Stopping WooCommerce Checkout Bots — Cloudflare Turnstile at the Edge

A technical recap of the issue, root-cause investigation, and mitigation steps taken to resolve a bot-attack disruption and reinforce long-term website stability.

Posted by: its-d on Category: Case Study Incident Response

A non-profit's e-commerce store began experiencing a sudden surge of fraudulent checkout attempts, overwhelming their book-ordering system and forcing them to temporarily disable online sales. I was brought in to diagnose the issue, identify the underlying cause, and implement a solution that would restore stable operations without disrupting the rest of their website.

Initial Discovery and Assessment

When the Swedish-American Historical Society reached out, they explained that every time fixed-price book sales were re-enabled, the site was immediately hit with a wave of fake checkout attempts. These orders appeared with randomized names, U.S. addresses, and placeholder email accounts consistent with automated bot behavior. Meanwhile, donations and memberships, which use variable pricing, continued functioning normally.

To get an accurate picture, I began with a structured discovery session covering:

  • When the issue started
  • Recent changes (plugins, payment gateways, pricing models)
  • Hosting details (Bluehost)
  • WordPress and WooCommerce configurations
  • Checkout flow and payment gateway usage
  • Log availability and patterns already observed

Their team also mentioned switching to the newer PayPal Advanced Card Processing plugin around the same time the behavior began. Combined with the fact that fixed-price books were the only target, this helped narrow down where the vulnerability likely existed.

I validated the issue by reviewing activity patterns in WordPress and confirmed the traffic resembled a known WooCommerce exploit involving automated bots using the Store API to rapidly test stolen cards against fixed-price products. Many site owners running similar setups have reported the same pattern, particularly after upgrading PayPal plugins.

At this point, we had a clear working theory and a plan to implement a strong bot-prevention layer at the edge and secure the checkout endpoint.

Root Cause Analysis

Through log analysis, plugin review, and cross-referencing industry reports, the underlying cause became clear:

The site was being targeted by automated card-testing bots exploiting WooCommerce's Store API checkout endpoint.

These attacks:

  • Exploit predictable fixed-price checkout routes
  • Do not require bypassing WordPress login
  • Can occur even when inventory appears normal
  • Overwhelm order logs with fake transactions
  • Frequently target PayPal Advanced Card Processing integrations

Because only fixed-price book orders were affected and variable-priced donations were not, the pattern aligned exactly with documented WooCommerce exploits.

Solution and Implementation

Before implementing changes, I evaluated several mitigation options including WooCommerce's built-in rate limiting, adjusting PayPal plugin settings, and adding traditional CAPTCHAs. Because the attack was hitting the WooCommerce Store API directly, bypassing typical browser-based protections, the most effective solution needed to filter traffic before it reached WordPress at all. Cloudflare offered the strongest edge-level protection, seamless WordPress integration, and a frictionless human-verification system (Turnstile) that would not interrupt legitimate buyers. Given these advantages, Cloudflare was the clear choice to block automated checkout attempts without disrupting the rest of the site.

With the root cause confirmed, I moved forward with implementing the most effective and lowest-impact mitigation steps.

1. Enable Cloudflare for the Website

Their site was hosted on WordPress with plugins capable of enabling Cloudflare as a CDN and security layer. After activation:

  • DNS began proxying through Cloudflare
  • Site performance improved
  • Cloudflare security features became available, including Turnstile

2. Activate Cloudflare Turnstile

Turnstile silently verifies whether a visitor is human without disrupting user experience.

We:

  • Installed the Cloudflare plugin on WordPress
  • Enabled Turnstile on key pages: Checkout, Login, Registration
  • Performed test actions to verify correct operation

3. Validate Payment Flow

We confirmed that:

  • PayPal Advanced Card Processing remained compatible
  • The checkout process was not disrupted for real customers
  • Fixed-price books could safely be re-enabled

4. Monitor for Continued Attack Activity

I instructed the client to keep fixed-price books active for several days.

Results:

  • No new bot activity detected
  • Zero fraudulent orders created
  • Site performance remained stable

Outcome and Impact

After implementing Cloudflare Turnstile and re-enabling fixed-price books:

  • All bot activity ceased
  • Zero fraudulent orders occurred in the following days
  • Checkout performance improved due to Cloudflare caching
  • No changes were required to donation or membership workflows
  • The team can safely run holiday-season traffic without fear of overload

Client Testimonial

I met Darian through a mutual contact when the organization I steward was in a vulnerable moment with our web security. Darian was a patient communicator, and was flexible with the timing, needs, and budget of our organization. When the fix he identified for our website was much easier than we initially worried it might be, he acted with integrity and helped us fix it ourselves. While I hope my organization's website will continue to run smoothly, I appreciated working with Darian and will do so again should the need arise.

— Swedish-American Historical Society

Closing Thoughts

This was a great example of how even a small configuration change combined with a broader industry exploit can create a sudden operational issue for a nonprofit or small business. With the right diagnostic approach and security layers in place, we were able to restore stability quickly and prevent future attacks.

If you're facing similar traffic anomalies, bot activity, or checkout instability on WordPress/WooCommerce, feel free to reach out — I'm always happy to help troubleshoot or harden your setup.

Keywords: Cloudflare, Bot Mitigation, WordPress security, WooCommerce Store API, PayPal Advanced Card Processing, Checkout Fraud, Incident Response, Website Performance