Observe before you block
Observe records which checkouts match your rules while shoppers carry on. Switch to Block when the matches look right, or Pause to keep your rules without checking anything.
Order Security by modevfy
Stop Card Testing and Fake Orders in WooCommerce
Order Security for WooCommerce stops suspicious checkouts before payment is processed. Start in Observe mode to see what your rules would catch, then block bot orders, checkout spam, and card testing patterns without guessing.
- Observe before blocking
- Cloudflare Turnstile built in
- Classic, CheckoutWC & Checkout block
The problem
Card testing leaves a mess behind
Bots use store checkouts to find out which stolen cards still work. They place small orders with made-up names, again and again, and each attempt can leave a failed order in WooCommerce and a decline on your payment account.
- Hundreds of failed orders to sort through and delete
- Declines and warnings piling up on your payment account
- Fake customer details mixed in with real orders
- Attacks that start at night and run until someone notices
Features
Built around how bot orders actually look
Every rule is plain and adjustable, so you can see why a checkout matched. Matching checkouts are stopped before an order is paid, and Observe mode lets you try any rule first.
Rules and blocklists
Block exact names, emails, email domains, domain endings such as .test, ZIP codes, phone numbers, street addresses, and IP addresses. Turn each list on or off on its own.
Bot-order patterns
Catch the classic card testing order: a low total with random-letter names like "uyohzern." Choose the total, name length, and consonant run, and match all conditions or any of them.
Detected patterns
Optionally watch new orders for common bot templates. Once a template shows up in five failed orders, it is suggested as a rule for you to review. Nothing turns on by itself.
Product rules
Bots often hit the same cheap product. Watch or block checkouts that include it, for an hour, up to 30 days, or until you turn the rule off.
Checkout rate limits
Manage WooCommerce's own rate limiter for the Checkout block from the same screen, and see the limits that are actually in effect.
Failed-order alerts
Get an email when failed orders spike, such as 5 failures in 10 minutes, so an attack doesn't run all night unnoticed.
Bot order cleanup
Preview failed orders from a date range, check the list, then move them to Trash in small batches. Orders stay recoverable in Trash.
Cloudflare Turnstile
Add a Turnstile challenge to checkout, cart, Order Pay, login, or registration, each with its own switch. Every token is checked on your server before the form goes through.
How it works
Watch first, then block
Install
Add the plugin to your WooCommerce store and activate your license.
Observe
Turn on the rules that fit the orders you've been getting. Observe mode records matches while shoppers check out normally.
Review
Check the matches on the dashboard and adjust any rule that catches a real customer.
Block
Switch to Block. Matching checkouts get your message instead of an order, and failed-order alerts watch for anything new.
Where it fits
One layer of a safer checkout
Order Security works on the details of each checkout: who, where, what, and how much. It works best alongside tools that look at the visitor and the card.
A bot challenge
Cloudflare Turnstile stops many bots before they can submit at all. Turn it on from Order Security, or keep the Turnstile plugin you already use.
Order Security
Rules and patterns catch the checkouts that get through, and alerts and cleanup handle what's left.
Your payment gateway
Fraud tools such as Stripe Radar judge the card itself. Order Security doesn't inspect cards or change gateway settings.
Pricing
One yearly license with every feature
Licenses go on sale soon. Join the waitlist and you'll get an email when Order Security is available. Each license includes the full plugin, a year of updates through WordPress, and email support.
One Store
$99per year
For one WooCommerce store
- Every rule, alert, and cleanup tool
- Cloudflare Turnstile built in
- Updates in your WordPress dashboard for a year
- Email support
- Local and staging copies don't use up your stores
Up to 5 Stores
$199per year
For agencies and owners with several stores
- Everything in One Store
- Use one key on up to 5 stores
- Copy rules between stores with import and export
- Email support
Something not working for your store? Write in first and it gets fixed. If it can't be fixed within 30 days of purchase, you get a full refund.
Ask a QuestionOptional add-ons
Under attack right now?
Order Security is built to set up yourself. If you'd rather hand it off, add a one-time setup at checkout and it's paid together with your license.
Setup
$149one time
Running on your store
- Install the plugin and activate your license
- Starter rules based on your recent failed orders
- Observe mode on, with the rules tested
- Failed-order alerts sent to your inbox
- Your blocked-checkout message written
- One round of changes
Custom Setup
$349one time
Tuned and switched to Block
- Everything in Setup
- A review of your first week of matches
- Working rules switched to Block
- Product rules and checkout rate limits set up
- Existing bot orders cleaned up, after a backup
After checkout, you'll get an email asking you to add a temporary administrator user for modevfy. Never share your own password. Work on other plugins, payment gateways, or Cloudflare gets a separate quote.
Get a QuoteQuestions
Order Security FAQ
How much does Order Security cost?
$99 per year for one store, or $199 per year for up to 5 stores. Both include every feature, a year of updates, and email support. Sales tax is added at checkout where it applies.
Can it stop card testing on my WooCommerce store?
It can stop a lot of it. Card testing bots tend to repeat the same patterns: low order totals, random-letter names, throwaway email domains, and the same cheap product. Order Security lets you block checkouts that match those patterns before payment is processed. No single tool stops every attack, so use it alongside your payment gateway's fraud tools and a bot challenge such as Cloudflare Turnstile.
Will it block real customers?
It can if a rule is too broad, which is why every store starts in Observe mode. Observe records which checkouts would have been blocked while every shopper can still check out. Switch to Block once the matches look right, and add exceptions for any customer email that should always get through.
Which checkouts does it cover?
The classic WooCommerce checkout, CheckoutWC, the Checkout block, pay-for-order pages, and adding a saved payment method. Express payment buttons, subscriptions, and other custom checkouts should be tested on a staging copy first.
Does it slow down checkout?
Rules are checked on your own server against settings saved in WordPress. If you turn on Turnstile, checkout also makes one quick check with Cloudflare.
Does it include Cloudflare Turnstile?
Yes. Turn on a Turnstile challenge for checkout, cart, Order Pay, login, or registration, using the keys from your free Cloudflare account. Choose the theme, size, and placement. If another Turnstile plugin is already active, Order Security won't add a second challenge on top of it.
What does it store about my customers?
Activity history keeps only the time, the decision, which rule matched, and the checkout type. It does not keep names, email addresses, IP addresses, street addresses, or card details, and history is cleared after 1, 7, or 30 days.
What happens if I stop renewing?
Order Security keeps working on your store, and so do its rules and settings. Updates stop until you renew. Renewing with the same email brings back the same license key.
What does the license check send?
Your license key, your website address, and the plugin version, when the key is entered and about once a week after that. Nothing about your orders or customers is sent.
Do staging and local copies use up my stores?
No. Local, development, and staging copies on common hosts don't count toward your license, so you can test rules on staging first.
What if it doesn't work for my store?
Write in first, and the problem gets fixed. If it can't be fixed within 30 days of purchase, you get a full refund.
What are the requirements?
WordPress 6.5 or newer, PHP 7.4 or newer, and WooCommerce.
Can modevfy set it up for me?
Yes. Add Setup ($149) or Custom Setup ($349) at checkout and it is paid together with your license. After checkout, you add a temporary administrator user for modevfy in WordPress. Never share your own password.
Need help with the rest of the store? See WooCommerce solutions.
Waitlist
Get an email when it's available
Share your store and what kind of bad orders you're seeing. Modevfy will follow up, and can set Order Security up for you too.
Not affiliated with or endorsed by WooCommerce or Automattic. WooCommerce is a trademark of its owner.