Velocity Guard for WooCommerce – Fraud Protection, Stop Fake Orders & Card Testing

A burst of failed or declined orders in a short window — especially overnight, with tiny order totals or odd email addresses — is the signature of a card-testing bot. Attackers run stolen card numbers through your live checkout to find which ones still work. Velocity Guard detects the burst (many attempts from one IP, email, or session in minutes) and turns the extra attempts away before they reach your payment processor.

Very often, yes. A flood of declined authorizations spikes your decline ratio and chargeback risk, which is exactly what gets a Stripe or PayPal account flagged or frozen. Stopping the attempts at the door keeps your decline ratio clean. Velocity Guard rejects the abnormal burst before WooCommerce ever hands the attempt to your gateway, so the declines never hit your processor stats.

Those are card-testing probes. Criminals use a small amount because it's less likely to trip a bank's fraud alert, and they only need to know whether the charge succeeds. Every probe can still cost you an authorization/processing fee even when it's declined. Velocity Guard blocks the repeated attempts so you stop paying fees on fraud traffic.

Each checkout attempt that reaches your gateway can incur a fee, declined or not — so an automated attack racks up fees fast. Because Velocity Guard rejects the abnormal burst before the request reaches your payment processor, the attacker's attempts never generate billable gateway calls.

No. Velocity Guard runs entirely on your WordPress server. The free version has no external dependencies.

The default thresholds (5 orders per IP per 10 minutes, 3 per email per hour, 3 failed payments before auto-blocklist) are tuned to be invisible to normal shoppers. Every block is logged with rule + source so you can audit and tune per-rule from the settings page. Whitelist your staff IPs to bypass entirely.

Yes. Velocity Guard protects both the classic checkout (woocommerce_checkout_process hook) and the Cart/Checkout block Store API (woocommerce_store_api_checkout_order_processed and rest_pre_dispatch for direct REST hits).

Yes, but you need to tell the plugin which header carries the real client IP. Go to WooCommerce → Velocity Guard → Reverse proxy / CDN and select your provider (Cloudflare uses CF-Connecting-IP, Akamai uses True-Client-IP, etc.). Default is REMOTE_ADDR which is the safe choice when no proxy is in front of your site.

Yes, built HPOS-native from day one. No legacy meta-table queries.

Yes. The plugin won't activate without WooCommerce 8.0+ active.

The free version stops bots that don't load your page (curl, scripts, direct API hits without a session cookie) and rate-limits per identity (IP / email / session). Pro adds device fingerprinting (catches attackers that rotate IPs but keep the same browser), real-time alerts, and an updatable pattern library sourced from active vulnerability research.

Velocity Guard stores: timestamps of checkout attempts, source IPs, billing emails, session identifiers, and block reasons. It does NOT store card numbers, CVCs, or any PCI-sensitive data.