Field note · Layered defense
Why blocking checkout bots is not enough to stop modern card testing
A checkout token can stop basic direct scripts. It cannot, by itself, stop automation that behaves more like a browser.
Direct scripts
The simplest automation never loads checkout. Checkout-flow proof makes this cheap path harder by requiring a short-lived signed token from the expected flow.
Token-aware automation
An attacker can obtain a normal session or token before submitting. That is why a token must be combined with velocity across IP, email, session, and failure history.
Headless and full-browser automation
More capable automation can execute JavaScript and complete the expected flow. A risk-triggered Turnstile challenge adds another layer, but should not be described as infallible.
Why feedback matters
Actual payment declines tell the protection engine that a pattern is becoming dangerous. Combined with explainable decisions and recovery, the layers can shorten abuse without treating every checkout as hostile.
Version 1.0.0 · Available on WordPress.org
Put a control between checkout abuse and your payment gateway.
Install the complete Free edition from the official WordPress.org Plugin Directory. New installations begin safely in Observe Mode.