How To Stop Spam & Fake WooCommerce Orders

Spam and fake orders are turning up on more and more WooCommerce stores. They’re more than an annoyance. If a third party logistics (3PL) provider fulfils your orders, some of those fake orders can actually get shipped. You lose the stock on the fraudulent order, then lose again when the chargeback arrives.

Here’s how to spot these orders and shut them down. The same principles work on other ecommerce platforms like Magento and OpenCart too.

What Fake Orders Look Like

Most fraudulent orders are for small amounts. The people behind them are testing lists of stolen credit card numbers to find out which ones still work.

The pattern is usually easy to recognise: several orders an hour, all for the same product. The customer details are often typed entirely in lowercase, because the orders tend to come from countries whose languages don’t use capital letters.

Why You Can’t Ignore Them

• Your 3PL or fulfilment partner may ship goods for orders that were never real.
• Your payment processor or merchant account provider may flag or suspend you for suspicious activity.
• Junk orders clutter your system, waste staff time and can erode trust with genuine customers.

5 Ways to Stop Fake WooCommerce Orders

1. Turn on WooCommerce rate limiting

WooCommerce includes rate limiting for the checkout and its Store API. On its own it rarely stops an attack, because fake orders usually arrive too slowly to trip the limit, but it costs nothing to enable. Go to WooCommerce > Settings > Advanced > Features and switch on Rate limiting Checkout block and Store API. WooCommerce explains how it works in its rate limiting documentation.

2. Use Cloudflare to filter traffic by country

Cloudflare is worth having on any WordPress site, and even the free plan brings real speed and SEO benefits. Its firewall rules let you filter visitors from outside the countries or continents you sell to, which stops most of the automated tools used to place these orders.

Don’t block countries outright. Sooner or later a genuine customer will get caught. Use a managed challenge or interactive challenge instead, so real people can get through with a quick check while bots are stopped.

3. Install a WooCommerce fraud plugin

Fraud plugins screen each checkout against set rules, IP blocklists and behaviour that’s known to be fraudulent. There are plenty to choose from and they work in similar ways. Two worth trying:

• FraudLabs Pro, free for up to 500 orders a month.
• WooCommerce Anti-Fraud, a paid plugin with lots of settings to fine tune the filtering.

4. Stripe users: enable Stripe Radar

If you take payments through Stripe, its Radar product identifies and flags spam and fraudulent payments. It carries an extra fee, but it’s well worth paying for a store that’s being targeted.

5. Dig into your server logs and block what you find (advanced)

Country filtering isn’t always an option. In one wave of attacks we dealt with, several stores sold digital products worldwide, so blocking by country wasn’t possible. The odd thing was that orders arrived with shipping details even though those checkouts didn’t ask for a shipping address.

The server logs explained it. Each WooCommerce order shows the IP address it came from, so we filtered the access log by those IPs and followed what each one did. The fake orders were being submitted directly through the public WordPress REST API, skipping the normal cart, which is how shipping details got in. The IPs all traced back to a single hosting network.

With that information we built a Cloudflare rule that blocked:

• Two API calls being used to add items to the cart and update customer details
• An API call being used to list every product in the store
• The network the attacks came from, identified by its AS number in the Cloudflare event log

You’ll find your logs in your hosting control panel, labelled something like Access Log, Apache Access Log or Nginx Access Log, usually alongside an error log. Most panels let you filter by IP. If yours doesn’t, download the log and search it in a plain text editor. If you’re comfortable on the command line, SSH access makes searching large logs much quicker.

While you’re tightening things up, it’s a good time to run a malware scan and review how to lock down your site.

What Doesn’t Work

You’ll often see two pieces of advice for this problem: turn off guest checkout, and add reCAPTCHA or Cloudflare Turnstile to the checkout. Skip both. At best they do nothing, and they’re likely to cost you sales.

• Disabling guest checkout hurts conversion rates in almost every case and doesn’t stop the more sophisticated attacks. It mostly frustrates real customers.
• Checkout captchas are unpleasant for shoppers, and AI tools now get past them easily. Cloudflare’s network level firewall rules are far more effective and don’t get in the way of genuine buyers.

Quick Checklist

• Enable WooCommerce rate limiting for the checkout and Store API
• Put Cloudflare in front of your store
• Challenge (don’t block) traffic from outside the countries you sell to
• Install a fraud screening plugin
• Turn on Stripe Radar if you use Stripe
• Check fake order IPs against your access log and block the pattern in Cloudflare
• Leave guest checkout on and keep captchas off the checkout

Bots that place fake orders often crawl your cart URLs as well. Our WooCommerce robots.txt guide helps cut that load.