Does Wordfence stop card testing on WooCommerce?

A guide for store owners. Updated October 22, 2026.

Your store runs Wordfence, and bots are still putting stolen cards through your checkout. It's fair to ask whether the security plugin you already have should be stopping them. Wordfence is a security plugin for all of WordPress: its WordPress.org listing calls it Firewall, Malware Scan, and Login Security. Card testing happens in the store part of your site, and Wordfence's own support team has said as much.

What Wordfence's support says

A store owner asked in Wordfence's support forum about a flood of fake orders, all for the same product, each with a different name and IP address. Wordfence's support replied that taking orders is specific to e-commerce platforms rather than WordPress itself (the full reply, November 2025). They suggested Wordfence's rate limiting or manual IP blocks if the orders come from the same IP address or range, and pointed to fraud add-ons for WooCommerce.

That's an honest answer, and this guide takes it at its word. It makes no claims about how Wordfence works inside. It explains why card testing needs a different kind of check, and what that check is.

Why card testing needs a different kind of check

A card-testing order looks like any other order. The bot sends the same kind of request a real shopper's browser sends, to ?wc-ajax=checkout (the classic checkout) or to the Store API behind the checkout block (/wp-json/wc/store/v1/checkout). What gives it away is what happens next: the card is declined, then the next one, then the next. Seeing that takes counting failed payments, which WooCommerce and your payment provider know about, per shopper and across the whole store.

Card-testing bots also switch IP addresses between tries, as the store owner in that thread saw: a different one on every order. Blocking addresses one at a time, or limiting each address, doesn't keep up when each address only tries a card or two.

You don't have to remove Wordfence

Card testing just needs something that watches payments as well. Ropeline's compatibility tests run Ropeline and Ropeline Pro next to Wordfence on a WooCommerce store with the checkout block: real shoppers log in, sign up and buy, card testers get paused and attack mode holds.

What does stop card testing

1. Your payment provider's fraud rules (free). In Stripe, open Radar and turn on blocking for payments that fail the CVC or postal code check. PayPal and others have similar settings.
2. Counting failed payments, not just requests. Per connection, per email address and across the whole store. A shopper whose cards keep getting declined isn't shopping.
3. Attack mode. When failed payments pile up across the store, only take orders from shoppers who opened your checkout page. Bots that send orders straight to checkout never do.
4. A bot check on every way in. A CAPTCHA that only sits on the checkout page never runs for bots that skip the page. It has to guard ?wc-ajax=checkout and the Store API too.
5. WooCommerce's own checkout limit (free). Recent WooCommerce versions have a Rate limit Checkout switch in WooCommerce, Settings, Advanced, Features. It's off by default. Turned on, it allows 3 checkout tries a minute from each shopper, on the checkout block and the classic checkout. It slows a bot down; it doesn't stop one that switches addresses.

Being card-tested right now? Start with the free steps in the failed orders guide: find and refund any orders that went through, turn on your payment provider's fraud rules, and tell your provider.

How Ropeline Pro does it

Ropeline Pro is a WordPress plugin that watches your WooCommerce checkout and steps in on its own:

• 5 failed payments from one connection or one email address in an hour: that shopper's checkout pauses for an hour.
• More than 6 checkout tries from one connection in 10 minutes: they're asked to wait 10 minutes.
• 10 failed payments across your store in an hour: attack mode for 2 hours. Only shoppers who opened your real checkout page can pay, which stops bots that send orders straight to checkout, from any address. You get an email when it starts.
• Attack mode works from the first attack, even during Ropeline's first-week learning mode.
• Works with the classic checkout, the checkout block and pay-for-order pages, and with Stripe, PayPal and other gateways that mark a declined payment as failed.

Not ready for Pro? The free Ropeline plugin counts your failed orders. When 10 or more payments fail within 24 hours, it warns you on its Overview and in the WordPress Dashboard, with what to do next. And the free store check shows in 10 seconds whether your checkout takes orders straight from scripts.

Questions

Will Wordfence's rate limiting help?

Wordfence's support suggested it for orders that come from the same IP address or range. Card-testing bots switch addresses, so also count failed payments per email address and across the store.

Can I run Ropeline and Wordfence together?

Yes. It's one of the setups Ropeline's compatibility tests build: a WooCommerce store with Wordfence, the checkout block and Ropeline Pro. In the last run (October 13, 2026, with Wordfence 9.0.2), every check passed.

Will Ropeline Pro block my real customers?

It's built not to. A pause only follows repeated declines from the same connection or email. During attack mode, shoppers who go through your checkout page, as almost everyone does, can still pay. Logged-in customers who have paid before skip the checkout-tries limit and attack mode.

Why do the failed orders say "Unknown" under Origin?

Because the bots never opened your shop, so WooCommerce got no attribution with the order. Real orders can say it too, so it's a hint, not proof: see the failed orders guide.