Bots guessing WooCommerce coupon codes: how to spot it and stop it

A guide for store owners. Updated October 17, 2026. Settings are named as in WooCommerce 11.

A coupon box answers every guess straight away: this code works, or this one doesn't exist. WooCommerce doesn't limit how many codes one visitor can try, so a script can go through thousands of guesses for free: common words like WELCOME or SAVE20, numbered codes, lists of codes leaked from other stores.

What a bot gets out of it

• Discounts you didn't mean to give out. A welcome code meant for newsletter signups, a code you gave one influencer, a staff discount, or a 100%-off code left over from testing the shop.
• Gift cards with money on them. Some gift card plugins take their codes in the same box. A guessed gift card is a customer's money spent by someone else.
• Codes to sell or share. A working code ends up on coupon sites, and you pay the discount on every order that uses it.

Signs it's happening

• A code you only gave to a few people shows up on lots of orders, or on orders from new accounts.
• Orders with big discounts that you don't remember offering.
• In your server's access logs, lots of requests to ?wc-ajax=apply_coupon (the classic cart and checkout) or to /wp-json/wc/store/v1/cart/apply-coupon (the cart and checkout blocks) from one address, seconds apart. WooCommerce doesn't keep a record of wrong codes itself.

1. Make guessing pointless (free, in WooCommerce)

Open Marketing, Coupons and go through your codes:

• Use codes nobody can guess for anything valuable. The Generate coupon code button on the coupon screen makes a random one. Keep the easy, memorable codes for small public discounts that you don't mind people finding.
• Coupon expiry date. Give every code an end date, so an old code can't be found and used forever.
• Usage limit per coupon and Usage limit per user, under Usage limits. A code meant for one order should only work once.
• Allowed emails, under Usage restriction. A code made for one customer or one member of staff can be tied to their email address, so it's useless to anyone else.
• Minimum spend, for big discounts.
• Delete test coupons, above all anything that takes 100% off.

And if your store doesn't use coupons at all, turn the box off: WooCommerce, Settings, General, untick Enable the use of coupon codes. No box, nothing to guess.

2. Limit how many codes one visitor can try

A real shopper mistypes a code or two. Nobody types ten wrong codes in a quarter of an hour. Counting wrong codes per internet address and pausing the coupon box after a handful stops guessing cold. WooCommerce has no setting for it, so it takes a plugin or a firewall rule, and it has to cover both ways into the coupon box: the classic cart's apply_coupon request and the blocks' Store API. A rule on one alone leaves the other open.

How Ropeline Pro does it

Ropeline Pro's store plans guard the coupon box as part of checkout protection:

• 10 wrong codes in 15 minutes from one address pauses that address's coupon box for an hour. The shopper sees a message saying so, with a suggestion to contact the store if a real code isn't working.
• It covers the classic cart and checkout, and the cart and checkout blocks.
• Shoppers who have paid before, your staff, and addresses you've told it to always let in are never paused.
• A paused shopper can still check out; only the coupon box waits.
• For its first 7 days Ropeline only records what it would have stopped, so you can see it won't get in anyone's way.

The same plan limits checkout tries and stops card-testing bots: see the card testing guide.

Questions

What about shoppers using coupon-finder browser extensions?

Some extensions try a list of codes for the shopper at checkout. One that tries 10 wrong codes within 15 minutes gets the coupon box paused for that shopper for an hour, like anyone else. They can still buy, just without a code.

Does it work with gift card plugins?

When a gift card plugin takes its codes in WooCommerce's coupon box, wrong gift card codes count the same way. Gift card plugins with a box of their own aren't covered.

Can I change the limit?

Yes. A developer can change the number of wrong codes, the time window and the pause with the ropeline_coupon_limits filter.