=== CatCode Card Testing Shield for WooCommerce ===
Contributors: catcodestudio
Tags: woocommerce, card testing, fraud, rate limit, checkout
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Stops card testing on the WooCommerce checkout: limits on card attempts and declines per IP, session and e-mail, a growing pause, a log.

== Description ==

Card testing is a script running stolen card numbers through your checkout, one small payment after another, to find the cards that still work. The shop pays for it: hundreds of declined transactions, gateway fees per attempt, disputes, and in the end a payment processor that freezes or closes the account.

Card Testing Shield counts what a tester cannot hide — how many card payments come from one address, one browser session and one e-mail, and how many of them the gateway declines — and stops them before the next one reaches the gateway. Real buyers never notice: they make one payment, maybe two.

**Where it works**

* Classic checkout and the block checkout (Store API), including the AJAX endpoint scripts call directly.
* "Pay for order" pages.
* My account → "Add payment method" — the favourite of testers who register thousands of free accounts. Covers the WooCommerce form and the cards that WooCommerce Stripe Gateway and WooPayments check over their own AJAX calls.
* Any card gateway: Stripe, WooPayments, Braintree, Square, Authorize.Net, NMI and others. You choose which payment methods are watched; bank transfer, cheque and cash on delivery are left alone by default.

**What it limits**

* Card attempts and declines per IP address, per browser session (cart) and per billing e-mail, in a period you choose.
* A pause after every decline that doubles each time: 10 s, 20 s, 40 s… A person re-typing a card does not notice it; a script running a list slows to a crawl.
* Payments fired at the same moment from one address, browser or account: at most three in ten seconds go through. Without it a script sending twenty cards in parallel would get all twenty to the gateway before the first decline is counted.
* A client that hits a limit is refused for a set time, with a neutral message that does not tell which limit it was.
* An attempt is counted only when WooCommerce has accepted the form and hands the order to the gateway, so a buyer fixing a typo in the address never spends one. A decline reported later by the gateway (a webhook, a failed 3-D Secure) is counted too.

**Never limited**

* Customers who have paid before (logged in, with a paid order), shop managers and administrators.
* Addresses and networks you list (your office, a call centre taking phone orders), e-mails and whole e-mail domains.

**Monitor mode**

Not sure the limits fit your shop? Monitor mode logs what would be refused and refuses nothing.

**Log and overview**

Every decline and every refusal, with the address, the e-mail, the payment method, the order and the reason; card attempts, declines and refusals by the hour. "A customer cannot pay?" — look up an address or an e-mail and release it with one click.

**Fast under attack**

Counters live in the fastest store the server has: Redis/Memcached object cache, APCu, or one small table updated with a single query. Repeated refusals of the same client are not written to the log one by one.

**Where the data goes**

Nowhere. Everything happens on your server; the free version makes no external requests. The log keeps the address and the e-mail of the attempt, and never a card number.

== Installation ==

1. Install and activate the plugin. WooCommerce must be active.
2. WooCommerce → Card Testing Shield → Rules. The defaults suit most shops; if unsure, choose Monitor for a few days and look at the log.
3. If the site is behind Cloudflare or another proxy, check "Your address as the shield sees it" on the Overview tab and set "Visitor address" in Rules → Server if needed.

== Frequently Asked Questions ==

= Will real customers be blocked? =

The defaults allow 6 card attempts and 3 declines per session and e-mail, and 10 attempts and 5 declines per address, per hour. Customers who have paid before are never limited. If somebody does get refused, look them up on the Overview tab and release them.

= Does it replace a CAPTCHA or my gateway's fraud tools? =

It works alongside them. A CAPTCHA can be solved by a farm and does nothing against "Pay for order" or saved cards; gateway fraud rules only see the attempts that already reached the gateway and cost you a fee. The shield stops the repeat attempts on your own server.

= What about WooCommerce's own "Rate limit Checkout"? =

That feature (Settings → Advanced → Features) allows 3 block-checkout requests a minute per address or account, whatever their outcome. It does not cover the classic checkout, "Pay for order" or saved cards, and does not look at declines or e-mails. Both can be on at the same time.

= My shop is behind Cloudflare =

The address is taken from CF-Connecting-IP automatically, but only for requests that really come from Cloudflare's networks. Behind another proxy or load balancer, choose its header in Rules → Server.

= Does it store card data? =

No. The log keeps the address, the e-mail, the payment method and the order — never a card number.

== Changelog ==

= 1.0.0 =
* First release: limits on card attempts and declines per address, session and e-mail; growing pause after declines; classic checkout, block checkout, "Pay for order" and "Add payment method" (WooCommerce form, Stripe and WooPayments); declines reported later by the gateway; whitelist of customers, addresses and e-mails; monitor mode; log and hourly overview; release of a client.
