Card testing
Attack mode and challenges (Turnstile, hCaptcha)
What ChargeWarden's attack mode changes, when it turns on by itself, and how to add an optional Cloudflare Turnstile or hCaptcha challenge that only risky shoppers see.
Last updated by the PluginLoom team
Attack mode is an emergency setting for when your store is being hit right now. A challenge is an optional middle step that asks risky shoppers to prove they are human instead of blocking them.
What does attack mode change?#
| Normal | Attack mode |
|---|---|
| Limits as set | Every maximum divided by 3 (setting "In attack mode, divide every maximum by") |
| Challenge only for elevated shoppers | Challenge for every checkout, when a provider is set up |
| Checkout without the browser signal allowed | Refused (setting "In attack mode, refuse checkouts without the browser signal") |
Attack scripts that call the Store API directly do not run your checkout page's script, so they never send the browser signal. A few real shoppers with scripts turned off would also be refused while attack mode is on, which is why it is meant for short periods.
How do I turn it on?#
- By hand: Dashboard > Turn attack mode on, for 1 hour, 6 hours, 24 hours or until you turn it off. Or
wp chargewarden attack-mode on --minutes=60. - Automatically: when failed payments store-wide reach the threshold (default 30 in 10 minutes), ChargeWarden turns attack mode on for 60 minutes and emails you. Set the threshold to 0 to turn this off.
A red notice shows on every admin screen while attack mode is on.
How do I add a challenge?#
Both providers have free plans. Create keys in your own account, then paste them into Settings > Card testing or wizard step 2.
| Provider | Where to get keys | Verification endpoint ChargeWarden calls |
|---|---|---|
| Cloudflare Turnstile | Cloudflare dashboard, Turnstile | https://challenges.cloudflare.com/turnstile/v0/siteverify |
| hCaptcha | hCaptcha dashboard | https://api.hcaptcha.com/siteverify |
The secret key is stored encrypted. You can also pin it with CHARGEWARDEN_CHALLENGE_SECRET in wp-config.php.
What does the shopper see?#
Nothing, unless their risk is elevated. Then:
- Their checkout attempt is refused with "Please complete the quick security check, then place your order again."
- The widget appears above the Place order button, on the classic checkout, the Checkout block and the pay for order page.
- After they pass, they place the order again. A pass is remembered for 15 minutes so they are not asked twice.
On the Checkout block, ChargeWarden adds the token to the Store API request with a wp.apiFetch middleware (header X-ChargeWarden-Challenge). Attack scripts that call the API directly cannot pass it without solving the challenge.
Can returning customers skip it?#
Yes, by default. Logged-in customers with at least one completed or processing order skip challenges (setting "Skip challenges for returning customers"). Blocks still apply to them.
What if the provider is down?#
A challenge that cannot be verified fails, and the shopper can try again. Velocity blocks do not depend on the provider.
Was this page helpful?