WooCommerce bot protection: what each option stops, door by door

A guide for store owners. Updated October 27, 2026.

Bots get into a WooCommerce store through five doors: the login, new account signups, the checkout, the coupon box and contact forms. Most tools guard one or two of them well, and none of them is the whole answer. This guide goes door by door through what WooCommerce, a CAPTCHA, Cloudflare, Wordfence and your payment provider cover, going by each one's own documentation. It also shows what's still open once the free ones are set up.

Door by door

1. The login

What bots do: guess passwords, on the login page and through XML-RPC. Out of the box, WordPress lets them guess forever.

Free options: Wordfence limits login attempts and has a login page CAPTCHA and two-factor login. A Cloudflare custom rule can challenge /wp-login.php (copy it here). The free Ropeline plugin locks an address out after 5 wrong passwords in 15 minutes (for 15 minutes, then an hour, then a day). When one account fails 10 times in an hour from 3 or more addresses, that account only opens on devices that have logged in before.

What's left: very little. This door is well covered for free. One of these is enough; you don't need all three.

2. The checkout

What bots do: card testing, which means running stolen card numbers through your checkout to find the ones that still work. The bots send orders straight to ?wc-ajax=checkout (the classic checkout) or to the Store API behind the checkout block (/wp-json/wc/store/v1/checkout), and they switch IP addresses as they go.

Free options:

• WooCommerce's own Rate limit Checkout switch, in WooCommerce, Settings, Advanced, Features. It's off by default. Turned on, it allows 3 checkout tries a minute from each shopper.
• Your payment provider's fraud rules. In Stripe, Radar can block payments that fail the CVC or postal code check.
• Cloudflare's free rate limiting rule can slow down the checkout block's address. It can only match the path, so it can't single out the classic checkout.
• A CAPTCHA, as long as your server checks it on every way into checkout (more on that below).
• The free Ropeline plugin counts your failed orders. When 10 or more payments fail within 24 hours, it warns you on its Overview and in the WordPress Dashboard. When 10 fail within an hour, it emails you.

What's left: the biggest gap. A bot that uses a new address for every card gets under any per-address limit. Your payment provider declines the card, but only after the bot has reached your checkout. Stopping card testing takes counting failed payments across the whole store. Wordfence's own support has said that taking orders is the e-commerce platform's job (more on that).

3. Signups

What bots do: make fake customer accounts, with throwaway email addresses, links in their names, or many accounts going to one inbox.

Free options: WooCommerce's account settings decide where accounts can be made at all. The fake accounts guide goes through each one. A CAPTCHA on the signup form helps, if your server checks it. The free Ropeline plugin counts the fake accounts already in your store, with the reason for each. It only reads, so it deletes nothing.

What's left: stopping fake signups as they arrive without putting a puzzle in front of every real customer.

4. The coupon box

What bots do: try code after code until one works.

Free options: WooCommerce's coupon settings (Usage limit per user, Allowed emails, Minimum spend) limit what a guessed code is worth. The coupon guessing guide goes through them.

What's left: the guessing itself. Those settings decide what a code can do once someone has it. They don't slow down a bot trying codes.

5. Contact forms

What bots do: post spam through contact forms and comments.

Free options: Contact Form 7 and WPForms already have spam settings, and both connect to a CAPTCHA. The contact form spam guide shows where each setting is.

What's left: mostly covered for free. What's missing is stopping spam without a CAPTCHA in front of real people.

Tool by tool

WooCommerce's own checkout limit

Free and built in, but off by default. Turned on, it allows 3 checkout tries a minute from each shopper, on the checkout block and the classic checkout. It slows a bot down. It doesn't stop one that switches addresses.

A CAPTCHA (Cloudflare Turnstile or Google reCAPTCHA)

Both have a free tier. Turnstile's free plan has up to 20 widgets and no limit on challenges. Google's reCAPTCHA includes 10,000 free checks a month, shared across your Google Cloud organization.

The catch is where the check happens. Cloudflare's own docs say that the client-side widget alone does not protect your forms: your server has to check each answer. At checkout, that means checking it on ?wc-ajax=checkout and the Store API, not just showing it on the checkout page, because bots that send orders straight to checkout never open the page. Each Turnstile answer can be checked once, within 5 minutes.

Cloudflare (free plan)

Cloudflare sits in front of your site and sees every request. The free plan gives you 5 custom rules and 1 rate limiting rule, and the Cloudflare rules tool writes them for you. Bot Fight Mode is free too, and challenges traffic that matches known bots. Cloudflare's docs say it can't be skipped with custom rules and may challenge API traffic. The checkout block sends orders through WooCommerce's Store API, so place a test order after you turn it on.

What Cloudflare can't see is what happens to a payment, so it can't tell a card tester from a shopper.

Wordfence

A security plugin for all of WordPress; its WordPress.org listing calls it Firewall, Malware Scan, and Login Security. The free version limits login attempts and has a login page CAPTCHA and two-factor login. It gets new firewall rules and malware signatures 30 days after Premium does. On fake orders, its support suggested rate limiting or IP blocks when the orders come from one IP address or range.

Your payment provider's fraud rules

Free, and worth turning on today. In Stripe, open Radar and block payments that fail the CVC or postal code check. PayPal and others have similar settings. These rules judge each payment after the bot has already reached your checkout. On some payment plans, every declined card adds a fee.

Ropeline

The free Ropeline plugin covers the login (lockouts and the botnet guard above), counts fake accounts and warns you about bursts of failed payments. Ropeline Pro guards the other four doors in the same plugin:

• Checkout:
  • 5 failed payments from one connection or one email address in an hour: that shopper's checkout pauses for an hour.
  • More than 6 checkout tries from one connection in 10 minutes: they're asked to wait 10 minutes.
  • 10 failed payments across your store in an hour: attack mode for 2 hours. Only shoppers who opened your real checkout page can pay, which stops bots that send orders straight to checkout, whatever address they use.
  It works on the classic checkout, the checkout block and pay-for-order pages.
• Signups: it stops signups that fill in a hidden field only bots can see, are sent in under 3 seconds, use a throwaway email address, or come from a network that has made more than 3 accounts in an hour. Accounts made while placing an order are never held to that limit.
• Coupons: 10 wrong codes in 15 minutes from one address pauses that address's coupon box for an hour.
• Contact forms and comments (Contact Form 7, WPForms, comments and product reviews): with no puzzle, it refuses posts sent in under 3 seconds or without loading the page, and limits each address to 5 posts in 10 minutes.
• AI shoppers: agents that prove who they are with a signature, like ChatGPT agent, can shop without limits.

A free setup to start with

1. Turn on WooCommerce's Rate limit Checkout.
2. Turn on your payment provider's fraud rules.
3. Protect the login with the free Ropeline plugin, or with Wordfence if you already run it.
4. If your site is on Cloudflare, add the free rules.
5. Switch on your form plugin's own spam settings.

That covers the login and contact forms well. The gap it leaves is at checkout, from bots that switch addresses on every card, and that's the gap Ropeline Pro's attack mode closes. Not sure where your store stands? The free store check shows in 10 seconds whether your checkout takes orders straight from scripts.

Questions

Do I need all of these?

No. For the login, one tool is enough. For card testing, use your payment provider's rules plus something that counts failed payments across the whole store.

Will a CAPTCHA on my checkout page stop card testing?

Only if your server checks it on every way into checkout. Card-testing bots send orders straight to ?wc-ajax=checkout or the Store API without opening the checkout page, so a CAPTCHA that's only on the page never runs for them.

Can I run Ropeline with Wordfence or Cloudflare?

Yes. Ropeline's compatibility tests run it next to Wordfence on a WooCommerce store with the checkout block. In the last run (October 13, 2026, with Wordfence 9.0.2), every check passed. Behind Cloudflare, Ropeline Pro trusts Cloudflare's addresses out of the box, so it sees each shopper's real address.

My store isn't on WordPress. Does any of this apply?

The doors are the same on any platform. Ropeline for any website guards them with one request from your server before each login, signup, checkout or form post.

Checked on October 27, 2026 against each tool's own pages: Cloudflare's docs on Turnstile's server-side check, Turnstile's plans and Bot Fight Mode; Google's reCAPTCHA tiers; Wordfence's WordPress.org listing and its support reply on fake orders. These tools change, so check their pages before relying on a limit.