Stopping a card-testing attack
Bots were testing stolen cards at checkout, creating failed orders and payment risk.
- Client
- US subscription supplement store
- Market
- United States
- Service
- Security, infrastructure & site care
- Status
- Live
01 / Build
What I built
Firewall rules against bot traffic, forced card authentication, API user-enumeration block, fake-order filtering.
- Cloudflare WAF
- WooCommerce
- PHP
02 / Decisions
Key decisions
- Stop the bots at the Cloudflare edge, not inside WordPress. A request the firewall drops never starts PHP, so the attack stops costing server time as well as payment attempts.
- Force card authentication at checkout. A stolen card number fails the bank's challenge, which removes the reason to test cards on this store at all.
- Block user enumeration through the API and filter fake orders in PHP, so attackers lose the account list they harvest, and the order queue stays clean while the firewall rules are tuned.
03 / Notes
Architecture and hindsight
Architecture
Three layers, each catching what the one before it misses. At the edge, Cloudflare firewall rules challenge or drop bot traffic on the checkout and API paths before it reaches the server. At payment, forced card authentication means a card that gets through still has to pass the bank. In the application, a PHP filter on order creation flags the patterns fake orders share, so staff never fulfil one by mistake.
What I'd do differently
Put rate limits on checkout and the order endpoints from the first day, with an alert on a spike in failed payments. Then an attack shows up as an alert on a phone, not as a column of failed orders in the admin.
04 / Outcome
Outcome
Live in production; card-testing orders stopped reaching the gateway.
Have a problem like this one?