WooCommerce abuse: fake checkouts, coupon attacks, and rate limits

Some WooCommerce problems are not dramatic hacks. They are automated abuse that drains performance and revenue by hammering checkout and guessing coupons. Treat those flows as revenue paths, not generic WordPress traffic.

Stores often wear down quietly. The site still loads. Orders still arrive. Meanwhile checkout feels inconsistent, support hears “it didn’t work,” CPU spikes do not match analytics, and abandoned checkouts drift upward.

Broader store hardening: WooCommerce security guide and protect your ecommerce site.

Fake checkouts and card testing

Bots hit add-to-cart and checkout actions to create load and run expensive WooCommerce logic. That can look like a hosting problem. Payment gateways also notice volume that looks like card testing: hundreds of different cards tried at checkout to see which stolen numbers still work.

If a gateway sees unchecked carding, you can lose the ability to take payments while you migrate processors. Showing that you rate-limit and block abuse is part of keeping that relationship.

Coupon brute forcing

Automation tries large volumes of coupon codes until something validates or a rule can be bent. Even failed guesses cost CPU, database queries, and attention. Teams then freeze promotions because coupons feel like a liability.

Signals that it is bots, not shoppers

You do not need perfect forensics. Look for:

• High-frequency cart and checkout actions
• Many different coupon codes in a short window
• Traffic with no product depth or realistic browse path
• Bursts at odd hours that do not match campaigns

Protect the revenue paths, then tune

Generic hardening helps. It often misses the real cost: repeated actions that force WordPress and WooCommerce to work for traffic with no intent to buy.

A practical approach:

1. Rate-limit sensitive WooCommerce actions so bots cannot hammer them forever
2. Limit coupon attempts so guessing stops paying off
3. Roll out with monitoring so you can tighten without blocking real shoppers (false positives hurt conversion)

WP Security Ninja’s Cloud Firewall includes WooCommerce-focused rate and coupon protection. Setup notes: WooCommerce rate and coupon protection. Broader firewall docs: firewall documentation.

Do not jump from “no protection” to the harshest thresholds in one step. Enable, watch what gets throttled, adjust for your peak traffic, then re-test add to cart → checkout → coupon → pay end to end.

Quick checklist

1. Confirm the pattern (checkout/cart spam, coupon spray) before changing rules
2. Protect checkout and coupons first; tune before you go aggressive
3. Re-test the full customer journey after every change

Related: beyond card testing

Card abuse is one playbook. Persistence and stealth show up elsewhere:

• Malware that kept coming back
• The helpful backdoor

For cleanup after a real compromise: malware scanner and malware removal.