Ali Khallad

carticy

Checkout Shield stops fake checkout orders and card testing attacks — the kind that bypass your CAPTCHA.
Card testing bots don’t fill out your checkout form. They hit your store’s checkout API directly, completely skipping any reCAPTCHA or hCaptcha you’ve set up. That’s why CAPTCHA alone doesn’t stop them.
This plugin verifies that every checkout request comes from a real browser session. Bots that can’t prove they loaded your checkout page get blocked before WooCommerce processes the order.
<h4>Why Store Owners Choose This Plugin</h4>
<ul>
<li>Catches what CAPTCHA misses — blocks bots hitting your checkout API directly</li>
<li>Works with any caching — LiteSpeed, Cloudflare, WP Rocket, W3TC — no conflicts</li>
<li>Zero configuration — activate and you’re protected</li>
<li>No external services — everything runs on your server, no subscriptions</li>
<li>No performance impact — validation adds microseconds, not seconds</li>
</ul>
<h4>Features (Free)</h4>
<ul>
<li>Automatic bot blocking — works the moment you activate, no setup needed</li>
<li>4 protection levels — Learning, Permissive, Balanced, and Strict — choose how aggressive you want to be</li>
<li>Dashboard overview — see blocked vs verified orders at a glance with a 7-day chart</li>
<li>Order status tracking — know which orders were flagged, passed, or blocked</li>
<li>IP whitelist — let trusted addresses through, supports CIDR notation</li>
<li>API key authentication — for headless and custom checkout setups</li>
<li>Works with all checkout types — classic, block-based, and all payment gateways</li>
<li>HPOS compatible — works with High-Performance Order Storage</li>
<li>WooCommerce logging — full integration with WooCommerce Status logs</li>
</ul>
<h4>Pro Features</h4>
Take control with advanced tools:
<ul>
<li>Smart logging — choose what gets logged: nothing, blocked attempts only, or everything with full details</li>
<li>Recent blocks feed — see the last 50 blocked attempts right on your dashboard, with email, payment method, and block reason</li>
<li>Automatic CDN/proxy detection — correctly identifies visitor IPs behind Cloudflare, Sucuri, or Akamai without manual configuration</li>
<li>Stronger permissive mode — adds referrer verification on top of session checks for tighter bot detection</li>
<li>Checkout details in logs — see exactly which email and payment method bots tried to use</li>
<li>Customer blocklist — block repeat offenders by email, name, address, phone, IP, or postal code</li>
<li>Order block metabox — add customers to the blocklist directly from any order screen</li>
</ul>
<a href="https://carticy.com/plugins/checkout-shield-for-woocommerce/" rel="nofollow ugc">Learn more about Pro features</a>

Checkout Shield for WooCommerce – Stop Fake Orders, Spam Bots & Card Testing

Stops fake checkout orders, card testing attacks, and spam bots that bypass CAPTCHA. Works instantly with all checkout types.

kognetiks

Bot Lockout is a security plugin that implements a lightweight cryptographic challenge system to distinguish between real browsers and automated bots. Unlike traditional CAPTCHA systems, it uses JavaScript-based cryptographic operations that are easy for humans but difficult for most bots to solve.
<h4>Key Features</h4>
<ul>
<li>Lightweight Protection: Uses minimal resources and doesn’t impact site performance</li>
<li>Cryptographic Challenges: SHA-256 hashing with date and user agent binding</li>
<li>Smart Whitelisting: Allow trusted bots (Google, Bing, etc.) and IP addresses</li>
<li>Flexible Configuration: Exclude specific pages and customize block messages</li>
<li>Comprehensive Logging: Track blocked attempts for analysis</li>
<li>Custom Styling: Add custom CSS to match your site’s design</li>
<li>Daily Token Expiration: Prevents long-term bypass attempts</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>Initial Request: When a visitor accesses your site, the plugin checks for a valid challenge token</li>
<li>JavaScript Challenge: If no token exists, a cryptographic challenge is presented</li>
<li>Token Generation: The challenge combines the current date with the user agent string and creates a SHA-256 hash</li>
<li>Secure Storage: The hash is base64 encoded, truncated, and stored as a secure cookie</li>
<li>Validation: Subsequent requests are validated against the stored token</li>
</ol>
<h4>Security Features</h4>
<ul>
<li>Cryptographically Secure: Uses SHA-256 hashing algorithm</li>
<li>Time-Bound: Tokens expire daily to prevent long-term bypass</li>
<li>Browser-Specific: User agent binding prevents token sharing</li>
<li>Secure Cookies: Implements proper cookie security settings</li>
<li>Whitelist Support: Allow trusted services and IP addresses</li>
</ul>
<h4>Multi-Site Support</h4>
Bot Lockout supports WordPress Multi-Site installations with both network-wide and site-specific configurations:
<ul>
<li>Network Activation: Apply settings to all sites in the network</li>
<li>Site-Specific Activation: Independent settings for each site</li>
<li>Mixed Configuration: Network-wide defaults with site-specific overrides</li>
</ul>
<h3>Security Advisory</h3>
Bot Lockout is one layer in a broader security strategy, not a silver bullet.
While Bot Lockout is designed to deter automated bots and AI scrapers through cryptographic JavaScript challenges, no single solution can offer complete protection. Web scraping technologies continue to evolve, and determined actors may find ways to bypass front-end defenses.
This plugin should be used as part of a multi-layered approach to website security. For best results, we recommend combining Bot Lockout with additional tools such as server-level firewalls, rate limiting, CAPTCHA systems, behavior-based threat detection, and CDN-level bot mitigation.
Kognetiks makes no guarantee that this plugin will block all unwanted bot traffic. It is intended as a proactive, lightweight defense mechanism—not a comprehensive security system. Users are responsible for evaluating their own threat model and deploying appropriate complementary protections.
<h3>Support</h3>
For support, please visit the <a href="https://wordpress.org/support/plugin/bot-lockout/" rel="ugc">WordPress.org support forums</a> or check the <a href="https://wordpress.org/plugins/bot-lockout/" rel="ugc">plugin documentation</a>.
<h3>Credits</h3>
Developer: Kognetiks
This plugin is licensed under the GPL v3 or later.

Bot Lockout

A lightweight WordPress plugin that protects your site from AI scrapers and bad bots using cryptographic JavaScript challenges.

Checkout Shield for WooCommerce – Stop Fake Orders, Spam Bots & Card Testing vs Bot Lockout