FAILED ORDERS
Dozens or thousands of failed orders in minutes
Order numbers jump, admin fills with failures, and notifications flood in.
Codeprint · WooCommerce checkout security
Stop WooCommerce card testing before it reaches your payment gateway.
Checkout Firewall combines checkout-flow proof, Cloudflare Turnstile, velocity limits, and failed-payment lockout across Classic Checkout, Checkout Blocks, and the WooCommerce Store API.
Challenge suspicious checkout traffic. Block clear abuse. Let real customers purchase.
- Free core at launch
- No Codeprint account
- No local usage cap
- PHP 8.0+
POST /?wc-ajax=checkoutflow-proof valid · velocity ok · returning customerALLOWPOST /?wc-ajax=checkoutflow-proof missing, recoverable → TurnstileCHALLENGEPOST /wp-json/wc/store/v1/checkoutip velocity exceeded · repeated gateway declinesBLOCKPOST /wp-json/wc/store/v1/checkoutsame email across rotating sessionsBLOCKIllustration of the kind of output the event log produces. Not a product screenshot—real interface captures replace this at launch.
01 — Recognize it
Does your store look like this right now?
Card testing turns a real checkout into a test harness for stolen card details. Not every failed order is card testing—but these patterns together deserve attention.
TINY TOTALS
Repeated attempts on your cheapest product
Small amounts are cheap to test and less likely to be noticed.
PROCESSOR CONTACT
Your processor warns about decline volume
Abnormal authorization-to-decline ratios can put the merchant account at risk.
INVISIBLE TRAFFIC
Attempts never load your checkout page
Requests hit WooCommerce Store API checkout routes directly.
ROTATION
New email and IP on every attempt
One blocked address changes little when the next request uses a different identity.
STILL HAPPENING
It continues after a simple bot blocker
A token check stops naive scripts, not automation that walks the normal checkout flow.
02 — How it works
Six layers, evaluated before the gateway is asked to charge anything.
No single layer is sufficient. The combination keeps cheap checks first, uses a recoverable challenge for uncertainty, and reserves hard blocks for clear abuse.
Layer 1
Checkout-flow proof
A legitimate checkout requests a short-lived signed token bound to the checkout and session context. Direct requests that skip the expected flow can be challenged or blocked.
Limit: It proves the expected flow—not a human—and is not enough by itself.
Layer 2
Turnstile when risk calls for it
Merchant-owned Cloudflare Turnstile keys are validated server-side. Standard Mode challenges suspicious traffic without putting every low-risk customer through a test.
Limit: Turnstile is an external service, and no challenge is infallible.
Layer 3
Velocity across several dimensions
Repeated behavior is evaluated by IP, billing email, WooCommerce session, and IP + email—not by one address alone.
Limit: Free uses conservative fixed thresholds; Pro adapts to distributed rotation.
Layer 4
Failed-payment feedback
Real gateway declines raise suspicion and can create a temporary local lockout. Form errors and broad gateway outages are treated differently.
Limit: This signal follows a gateway attempt, but helps shorten an active attack.
Layer 5
Allow, challenge, or block—with a reason
Every decision carries a stable reason code and readable explanation. Mistaken temporary blocks can be released in one click.
Limit: Challenges are preferred over hard blocks when risk is uncertain.
Layer 6
Emergency response, manual or automatic
Free adds a manual emergency posture with an expiry. Pro can move through Normal, Elevated, Attack, and Recovery states automatically.
Limit: Checkout Firewall never automatically disables the entire payment gateway.
03 — Under attack now
The first fifteen minutes matter more than the plugin you install.
Preserve evidence, contact your processor, verify safe controls, and avoid handing the attacker a new opening.
Open the 15-minute guide →IMMEDIATE CHECKLIST
- 01Preserve logs and attack evidence
- 02Contact the payment processor
- 03Verify safe or test-mode options
- 04Inspect Store API and traffic patterns
- 05Add layered checkout protection
Do not delete evidence or blindly disable the entire checkout.
04 — Free and Pro
Free is the whole protection engine, not a trial.
Use Free to stop the obvious burst. Choose Pro when rotating identities, automation, and team response demand adaptation.
FREEManual control
- Classic Checkout, Checkout Blocks, and Store API protection
- Signed, cache-safe checkout-flow proof
- Native Cloudflare Turnstile with server-side validation
- Fixed IP, email, session, and IP + email velocity controls
- Failed-payment lockout and trusted-customer friction reduction
- Manual Emergency Mode with automatic expiry
- Seven-day aggregated history, reason codes, and one-click unblock
- No Codeprint account and no local usage cap
PRO 1.0Automatic response
- Normal, Elevated, Attack, and Recovery states
- Dynamic thresholds and distributed identity-pattern detection
- Rotating-IP, email, and session detection
- Adaptive challenge escalation with flash-sale safeguards
- Per-gateway thresholds and outage alerts
- 90-day incident analytics, timelines, and CSV export
- Slack, Discord, and generic webhook alerts
- Policy import/export, diagnostics, and priority support
05 — Product modes
Three postures: everyday, emergency, and automatic.
The plugin changes posture, not your whole payment gateway. Each state is explainable and designed to recover.
Quiet by default
Conservative local controls. Low-risk traffic proceeds with minimal friction.
One switch, with an expiry
Fresh guest challenges, tighter limits, and an automatic end time.
Escalate and recover
Normal → Elevated → Attack → Recovery → Normal.
06 — Privacy and resilience
Protection you can reason about, and audit.
No card data, ever
No raw card numbers, CVCs, or gateway payment payloads are inspected.
The engine runs on your site
A Codeprint outage does not take local checkout protection offline.
Minimized data
Long-term identifiers are hashed or masked; repeated events are aggregated.
Protection stays
If a Pro license lapses, the Free core and Emergency Mode remain active.
07 — Compatibility
Classic, Blocks, and Store API—without invented gateway claims.
Checkout Firewall is designed for WooCommerce’s core checkout surfaces. Gateway and checkout-replacement status stays “not yet tested” until evidence says otherwise.
View the compatibility matrix →EXPECTEDClassic Checkout
EXPECTEDCheckout Blocks
EXPECTEDStore API checkout
VERIFYSpecific gateways
08 — Planned launch pricing
Same Pro features. Plans differ by production sites.
Annual billing. Fourteen-day refund policy. Recognized local, development, and staging installs are planned not to consume activations.
Free
$0 forever
No local usage cap
The complete local protection engine for one store or many.
MOST POPULAR
Pro
$59 per year
1 production site
Automatic response and better distributed detection.
Business
$119 per year
5 production sites
The same Pro engine for a growing store portfolio.
Agency
$199 per year
25 production sites
The same Pro engine across client stores.
09 — FAQ
Straight answers, including the ones about limits.
What is card testing?
Card testing is an attacker sending stolen card details through a real checkout to learn which cards still work. Not every failed order is card testing, so patterns matter.
Is this a general fraud platform?
No. Checkout Firewall is intentionally focused on abusive checkout attempts. It is not KYC, AML, chargeback management, or a guarantee against every fraudulent transaction.
Does Free actually stop attacks?
Free includes the complete local protection engine, velocity controls, Turnstile, failed-payment lockout, Emergency Mode, logs, and recovery tools. It is not a timed or usage-capped trial.
Do I need a Codeprint account?
No. The Free plugin works locally without a Codeprint account or per-order Codeprint API.
Must I use Cloudflare as my CDN?
No. You can use Cloudflare Turnstile without routing your site through Cloudflare.
Does it inspect card numbers?
No. Checkout Firewall does not read, store, log, transmit, hash, inspect, or analyze raw card numbers, CVCs, or gateway payment payloads.
Does it protect Checkout Blocks and the Store API?
Yes. The product is designed for Classic Checkout, Checkout Blocks, and WooCommerce Store API checkout routes.
Will legitimate customers be blocked?
Any protection can be wrong. Standard Mode prefers a recoverable challenge when risk is uncertain, supports trusted-customer friction reduction, explains decisions, and makes temporary blocks easy to release.
Pre-launch · Be ready before the next burst
Put a control between checkout abuse and your payment gateway.
Checkout Firewall is being prepared for release. No download or paid checkout is live yet.