Checkout Shield for WooCommerce

Checkout Shield blocks the scripted checkout submissions that CAPTCHA never sees.

Card testing bots don’t fill out your checkout form. They hit your store’s checkout API directly, completely skipping any reCAPTCHA or hCaptcha you’ve set up. That’s why CAPTCHA alone doesn’t stop them.

Your site signs a proof into the checkout page it serves. A submission that carries that proof loaded the page; one that doesn’t, didn’t. Submissions with no valid proof are stopped before WooCommerce processes the order.

What this stops, and what it does not

Being straight about this is more useful than a bigger promise.

It stops anything that posts to your checkout without loading the checkout page first: curl scripts, direct Store API calls, replayed form posts, and the card testing runs that work this way. This is the large majority of automated checkout abuse, and it is the part CAPTCHA misses.

It does not stop a bot that drives a real browser. Something that genuinely loads your checkout page receives a genuine proof, because that is exactly what the proof records. Once loaded, that proof stays valid for the life of the shopping session, so a script can reuse it. No proof of this kind can tell the second submission from the first, since the thing being proven is identical.

For that tier you want a bot mitigation service in front of the site (Cloudflare Bot Fight Mode, Sucuri) alongside this plugin. What this plugin can do is show you when it is happening: the dashboard reports payments that failed repeatedly from a single checkout visit, which is what working through stolen card numbers looks like.

Why Store Owners Choose This Plugin

• Catches what CAPTCHA misses — blocks bots hitting your checkout API directly, without asking shoppers to prove anything
• Works with any caching — LiteSpeed, Cloudflare, WP Rocket, W3TC — no conflicts
• Nothing to configure — no rules to write and no thresholds to tune
• Never blocks your customers by mistake — it only starts once it has seen a real checkout on your store work, and if your theme ever stops carrying the proof it detects that, keeps letting real shoppers through, and tells you what to fix
• No external services — everything runs on your server, no subscriptions
• Adds milliseconds — the check is local, with no third-party call to wait on

Features (Free)

• Automatic bot blocking — no rules to configure; it arms itself once it has seen one checkout on your store work
• 4 protection levels — Learning, Permissive, Balanced, and Strict — choose how aggressive you want to be
• Dashboard overview — see blocked vs verified orders at a glance with a 7-day chart
• Order status tracking — know which orders were flagged, passed, or blocked
• IP whitelist — let trusted addresses through, supports CIDR notation
• API key authentication — for headless and custom checkout setups
• Works with all checkout types — classic, block-based, and all payment gateways
• HPOS compatible — works with High-Performance Order Storage
• WooCommerce logging — full integration with WooCommerce Status logs

Pro Features

Take control with advanced tools:

• 3-level logging control — turn logging off, log blocked attempts only, or log everything
• Recent blocks feed — last 50 blocked attempts on your dashboard with email, payment method, and reason
• Automatic CDN/proxy detection — identifies real visitor IPs behind Cloudflare, Sucuri, or Akamai
• Stronger permissive mode — tighter bot detection with referrer verification
• Checkout details in logs — see which email and payment method bots tried to use
• Customer blocklist — block repeat offenders by email, name, address, phone, IP, or postal code
• One-click order blocking — block a customer directly from any order screen

Read the full description on the official page →