How does the plugin stop it?

It checks the visitor when the checkout is submitted, on your server, before WooCommerce sends the payment to your gateway. Scripts, Tor and the classes you choose get a checkout error, and the card is never sent.

Does it work with the block checkout?

Yes. It checks the classic checkout and the block checkout, plus account registration from My Account.

Do I still need reCAPTCHA on checkout?

Customers never solve a puzzle with IPScanner. You can keep reCAPTCHA next to it, or remove it once the Overview tab shows the bots being caught.

Will it slow down checkout?

One check per visitor, usually well under a second, reused for 10 minutes. If IPScanner takes longer than 1.5 seconds or is down, the order goes through.

What does the free plan include?

30,000 requests a month, up to 1,000 a day. Each new visitor check uses 2. On Free, a site managed from the dashboard runs in monitor mode; blocking starts on Starter.

IPScanner

Products

IP DetectionVPN, proxy, Tor and hosting checks on any IP AgentscanTell humans, bots and AI agents apart ProvenanceLocation checks with a tamper-evident audit log Email securityCatch throwaway, mistyped and dead signup emails

Integrations

Cloudflare Worker WordPress plugin WooCommerce Traefik plugin Caddy module nginx, Apache, HAProxy Form gate Signup Gate MCP server All integrations

Detection servicesVPN Detection Proxy Detection Geolocation ASN Data WHOIS Info

WooCommerce plugin

Stop card testing and fake orders on WooCommerce

Every checkout is checked on your server before WooCommerce asks the gateway to charge the card. Starts in monitor mode and blocks nothing until you switch.

Get it on WordPress.org Read the setup guide

Classic and block checkoutFree, GPLv2 or later

shop.example.com/checkoutEnforce mode

Checkout

73.162.0.24Human

Order received. Thank you.

Email address

maria@studio.dev

Card

•••• 1881

Total $29.00Place order

Recent decisions

73.162.0.24Human, CheckoutAllow
5.9.0.14Malicious automation, CheckoutBlock
172.58.12.9Human, Account signupsAllow

Before payment

The card never reaches your gateway

Card testers place small orders with stolen cards to see which ones work. Every attempt shows up as a failed order and can get your merchant account flagged.

Without IPScanner

Orders

OrderDateStatusTotal

#5034 Guestjust nowFailed$1.00
#5033 Guest1 min agoFailed$1.00
#5032 Guest1 min agoFailed$2.50
#5031 Guest2 min agoFailed$1.00
#5030 Guest3 min agoFailed$1.00
#5029 Guest3 min agoFailed$2.50

With IPScanner

Orders

IPScanner refused 47 checkout attempts before payment today.

OrderDateStatusTotal

#5026 Maria Lopez12 min agoProcessing$48.00
#5024 Tom Becker26 min agoProcessing$112.50
#5021 Nina Weber41 min agoCompleted$35.90
#5019 Sam Carter58 min agoCompleted$64.00
#5017 Leo Martin74 min agoCompleted$27.00

Protected areas

Where it checks your store

A blocked checkout gets a WooCommerce error notice. Nothing else changes for customers.

Checkout
Before the payment is sent
Account signups
My Account registration
Login
My Account and wp-login
Product reviews
Before a review is saved
Contact forms
Contact Form 7 and WPForms
Whole store
Optional, off by default

Setup

Monitor first, then enforce

1
Install the plugin
Search for IPScanner under Plugins, then install and activate it.
IPScannerWordPress.org
1. Plugins
2. Add New Plugin
3. Search "IPScanner"
2
Connect with IPScanner
In Settings → IPScanner, click Connect and sign in. The plugin gets its API key and a dashboard site.
Settings → IPScanner
Connect with IPScannerConnected, Free plan
Or paste an API keyGet a free API key
3
Pick the areas, then enforce
Watch the Overview tab for a few days before you block anything.
- Checkout
- Account signups
- Login
- Product reviews
- Contact forms
- Whole store
MonitorEnforceafter a few days

Built for store owners

Bots stay out of checkout, customers walk right in

The plugin checks logins, signups, comments and WooCommerce checkout. Real customers never see a puzzle.

Install the plugin See plans

/checkout · HumanAllow

48orders through checkout today

/checkout · HumanAllow

/wp-login.php · TorBlock

48orders through checkout today

Sites dashboard

Change the policy without touching WordPress

Allow, flag or block each class from the dashboard. The plugin picks up a change within 30 seconds.

Verified search and AI crawlers always pass.
Administrators and the IPs you list are never blocked.
If IPScanner is slow or down, visitors get through.

shop.example.comWordPressMonitorEnforce

Traffic24h

Policy

HumanAllow
Verified botAllow
AI agentFlag
TorBlock
Malicious automationBlock

Recent requests

185.220.101.7Tor · /wp-login.php403 · Block
185.220.101.1Tor · /wp-login.phpWould block
73.0.0.1Human · /my-account/Allow

Questions

WooCommerce card testing FAQ

Bots place small orders with stolen card numbers to see which ones work. The store sees a run of failed orders, and the cards that pass get used somewhere else.

See your checkout traffic first

Install it, watch a week of checkouts in monitor mode, then turn on blocking.

Get a free API key Get it on WordPress.org

Stop card testing and fake orders on WooCommerce

The card never reaches your gateway

Where it checks your store

Checkout

Account signups

Login

Product reviews

Contact forms

Whole store

Monitor first, then enforce

Install the plugin

Connect with IPScanner

Pick the areas, then enforce

Bots stay out of checkout, customers walk right in

Change the policy without touching WordPress

WooCommerce card testing FAQ

See your checkout traffic first