an order before fulfilment or cancellation.
Start in observation mode
WooCommerce’s recommended sequence is to configure reCAPTCHA, start with risk scoring to observe behavior, establish whitelists, and only then add blacklists after patterns are clear. Risk scoring is for review; a blacklist match can stop checkout immediately. That difference is operationally important:
- Risk score: flags an order for human or workflow review and can place it in Pending Risk Review.
- Blacklist match: can prevent an order, cancel it, or block registration, depending on the action you choose.
Review a meaningful run of flagged orders. Note which signals correctly identify abuse and which are common among genuine customers. If a business customer, partner, or known location is repeatedly flagged, add a narrow whitelist entry before tightening automatic actions.
Review before fulfilment
Pending Risk Review should be part of your fulfilment process. Decide who checks the queue, how quickly they respond, and what evidence is sufficient to release or cancel an order. Do not promise a shipping time that assumes every flagged order will pass automatically. The scoring feature reduces blind fulfilment; it does not make the decision for every case.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems4. Set velocity and payment-attempt limits from your normal traffic
Velocity rules target behavior that is suspicious because of its frequency: many orders, checkout attempts, or payment attempts in a short interval. WooCommerce advises using thresholds based on your store’s own behavior rather than generic defaults.
Choose the measurements
- Orders from the same email address or domain.
- Orders associated with the same IP address.
- Payment attempts tied to a customer, address, or device pattern that your controls expose.
- Repeated attempts within the same short time window.
- Unusual bursts compared with your ordinary order rate.
Use a baseline that includes promotions, launches, and other legitimate peaks. A threshold that is safe on a quiet weekday may reject buyers during a sale. If your system supports separate actions, hold suspicious activity for review before cancelling it; this preserves a recovery path when the threshold is too strict.
Recognize card-testing behavior
Card testing often produces many quick attempts, small or inconsistent order values, and repeated failures. A failed payment is not proof of criminal intent—customers mistype details and banks decline legitimate purchases—but a cluster of attempts deserves scrutiny. Let gateway controls handle payment-specific signals while your WooCommerce rules handle order and checkout behavior.
5. Blacklist confirmed patterns and whitelist trusted exceptions
Blacklist rules should be narrow and evidence-based. WooCommerce documents conditions that can include email address or domain, phone number, IP address, shipping location, billing details, and order value. Depending on the rule and configuration, the action can prevent an order, cancel it, or block registration.
Build a narrow blacklist
Begin with identifiers that recur across confirmed abusive orders. A specific address or email domain is usually safer than a broad country-wide rule. Add one condition at a time and watch for legitimate customers who share it. If the abuse changes identifiers frequently, combine signals rather than expanding a single overly broad rule.
Use whitelists to reduce false positives
Smart whitelisting is the counterweight to blacklisting. Add trusted customers, partners, payment methods, or locations that your evidence shows are legitimate. Keep entries specific and review them periodically; a permanent exception for a shared email domain can become a loophole if ownership changes.
Choose the least destructive action that meets the need
- Prevent the order when the identifier is clearly abusive and stopping checkout immediately is appropriate.
- Cancel the order when you need the record for audit or customer-service handling but do not want it fulfilled.
- Block registration when account creation itself is part of the abuse.
Document why each rule exists. When a customer asks why checkout failed, staff should be able to identify the matching condition and remove or adjust it without deleting unrelated protections.
6. Rate-limit Checkout Block and Store API traffic
Some bots do not behave like a shopper in the browser. They call checkout endpoints directly, including the Store API used by Checkout Block and headless or custom flows. WooCommerce documents a rate-limiting setting for Checkout Block and Store API checkout endpoints to reduce abuse and excessive calls.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →When to enable it
Use API rate limiting when logs or order patterns show direct endpoint traffic, when the visible checkout CAPTCHA has not reduced the abuse, or when an integration is generating excessive calls. Apply the limit carefully: legitimate mobile apps, headless storefronts, fulfilment tools, and other integrations may depend on the same endpoints.
Validate integrations after the change
- List every legitimate client that submits or updates checkout data.
- Enable the documented rate-limiting setting.
- Run a complete test order through Checkout Block.
- Test any headless or custom Store API flow and each payment method it uses.
- Watch for rejected requests from legitimate clients before tightening the limit further.
Rate limiting controls request volume; it does not decide whether a buyer or card is fraudulent. Pair it with risk scoring, blacklists, and gateway controls.
7. Keep payment-gateway fraud controls active
WooCommerce’s fraud features do not replace payment-gateway controls and do not address every kind of fraud. Keep gateway fraud screening, payment authentication, and chargeback workflows enabled according to your provider’s rules. The gateway sees payment signals that WooCommerce may not, while WooCommerce sees order, account, and checkout behavior.
The two layers have different jobs:
- WooCommerce controls: CAPTCHA, order risk scoring, blacklists, whitelists, velocity rules, and Store API rate limiting.
- Gateway controls: payment authorization decisions, payment-specific risk signals, and chargeback handling.
If an order is stopped before payment, the gateway may never receive an authorization request. If it reaches the gateway, a gateway decline or review can still protect you even when the WooCommerce order appears normal.
What WooCommerce Anti-Fraud Protection covers
WooCommerce describes its fraud-prevention capability as watching checkout for “signs of automated or malicious shopper behavior — card testing, bot-driven checkout attempts, and similar abuse.” That makes it relevant to spam orders, but availability matters: the consulted WooCommerce documentation says the Fraud Prevention feature is currently limited to WordPress.com stores running on WP Cloud.
Do not assume that documentation describes every self-hosted WooCommerce installation or every extension configuration. Confirm that the feature is available in your store’s environment before designing a policy around Pending Risk Review, risk scoring, or the associated blacklist and whitelist controls. Where it is unavailable, use the controls your checkout, payment gateway, and installed extensions actually expose.
Compare controls by the decision you need to make
| Control | Primary target | Acts before payment or after order creation | Review and false-positive handling | Important compatibility note |
|---|---|---|---|---|
| Checkout CAPTCHA | Automated shoppers and scripted checkout submissions | Before an order is accepted | Low-friction Turnstile or challenge-based reCAPTCHA; test legitimate checkout | Protects the checkout surface where it is configured; direct API traffic may need separate protection |
| Fraud-risk scoring | Orders with suspicious behavior, including bot-driven attempts and card testing signals | During order evaluation; can move high-risk orders to Pending Risk Review | Designed for observation and review before aggressive blocking | Availability of WooCommerce Fraud Prevention is currently limited to WordPress.com stores on WP Cloud, according to its documentation |
| Blacklist rules | Known abusive emails, domains, phones, IPs, locations, billing details, or order values | Can stop checkout immediately or act on the order | Narrow rules and whitelists reduce false positives | Actions can include preventing an order, cancelling it, or blocking registration |
| Velocity and payment-attempt limits | Bursts and repeated attempts | At the threshold you configure | Use your own baseline; hold or review where possible | Generic thresholds can reject legitimate peaks |
| Checkout Block and Store API rate limiting | Excessive direct endpoint calls | Before the endpoint processes unlimited requests | Monitor legitimate integrations after activation | Relevant to Checkout Block and Store API checkout endpoints, including custom or headless flows |
| Payment-gateway fraud controls | Payment authorization risk and chargebacks | At payment authorization and post-payment stages | Use the gateway’s review and dispute processes | WooCommerce says these controls remain necessary and are not replaced by its fraud features |
Troubleshooting common outcomes
Spam continues after CAPTCHA
Check whether the orders arrive through a direct Store API or Checkout Block endpoint rather than the protected visible checkout. Enable the documented API rate limiting, then verify that legitimate integrations still function. If requests reach payment, review gateway fraud controls and payment-attempt patterns.
Legitimate customers are blocked
Inspect the exact blacklist condition or velocity threshold that matched. Replace broad rules with a narrower email, domain, phone, IP, location, billing, or order-value condition; add a trusted customer or partner to the whitelist when appropriate; and lower the aggressiveness of automatic actions while you observe risk scores.
Free tools Windows power users keep installed
One-click scans. No signup required.
The review queue is too large
Separate high-confidence blacklist matches from uncertain risk scores. Use automatic prevention only for confirmed patterns, while routing ambiguous orders to Pending Risk Review. Refine thresholds around your normal order volume instead of applying a generic limit.
An integration starts failing after rate limiting
Identify which client is sending the rejected requests and confirm whether it uses Checkout Block or Store API endpoints. Test its complete checkout and payment flow, then adjust the rate-limiting policy so legitimate traffic works without reopening an unrestricted endpoint.
Payment declines rise but fake orders do not disappear
That pattern points to card-testing pressure rather than only fake order creation. Keep the gateway’s fraud controls active, examine payment-attempt velocity, and use WooCommerce risk review or narrow blacklist rules for recurring identifiers. Do not treat every decline as proof that the customer is fraudulent.
Operate the controls after launch
Anti-spam settings need maintenance because attackers change identifiers and legitimate traffic changes with your business.
- Review blocked, cancelled, and Pending Risk Review orders on a regular schedule.
- Compare false positives with confirmed abuse before changing a rule.
- Recheck velocity thresholds after promotions, product launches, or seasonal volume changes.
- Audit whitelist entries so old exceptions do not bypass current protections.
- Test Classic Checkout, Checkout Block, and any headless or custom Store API flow that your business supports.
- Retest every payment method after changing CAPTCHA, risk, blacklist, or rate-limiting settings.
- Keep gateway fraud and chargeback controls enabled even when WooCommerce appears to stop the spam.
The most resilient setup is layered: CAPTCHA removes much automated browser traffic, scoring separates reviewable risk from ordinary orders, velocity limits contain bursts, narrow blacklists stop known patterns, whitelists protect trusted buyers, API rate limiting covers direct endpoint abuse, and the gateway handles payment-specific risk.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
