A couple of months ago a long time client of mine contacted me with a frustrating problem. The cause was a number of repeated failed orders within WooCommerce. Obviously this happened on a Friday evening, and whilst the client was sympathetic the fact it was Friday and could cope with it over the weekend – receiving a few hundred emails clogging up her inbox was not great. It was an annoyance, and could have in a worst case scenario prevented legitimate orders from using the site. Thankfully, it’s an easy fix.
What causes multiple repeated failed orders in WooCommerce?
These orders are caused by people acquiring stolen credit card numbers. They often are just making sure the cards still work, so in order to do this they would place an order with an unsuspecting site, usually it’d pick a low value item in stock, and then attempt to buy it using a stolen credit card.
These were often automated, with a script that connects to WooCommerce REST API to automate the whole product search, adding to cart and purchase. Simply the script would access the REST API, and run these tasks, just changing the credit card details every run.
By default, the REST API in WooCommerce is enabled, and this attack used it quite a lot, testing fairly commonly used paths to access it. Disabling the REST API for WooCommerce would lead to an integration with Google Shopping breaking, so we had to find another solution.
Blocking WooCommerce repeated failed orders with Cloudflare
The site used Cloudflare, so we were able to set up custom rules based on a guide we found. Within your Cloudflare dashboard, go to Security > Security Rules, and set up the following rules :-
- URI Full contains wp-json/wc/store/cart/add-item
- URI Full contains /wp-json/wc/store/cart/update-customer
- URI Full contains ?stock_status=
From this, make sure the Choose Action is a “Managed Challenge” and Place as the First.
You can see it below in this screenshot:-
And the Expression Preview should look a bit like this:-
(http.request.full_uri contains "wp-json/wc/store/cart/add-item") or (http.request.full_uri wildcard r"/wp-json/wc/store/cart/update-customer") or (http.request.full_uri contains "?stock_status=")Basically any request accessing the REST API should now be challenged. This would prevent scripted orders from hitting your cards, causing failures.
I put this on the client’s website late on Friday night, and I don’t think we had any failed orders since. This may work for you too!
Update 19th March 2026
I’ve recently seen an uptick on this again. It seems like the managed challenge isn’t working, and their hitting v1 JSON endpoints, so this is an updated rule to use.
(http.request.full_uri contains "wp-json/wc/store/cart/add-item") or (http.request.full_uri wildcard r"/wp-json/wc/store/cart/update-customer") or (http.request.full_uri contains "?stock_status=") or (ip.src.asnum eq 50837) or (http.request.full_uri contains "wp-json/wc/store/v1/products") or (http.request.full_uri contains "wp-json/wc/store/v1/cart/add-item") or (http.request.full_uri contains "wp-json/wc/store/v1/cart")I’ve also switched off the Manage challenge, instead relying on just blocking. I think a few managed to navigate this.
Finally, I’ve also noticed that WooCommerce has switched on Fraud Prevention using reCAPTCHA, so I’ve enabled that. It’s been 7 hours but hopefully that results in some success. We’ll see!