Spam orders can cripple your WooCommerce store. They drain server resources, trigger chargebacks, damage your reputation with payment processors, and waste hours of your time dealing with fake transactions. Whether you’re seeing a handful of suspicious orders or hundreds of failed payment attempts, this guide covers every proven method to stop spam orders in WooCommerce—from free settings changes you can make right now to advanced security tools.
Why Spammers Target WooCommerce Stores
Before diving into solutions, it helps to understand why bots and fraudsters target online stores in the first place.
Card testing attacks are the most common reason. Criminals use stolen credit card numbers and need to verify which cards are still active. WooCommerce checkout pages are perfect targets because they process payments and return instant feedback on whether a card works.
Vulnerability scanning is another motive. Bots probe checkout forms looking for security flaws in outdated WooCommerce versions or poorly configured plugins.
Inventory manipulation happens when competitors or bad actors place fake orders to make products appear out of stock, hurting your legitimate sales.
Resource exhaustion attacks flood your store with requests, slowing down or crashing your site during peak traffic periods.
The good news: every method below addresses one or more of these attack types. We’ll start with free changes you can make inside WooCommerce itself, then move on to external tools and plugins.
1. Require User Account Registration
This is one of the quickest and most effective changes you can make—and it’s completely free.
By default, WooCommerce allows guest checkout, which means anyone (including bots) can place orders without creating an account. Requiring registration adds friction that stops most automated attacks while also giving you a way to track and block repeat offenders.
To enable this, go to WooCommerce > Settings > Accounts & Privacy and:
- Uncheck “Allow customers to place orders without an account”
- Check “Allow customers to create an account during checkout”
- Check “Allow customers to log into an existing account during checkout”
Now every customer must register before purchasing. If a spammer creates an account, you can block their email address to prevent future orders.
Bonus: In WordPress, go to Settings > General and uncheck “Anyone can register” to prevent spam WordPress user registrations that aren’t tied to WooCommerce.
2. Restrict Selling to Specific Countries
If you only ship to certain regions, there’s no reason to accept orders from the rest of the world. WooCommerce has built-in settings that let you restrict who can buy from your store based on their location.
Go to WooCommerce > Settings > General and find the Selling location(s) dropdown. Select “Sell to specific countries” and choose only the countries you actually serve. Do the same for Shipping location(s).
For example, if you only ship within the UK, select United Kingdom for both settings. Orders from other countries will be blocked automatically.
This eliminates a huge source of fraudulent orders since many spam attacks originate from countries outside typical Western markets.
3. Disable or Restrict Cash on Delivery
Cash on Delivery (COD) orders are a favourite target for spam because they don’t require any payment verification upfront. Fraudsters can place unlimited fake orders with no financial barrier—they never intend to pay when the package arrives.
If you don’t absolutely need COD, disable it entirely. Go to WooCommerce > Settings > Payments, find Cash on delivery, and toggle it off.
If COD is essential for your business (common in some regions), add protective restrictions:
- Require phone verification before processing COD orders
- Limit COD to returning customers with previous successful orders
- Set a maximum order value for COD transactions
- Restrict COD to specific shipping zones where you trust the delivery network
4. Add Honeypot Fields
A honeypot is a clever spam-fighting technique that doesn’t inconvenience real customers at all. It works by adding a hidden form field that’s invisible to humans but visible to bots. Real users never see or fill this field, but bots typically fill every field they find—including hidden ones. When a honeypot field contains data, you know the submission came from a bot and can block it.
WooCommerce doesn’t include honeypot protection by default, but you can add it with free plugins:
- WooCommerce Honey Pot Anti Spam – A simple, free plugin that adds honeypot fields to your WooCommerce login and registration forms
- CleanTalk Anti-Spam – A more comprehensive solution that includes honeypot plus other protections
Honeypots work best as part of a layered approach. They catch simple bots but won’t stop sophisticated attackers or manual fraud.
5. Use Anti-Fraud Plugins
If you’re dealing with persistent spam or want more sophisticated protection, dedicated anti-fraud plugins can analyse orders in real-time and flag or block suspicious transactions based on risk scoring.
WooCommerce Anti-Fraud (premium, from $79/year) checks orders against multiple risk factors:
- Mismatched billing and shipping addresses
- High-risk countries
- Suspicious email patterns (random characters, disposable email domains)
- IP geolocation mismatches
- Proxy or VPN usage
You can configure risk thresholds and automatically hold, cancel, or flag orders that exceed them.
CleanTalk Anti-Spam (free tier available, premium from $12/year) provides spam protection across your entire WordPress site, including WooCommerce orders, registrations, and reviews. It checks submissions against a global database of known spammers.
OOPSpam (free tier with 40 checks/month, premium plans available) offers similar protection with a focus on privacy—no cookies or tracking, and all spam logs stay in your local database.
Do You Actually Need to Pay for Anti-Spam Plugins?
Let’s be honest: most small to medium WooCommerce stores don’t need paid anti-fraud plugins.
If you implement the free methods in this guide—requiring registration, restricting countries, using Cloudflare’s free plan, and adding a honeypot—you’ll stop the vast majority of spam orders without spending anything. These aren’t “lite” solutions; they’re genuinely effective for typical spam problems.
When free is enough:
- You’re getting occasional spam orders (a few per week)
- Most spam comes from obvious bot patterns or foreign countries you don’t ship to
- Your payment gateway (Stripe, PayPal) is catching fraudulent payments before they complete
- You have time to manually review suspicious orders
When paid plugins make sense:
- You’re processing hundreds of orders daily and can’t manually review them
- You’re experiencing targeted attacks that adapt to your defences
- You’re seeing successful fraudulent orders that slip past your payment gateway
- Chargebacks are costing you real money (payment processors charge £15-25 per chargeback, plus you lose the product)
- You sell high-value items that attract sophisticated fraud
The maths is simple: if you’re losing more to fraud and chargebacks than a plugin costs, it’s worth it. If you’re losing £500/year to fraud, a £79 plugin pays for itself. If you’re losing £50/year, stick with free solutions.
One more thing worth noting: many “premium” anti-spam plugins are essentially wrappers around the same techniques covered in this guide—honeypots, country blocking, email validation. You’re often paying for convenience and a nice dashboard rather than fundamentally better protection. There’s nothing wrong with that if you value your time, but don’t assume expensive means more secure.
6. Enable Stripe Radar and 3D Secure
If you use Stripe for payments, you already have access to powerful fraud detection tools—you just need to make sure they’re properly configured.
Stripe Radar uses machine learning trained on billions of transactions across the Stripe network to identify and block fraudulent payments. It’s enabled by default on all Stripe accounts, but you can customise its rules in your Stripe Dashboard under Radar > Rules. For example, you can automatically block payments from specific countries or flag orders above a certain amount for manual review.
3D Secure (also called Strong Customer Authentication or SCA) adds an extra verification step where customers confirm their identity with their bank—usually through their banking app or a one-time code. This shifts chargeback liability to the bank and stops most card testing attacks because stolen card numbers alone aren’t enough to complete the purchase.
To enable 3D Secure in WooCommerce, make sure you’re using an up-to-date Stripe plugin like Payment Plugins for Stripe WooCommerce or WooCommerce Stripe Gateway by FunnelKit. In the plugin settings, enable 3D Secure or Strong Customer Authentication (SCA).
Legitimate customers see a quick bank verification popup. Fraudsters using stolen cards get blocked.
7. Use a Web Application Firewall (Cloudflare)
Everything we’ve covered so far happens after traffic reaches your website. A Web Application Firewall (WAF) takes a different approach—it filters malicious traffic before it even reaches your server, reducing load on your site and blocking attacks at the network level.
Cloudflare is the most popular WAF for WordPress sites. It sits between your visitors and your web hosting, analysing all incoming traffic and blocking known threats. Think of it as a security guard checking IDs at the door before anyone enters your store.
Setting Up Cloudflare (Free)
Cloudflare offers a generous free plan that includes basic bot protection, DDoS mitigation, and performance improvements. Here’s how to set it up:
- Go to cloudflare.com and create a free account
- Add your website domain and Cloudflare will scan your existing DNS records
- Cloudflare will give you two nameservers (e.g.,
anna.ns.cloudflare.com) - Log into your domain registrar (where you bought your domain) and replace your current nameservers with Cloudflare’s
- Wait for DNS propagation (usually 15 minutes to a few hours)
Once active, all traffic to your site flows through Cloudflare’s network, where it can be filtered and optimised.
Enabling Bot Fight Mode
In your Cloudflare dashboard, navigate to Security > Bots and toggle Bot Fight Mode to ON. This uses Cloudflare’s threat intelligence to identify and block known malicious bots before they can access your checkout pages.
While you’re there, enable Block AI Bots to prevent scrapers and automated tools from overloading your store.
These two toggles take seconds to enable but block a significant portion of automated spam orders.
8. Add Cloudflare Turnstile CAPTCHA
Traditional CAPTCHAs (like “select all the traffic lights”) are frustrating for users and can hurt your conversion rate. Cloudflare Turnstile is a modern alternative that verifies visitors are human without requiring them to solve puzzles. It runs invisible checks in the background, only presenting a challenge if something looks suspicious.
To set it up:
- In your Cloudflare dashboard, go to Turnstile in the left sidebar
- Click Add Widget and enter your website domain
- Choose “Managed” mode (automatically decides when to show challenges)
- Copy the Site Key and Secret Key that Cloudflare generates
- In WordPress, install the Simple Cloudflare Turnstile plugin
- Go to Settings > Cloudflare Turnstile and paste your keys
- Enable Turnstile for WooCommerce Login, Registration, and Checkout forms
This catches bots that slip past other protections without annoying your real customers.
9. Create Custom WAF Rules for Checkout
If you’re using Cloudflare, you can create custom rules that add extra protection to your most vulnerable pages—specifically your checkout and account pages where spam orders originate.
Go to Security > WAF > Custom Rules and create a new rule with these conditions:
- URI Path contains
/checkout/ - OR URI Path contains
/my-account/ - OR Query String contains
wc-ajax=checkout
Set the action to Managed Challenge. This forces suspicious visitors to verify they’re human before accessing your checkout or account pages.
You can also create a rule to block traffic from countries you don’t serve. Set Country does not equal your target countries (e.g., United Kingdom, United States) and set the action to Block. This stops fraudulent traffic before it even reaches WordPress.
10. Enable Rate Limiting
Rate limiting prevents any single visitor from making too many requests in a short time period. This is essential protection against card testing attacks, where criminals may attempt hundreds of transactions in minutes using different stolen card numbers.
In Cloudflare, go to Security > WAF > Rate Limiting Rules and create a rule targeting your checkout and cart pages:
- Match requests to
/checkout/,/cart/, and/my-account/ - Set a threshold like 10 requests per minute per IP address
- When exceeded, trigger a Block or Challenge action
This stops both brute-force attacks and high-volume spam order attempts while allowing normal shopping behaviour.
Quick Implementation Checklist
Start with the free methods that take minutes to set up, then add more protection as needed:
Free and fast (do these today):
- Require user registration in WooCommerce settings
- Restrict selling locations to your target countries
- Disable Cash on Delivery if you don’t need it
- Install a free honeypot plugin
Free but requires more setup:
- Set up Cloudflare (free plan)
- Enable Bot Fight Mode
- Add Cloudflare Turnstile to checkout
- Create WAF rules for checkout pages
- Configure Stripe Radar rules
Premium options for high-risk stores:
- WooCommerce Anti-Fraud plugin
- CleanTalk or OOPSpam paid plans
- Cloudflare Pro for advanced WAF rules
FAQs
What are the signs of spam orders in WooCommerce?
Common signs include multiple failed payment attempts from similar IP addresses, orders with mismatched billing and shipping countries, suspicious email addresses with random characters, unusually large orders from first-time customers, and spikes in orders during off-peak hours.
Does WooCommerce have built-in spam protection?
WooCommerce has minimal built-in protection. It relies on your payment gateway (like Stripe or PayPal) for basic fraud detection. For comprehensive protection, you need to combine WooCommerce settings with security plugins and services like Cloudflare.
Will these security measures affect legitimate customers?
When configured correctly, no. Features like Cloudflare’s Managed Challenge and Turnstile only prompt suspicious users. Legitimate customers from your target countries won’t notice any difference. Avoid overly aggressive rate limiting that might block customers with slow connections.
Can I use multiple anti-spam methods together?
Yes, and you should. Security works best in layers. Use Cloudflare to block bots before they reach your server, WooCommerce settings to restrict who can order, and anti-fraud plugins to catch anything that slips through. These tools complement rather than conflict with each other.
How do I stop card testing attacks specifically?
Card testing attacks require rapid payment attempts, so rate limiting is your first defence. Enable Stripe Radar and 3D Secure to verify cardholders. Require account registration to prevent anonymous checkout abuse. If attacks persist, temporarily enable CAPTCHA on your checkout page.
What should I do if I’m already under a spam attack?
If you have Cloudflare, enable “Under Attack” mode for immediate protection—this challenges all visitors before they can access your site. Block the attacking IP addresses or countries in your WAF rules. Review recent orders and cancel any that are clearly fraudulent. Once the attack subsides, implement the preventive measures in this guide.
Summary
Spam orders are an inevitable challenge for WooCommerce stores, but you don’t have to accept them. Start with the free protections built into WooCommerce itself—requiring registration, restricting countries, and disabling risky payment methods. Add honeypots and anti-fraud plugins for extra protection against bots. For stores facing persistent attacks or processing high volumes, a web application firewall like Cloudflare provides powerful network-level protection that stops threats before they reach your site.
The key is layered security. No single method stops every attack, but combining several makes your store a much harder target—and sends spammers looking for easier victims.
Author
