Free help

Under a card-testing attack right now?

Failed orders piling up, a "Failed order" email every minute, maybe a warning from Stripe or PayPal? You're not the first, and it can be stopped. Here's what to do in the next 30 minutes, and where to get a hand.

The next 30 minutes

1. Find any orders that went through. In WooCommerce, Orders, look for orders from the same burst that are Processing or Completed. Don't ship them; refund them. Those cards are stolen.
2. Turn on your payment provider's fraud rules. In Stripe, open Radar and turn on blocking for payments that fail the CVC or postal code check. PayPal and others have similar settings.
3. Turn on WooCommerce's own checkout limit. In WooCommerce, Settings, Advanced, Features, turn on Rate limit Checkout (recent WooCommerce versions have it; it's off by default). It slows a bot down.
4. If the bot keeps buying one cheap product, set that product to private for now, or raise its price.
5. Tell your payment provider. They have seen this before, and it shows you're dealing with it.

The failed orders guide explains each step, and the card testing guide explains the attack.

Get a hand, free

Write to hello@getropeline.com with your store's address and what you're seeing: how many failed orders, since when, and which payment provider you use. A person reads every email and will help you work through it, free, whether or not you ever use Ropeline.

Please don't send passwords, card numbers or a login to your store. We never need them to help.

Stop it for good

Ropeline Pro stops card testing inside WooCommerce: it counts failed payments per address, per email and across your store, pauses the ones whose cards keep getting declined, and during an attack only takes orders from shoppers who opened your checkout page. It works from the first attack, even during its first-week learning mode, and when the attack is over it sends you one summary instead of hundreds of emails.