Card testing
Blocks and the allowlist
How ChargeWarden's automatic blocks expire, how to block or unblock an IP, network or email by hand, and when to use the allowlist.
Last updated by the PluginLoom team
ChargeWarden > Blocks and allowlist shows every active block and every allowlist entry.
How do automatic blocks work?#
When a limit fires, ChargeWarden blocks the identifier that reached it for that rule's block time. A blocked shopper sees your block message (Settings > Card testing) and no payment is attempted. Each block shows its rule, how many attempts it has stopped and when it expires. Expired blocks are deleted by the hourly clean-up.
How do I block or unblock someone by hand?#
Blocks store a keyed hash, not the value, so to find one you type the same value again:
- Choose IP address, Network or Email.
- Enter the value, for example
203.0.113.7,203.0.113.0/24orsomeone@example.com. - Choose a duration and click Block, or click Unblock to remove matching blocks.
From WP-CLI: wp chargewarden block ip 203.0.113.7 --hours=24 and wp chargewarden unblock email someone@example.com.
Rejecting an order as fraud in the review queue can also block its email and browser until you remove them, and its IP for 30 days.
When should I use the allowlist?#
Allowlisted shoppers skip every velocity check and are never blocked. Use it sparingly:
| Type | Example | Good for |
|---|---|---|
| IP or CIDR range | 198.51.100.0/24 | Your office, a warehouse, a payment team testing orders |
buyer@wholesale.example | A trusted business buyer who places many orders | |
| User | User ID or username | Staff accounts placing orders for customers |
Allowlisted emails are stored as a hash and shown masked. IP ranges are stored as typed, because range matching needs the value.
What does a blocked shopper see?#
By default: "We could not take this payment right now. Please try again later, or contact us if you need help." Keep the message neutral and do not say which rule fired: that tells an attacker what to change.
Was this page helpful?