WooCommerce

Card testers run stolen card numbers through small shops by the hundred, and the payment provider's fees and chargebacks land on you. Check the customer's address at checkout, and report addresses that rack up failed payments.

Set it up

Create wp-content/mu-plugins/isipsafe-woocommerce.php (must-use plugins load automatically) and set your key in wp-config.php with define('ISIPSAFE_KEY', 'sl_your_key_here');

<?php
/**
 * Plugin Name: isIPsafe for WooCommerce
 * Description: Refuses checkout from listed addresses and reports card-testing floods.
 */

function isipsafe_wc_score(string $ip): int {
    $cached = get_transient('isipsafe_' . md5($ip));
    if ($cached !== false) {
        return (int) $cached;
    }
    $res = wp_remote_get(add_query_arg('ip', $ip, 'https://isipsafe.com/api/v1/check'), ['timeout' => 3]);
    $score = 0; // fail open: a slow lookup must not stop real customers
    if (!is_wp_error($res) && wp_remote_retrieve_response_code($res) === 200) {
        $body  = json_decode(wp_remote_retrieve_body($res), true);
        $score = (int) ($body['data']['abuseConfidenceScore'] ?? 0);
    }
    set_transient('isipsafe_' . md5($ip), $score, HOUR_IN_SECONDS);
    return $score;
}

// Refuse checkout from addresses with a high score.
add_action('woocommerce_after_checkout_validation', function ($data, $errors) {
    if (isipsafe_wc_score(WC_Geolocation::get_ip_address()) >= 75) {
        $errors->add('isipsafe', __('We could not process this order. Please contact us if you think this is a mistake.'));
    }
}, 10, 2);

// Report an address after five failed payments within an hour.
add_action('woocommerce_order_status_failed', function ($order_id, $order) {
    $ip = $order->get_customer_ip_address();
    if (!$ip || !defined('ISIPSAFE_KEY')) {
        return;
    }
    $counter = 'isipsafe_fail_' . md5($ip);
    $fails = (int) get_transient($counter) + 1;
    set_transient($counter, $fails, HOUR_IN_SECONDS);
    if ($fails === 5) {
        wp_remote_post('https://isipsafe.com/api/v1/report', [
            'timeout' => 5,
            'headers' => ['Authorization' => 'Bearer ' . ISIPSAFE_KEY],
            'body'    => [
                'ip'         => $ip,
                'categories' => 'card-testing,fraud-orders',
                'comment'    => '5 failed card payments within an hour on a WooCommerce shop',
            ],
        ]);
    }
}, 10, 2);

Use a page cache? Checkout is never cached, so the check always runs where it matters. Behind Cloudflare, make sure WordPress sees the visitor's address (a plugin or server setting that trusts CF-Connecting-IP), otherwise every order comes from Cloudflare.

For login floods on the same site, see WordPress.

Need a hand?

If something here does not work with your version of WooCommerce, or you have improved it, tell us. We update these pages with what people send.

WooCommerce and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.