Store protection (Pro) rate-limits checkout, cart, and order placement, and temporarily blocks an IP that guesses coupon or promotion codes. WooCommerce and SureCart share one set of switches. Protection runs when either plugin is active.
Open Security Ninja → Firewall → Store. Cloud Firewall should be on so these limits sit with the rest of the firewall.
The tab shows whether WooCommerce, SureCart, or both are detected. If neither is active, the settings stay saved and start applying when you activate a supported store.
Two-factor authentication is not configured here. It lives under Login Protection. SureCart’s own dashboard login cannot finish a 2FA prompt. Anyone who must use 2FA signs in on the WordPress login page first.
What it covers
- Rate limiting: checkout attempts, add-to-cart actions, and order placement, on WooCommerce and SureCart
- Coupon and promotion codes: a temporary ban after too many invalid codes from the same IP
- Login country rules: when country blocking is set to login forms, WooCommerce login and registration are included, and a blocked country cannot sign in through SureCart either
A failed coupon apply returns a normal coupon error. It does not kill the request. A coupon ban on its own does not stop the customer from placing the order.
Rate limiting defaults
Turn on Enable Rate Limiting, then set the numbers. Defaults:
| Action | Default limit | Default window | You can set |
|---|---|---|---|
| Checkout | 3 attempts | 5 minutes (300 seconds) | 2 to 10 attempts, window 180 to 1800 seconds |
| Add to cart | 10 actions | 1 minute (60 seconds) | 5 to 20 actions, window 30 to 300 seconds |
| Order placement | 2 orders | 10 minutes (600 seconds) | 1 to 5 orders, window 300 to 3600 seconds |
When a limit is hit, the store shows an error. On WooCommerce, checkout may send the customer back to the cart. Raise the numbers on a busy store. A quiet store can stay near the defaults.
SureCart uses the same three limits on its checkout and cart REST routes (including adding a line item, and finalize, confirm, complete, or pay).
Coupon and promotion-code protection
Turn on Enable Coupon Protection.
Defaults: 10 failed codes within 5 minutes (300 seconds), then that IP cannot apply codes for 15 minutes (900 seconds).
The failed-attempt field accepts 5 to 15. Browser shopping helpers often try several codes on their own, so a limit under 5 is not offered. A saved value below 5 is shown as 5. That matters because this field sits on the Store tab of the same form as the other firewall tabs. An out-of-range number can stop every firewall tab from saving.
- WooCommerce: classic forms, AJAX, and block cart or checkout. One failed apply is counted once per request, even if WooCommerce reports the error twice. The Events log stores the code that was tried, not an internal error id.
- SureCart: the same counters and the same ban.
- A valid code clears the failure counter.
- The ban message includes the time left. Normal use resumes when the ban ends.
- Window: 180 to 1800 seconds. Ban length: 300 to 3600 seconds.
Checkout and payment URLs
Long tokens in a WooCommerce download link, a SureCart checkout URL, or a payment webhook can look like an exploit to Filter Suspicious Queries. On WooCommerce and SureCart checkout, order-pay, download, and webhook requests, a few of those query checks are skipped so the payment can finish. Calls to those URLs that use curl are not treated as a scraper. The rest of the firewall still runs. Request paths are checked on their own, separate from the query string.
While SureCart is active, a POST to a surecart/webhooks path is not stopped by a visitor IP ban or a country ban, so SureCart can deliver payment notices.
Turn it on
- Go to Security Ninja → Firewall → Store.
- Confirm WooCommerce, SureCart, or both show as detected.
- Enable rate limiting, coupon protection, or both.
- Set limits, windows, and the coupon ban length.
- Save.
- Place a test order and apply a valid code. Then try a bad code a few times and confirm a real shopper is not stuck.
The installation wizard can apply these defaults when a store plugin is already active. You can still change them here afterward.
If real customers are blocked, raise the limits and look in Security Ninja → Events. WooCommerce rows use actions that start with woo_. SureCart rows include surecart in the action name (rate limits, coupon bans, and blocked logins).
