Developers

Testing ChargeWarden: self-test and attack simulator

Run ChargeWarden's self-test, and use the simulator to fire a card-testing attack at a staging store's classic checkout and Store API without real cards or real IP addresses.

Last updated Oct 24, 2026 by the PluginLoom team

Self-test#

Tools > Run self-test, or wp chargewarden selftest, checks email normalisation, hashing, IP networks and ranges, every velocity decision, the scoring rules and bands, the return rate maths, BankBridge return code parsing, script change detection, the free list parser and the PDF writer. It does not change your data.

Attack simulator#

Use the simulator on a staging copy of your store. It lets a test script pretend to be many shoppers.

wp chargewarden simulator enable prints a random secret.
Requests that send that secret in the X-ChargeWarden-Sim header may:
- use the IP address in X-ChargeWarden-Sim-IP instead of their own, and
- pay with the Test card (simulator) gateway. Card 4242424242424242 is approved; every other number is declined.
Ordinary visitors never see the test gateway and their IP is never replaced.
Everything a simulated request creates is marked simulated. wp chargewarden simulator cleanup removes simulated blocks, events and counters, and wp chargewarden simulator disable removes the secret.

Use IP addresses from the documentation ranges (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, 2001:db8::/32) so nothing you create can match a real visitor.

What our test run showed#

We ran the simulator against our demo store on 24 October 2026, against both the Store API checkout and the classic checkout:

Attack	Result
One IP, Store API, 10 declined cards	5 declined, then 5 blocked
One IP, classic checkout, 10 declined cards	5 declined, then 5 blocked
40 IPs in one /24, Store API	12 declined, then 28 blocked by the network limit
20 IPs in different networks, classic, one browser	5 declined, then 15 blocked by the browser limit
One card number from 8 networks	2 declined, then 6 blocked by the card limit (attack mode had just switched on and tightened limits)
Store-wide	Attack mode switched on by itself after 30 failed payments
Real customers on other networks, during and after the attack	6 of 6 paid, including one who mistyped a card first

Your numbers depend on your limits. The simulator script we used is part of our test suite, not the plugin download; ask support if you would like a copy.

Was this page helpful?