A card testing run looks like this: hundreds of tiny orders in a few minutes, nearly all declined, a handful approved, then the chargebacks and the dispute fees. Most stores find out from their payment provider, not from their own dashboard.

CheckoutHawk watches your checkout and reacts while it is happening. It counts failed payments per IP address and per email address, blocks the source automatically once the pattern is obvious, and gives you a one click panic mode for the worst of it.

It works on the classic checkout and the Checkout block, because plenty of protection plugins only hook the classic one and quietly do nothing on a modern store.

What it does

Failed payment velocity blocking. Too many declines from one IP address or email address inside your chosen window and that source is blocked automatically for as long as you like.
Panic mode. One switch that closes guest checkout, refuses small test orders, and halves every limit while an attack is running. It can also switch itself on when it spots an attack, and off again when the wave has passed.
Checkout traps. A honeypot field, a minimum time on the checkout page, and a per IP rate limit on checkout submissions.
Cart flood control. Stops scripts hammering add to cart.
Disposable email blocking. A built in throwaway domain list you can extend, applied to orders and to new accounts.
Country and minimum total rules. Refuse the cheap product the testers always pick.
Attack alerts. An email, and optionally a webhook for Slack style receivers, when a wave is detected. Throttled so your inbox survives.
Failed order cleanup. An attack leaves thousands of failed orders behind. Delete them on a schedule, or in one pass, with an option to touch only the orders CheckoutHawk itself flagged.
A readable log. Every block, with the reason, the IP address, the email address and the order. Exportable as CSV so you can hand it to your payment provider.

Works with

WooCommerce classic checkout, the Checkout block and the Store API, and High Performance Order Storage. Payment gateway agnostic: any gateway that marks an order as failed feeds the velocity rules, including Stripe, PayPal and WooPayments.

Privacy

Everything stays on your own site. No accounts, no external service, no data sent anywhere. IP addresses can be stored anonymised if you prefer, and the log has a retention setting. CheckoutHawk also plugs into the WordPress privacy tools, so a customer’s log entries are included in a personal data export and removed by a personal data erasure request. If you fill in the optional webhook field, and only then, alert data is posted to the URL you chose.

Behind Cloudflare or a proxy?

By default CheckoutHawk uses the direct connection address, because proxy headers can be faked and trusting them would let an attacker slip past every rule, or get one of your customers blocked. If your store sits behind Cloudflare, a CDN or a load balancer, pick the matching option under Settings, where the plugin also shows you the address it currently sees.

Built by Cubixsol.