If you are seeing a sudden surge in a woocommerce fake order or a series of $0.00 transactions, your store is likely being used for a card testing order attack. This is a process where a bot order script tests thousands of stolen credit cards to see which ones are active.
Most owners assume that adding a reCAPTCHA is enough. However, advanced scripts bypass the front-end entirely and hit your checkout API directly. To stop them, you need a solution that validates the user’s session logic before the payment is ever processed.
The “Direct Hit” Problem
The reason a bot order can bypass your security is that it does not “browse” your site like a human. It sends a direct request to the /checkout/?wc-ajax=checkout endpoint. Because the bot never loads your actual checkout page, your reCAPTCHA script never runs, and your security plugins think the request is a legitimate checkout attempt.
The Solution: Session-Based Gatekeeping
To block a woocommerce fake order, we must ensure that the “Place Order” request only comes from someone who has actually loaded the checkout page in a real browser.
The strategy is simple:
When a legitimate user loads the checkout page, we set a “security flag” in their WooCommerce session.
When the “Place Order” button is clicked, we check for that flag.
If a request arrives without the flag, we know it is a bot order and we terminate the transaction.
The Custom Function to Stop Card Testing
Add the following code to your child theme’s functions.php file or via a code snippets plugin. This code creates a hidden requirement that card testing scripts cannot fulfill.
Why This Stops a Card Testing Order
This function is highly effective because it operates on the server side. Even if a bot manages to bypass your JavaScript or reCAPTCHA, it cannot “fudge” a WooCommerce session variable that it doesn’t know exists.
By requiring this specific flag, you effectively stop a card testing order at the door. The payment gateway (Stripe or PayPal) is never contacted, meaning you avoid transaction fees and protect your merchant reputation.
Managing a bot order problem manually is impossible. You need automated, logic-based defenses to stay ahead of modern scripts.
Is your WooCommerce checkout fully protected? – Free Security Audit
