Stripe Radar for WooCommerce: Plans, Rules and Gaps

Short answer: Stripe Radar is the fraud screening built into Stripe. It scores every payment attempt and can block it, send it to review, or ask for 3D Secure. On the pricing pages we checked on 26 October 2026, Radar Lite is included at no additional charge on standard pricing, and the paid plans for businesses start at $10 (Standard), $14 (Plus) and $20 (Pro) a month, with custom rules and manual reviews in Plus and Pro. On WooCommerce it works through the Stripe gateway or WooPayments, and a Radar review puts the order on hold. It cannot see attacks that WooCommerce stops before a Stripe payment exists, or payments on other gateways.

Which Radar plan do you need?#

Stripe also says that, on average, businesses block 42% more fraud on Standard than on Lite. That is Stripe's own figure across its users, not a promise for your store.

What does Stripe Radar do?#

Stripe's docs describe Radar as using AI "to evaluate transactions, accounts, and customers in real time". In practice, for an online store, that comes down to four things.

1. Scoring. Every payment gets a risk level (normal, elevated or highest) and, on Plus and Pro, a risk score. Stripe's attributes reference gives the score as 0 (least risky) to 100 (riskiest), with 65 and above marked elevated and 75 and above marked highest by default.
2. Built-in rules. By default Radar blocks payments at the highest risk level and sends elevated-risk payments to review. You can also turn on rules that block payments failing the card's CVC or postal code check "unless Stripe evaluates it as low risk".
3. Card testing prevention. Included in every plan. Stripe says that with the latest Payment Element or Checkout it runs "rate limiters, AI models, CAPTCHA triggers, ongoing reviews" against card testers, and you see those payments as "Blocked by Stripe".
4. Your own rules and reviews on Plus and Pro, covered below.

Radar screens every payment attempt type on supported payment methods, including declined and blocked attempts. Stripe's docs note one exception: it does not screen SetupIntents for non-card payment methods.

Stripe Radar pricing in detail#

Here is what the official pages showed on 26 October 2026.

Three details matter for the bill:

• Stripe's main pricing page lists pay as you go "starting at $0.05 per screened transaction".
• Stripe's docs say Standard, Plus and Pro charge "for each screened transaction", including recurring and invoice payments, and only when Radar actually screens one. For Stripe Billing subscriptions you can set how many renewals Radar screens before it stops.
• Platforms and marketplaces pay more: the Radar pricing page shows $20, $44 and $70 a month for the three paid plans.

What happened to Radar for Fraud Teams?#

People still search for it, and Stripe's pricing page still says "Stripe Radar for Fraud teams" is "priced separately". But Stripe's Radar documentation now compares four plans, Lite, Standard, Plus and Pro, and does not list a plan by that name. The features people looked for in it, such as custom rules, manual reviews and risk scores, sit in Plus and Pro in the current docs. If your account is on an older plan, the Radar settings in your Dashboard show which one.

How Radar behaves with the WooCommerce Stripe Gateway#

The WooCommerce Stripe Payment Gateway (700,000+ active installs on WordPress.org) takes cards through "Stripe Elements hosted input fields" on your own checkout, and its listing says it uses Radar for fraud detection. What happens to the WooCommerce order depends on Radar's decision:

We read that behavior in the gateway's review.opened and review.closed handlers on GitHub. Two practical points follow.

• Webhooks must work. The hold comes from Stripe's webhook. If your webhook endpoint is not set up, Radar still reviews the payment on Stripe's side, but WooCommerce will not know.
• The gateway does not save the risk score. It records that a review opened, but it does not store Radar's risk level or score on the order. To see the score you open the payment in the Stripe Dashboard.

If you use WooPayments instead, it also runs on Stripe and uses Radar. WooCommerce's docs say Radar "will block those that Radar determines are likely fraudulent", and that WooPayments adds its own fraud protection settings on top.

Writing Stripe Radar rules#

Custom rules need Radar Plus or Pro. You add them under Radar, Rules in the Dashboard. Every rule has the same shape:

{action} if {attribute} {operator} {value}

The four actions run in a fixed order: Request 3D Secure first, then Allow, then Block, then Review. Once a payment matches an allow rule, no block or review rule runs, which is why Stripe says to use allow rules "minimally". You can have up to 200 transaction rules.

Rules worth knowing#

These examples come from Stripe's rules docs and reference, or use attribute names exactly as they appear in Stripe's attribute list. Change the numbers to suit your store.

A few rules of thumb from Stripe's docs:

• Test first. The rule tester runs your rule against the last six months of charges and shows how many good, fraudulent and blocked payments it would have hit.
• Start with review, not block. Stripe recommends review rules when you are unsure, then a block rule once you have checked for false positives.
• Roll out slowly. Traffic allocation lets a rule act on a percentage of matching payments. At 0%, Radar only reports what the rule would have done.
• Watch for missing data. A comparison against a missing attribute is always false. If your checkout does not send an email, Review if :email_domain: != 'example.com' matches nothing. Use is_missing(:email_domain:) to catch those.
• Counts exclude the current payment. total_charges_per_customer_hourly is 0 on the first attempt in an hour.
• iCloud Private Relay can make many shoppers share IP counters. Stripe suggests the isp attribute to spot it.

Rules only apply to future payments. Request 3D Secure rules only work with Stripe Checkout, Payment Intents or Setup Intents.

Where Radar stops on a WooCommerce store#

Radar is good at what it can see. Its blind spots on WooCommerce come from where it sits: at the payment, not at your checkout.

1. Card testing that never becomes a Stripe payment#

WooCommerce's developer blog wrote on 18 December 2024: "Recently we have seen card attacks specifically targeting the Store API alone, even without the use of the Checkout block." Attack scripts post orders to /wp-json/wc/store/v1/checkout many times a minute. Each attempt creates a WooCommerce order and load on your server, and only some reach Stripe. Radar sees and blocks many of the card attempts that do reach Stripe, but it cannot rate-limit your checkout endpoint, stop pending orders piling up, or block an IP network on your site.

Stripe's own card testing guide says as much: "If you're not a developer or if you use a plugin or platform, preventing and mitigating card testing typically requires code-level changes." It recommends CAPTCHA on every request that can create a payment, rate limits, and limits per IP address and customer. Those belong on the WooCommerce side. The full playbook is in WooCommerce card testing.

2. Payments on other gateways#

Radar only screens Stripe payments. If your store also takes PayPal cards, Authorize.net or another processor, those orders get no Radar score at all. Stores that mix gateways need a fraud layer that sits in WooCommerce and reads each gateway's own risk data.

3. Bank payments through another processor#

Stripe's rules docs show Radar rules can target Stripe's own ACH payments with :payment_method_type: = 'us_bank_account', on plans that cover all payment methods. ACH debits sent through another provider, such as Plaid Transfer, never pass through Radar. Nacha's monitoring rules for businesses that originate ACH debits are covered in the Nacha fraud monitoring rule guide.

4. Context that lives in WooCommerce#

Radar sees what your integration sends: card, amount, email, IP address, billing address and metadata. It does not see your order history in WooCommerce, the items in the cart, or orders you rejected by hand, unless you send them as metadata. Rules on those signals need either custom code or a tool inside WooCommerce.

Radar or a WooCommerce plugin?#

It is not either or. Radar decides on the payment with data from across Stripe's network, which no plugin has. A plugin works at your checkout, before and around the payment, and across every gateway. For a side-by-side of WooCommerce fraud plugins see the WooCommerce anti-fraud plugins comparison, and for vendor categories beyond plugins see the ecommerce fraud prevention software guide.

How ChargeWarden works with Stripe Radar#

ChargeWarden is built to sit next to Radar, not to replace it.

• It reads Radar's decision. When Radar opens a review and the Stripe gateway puts the order on hold, ChargeWarden scores that as "gateway asked for a review" (25 points by default). It reads the gateway's _stripe_status_before_hold record to know this.
• It can fetch the Radar score. Because the Stripe gateway does not save Radar's risk level or score, ChargeWarden has an optional setting, off by default, under Settings, Order risk, "Read Stripe Radar risk from the Stripe API". It asks Stripe once per order for the charge's outcome.risk_level and outcome.risk_score using the secret key already in your Stripe gateway settings, and caches the answer on the order. Elevated or highest risk adds 20 or 40 points. The details are in gateway risk data.
• It covers what Radar cannot see. It counts checkout attempts and failed payments per IP address, per /24 or /64 network, per email, per browser, per card where the gateway exposes it, and per session, on the classic checkout, the Store API, the pay for order page and the add payment method form. Blocks expire on their own, and attack mode tightens every limit when failed payments spike. See card-testing limits.
• It works across gateways. It also reads WooPayments' risk level and fraud outcome and PayPal's security code, address and 3D Secure results, so orders from every gateway get one 0 to 100 score with a written reason for every point, and a review queue in WooCommerce. See order risk scoring.

It does not replace Radar's network model, and it does not block a Stripe payment inside Stripe. Keep Radar on, and use ChargeWarden for the checkout and the gateways Radar does not reach.

You can see Radar reviews, blocked attacks and scored orders on the live demo. On our pricing page on 26 October 2026, ChargeWarden is $129 a month for a single store, $199 for 5 stores and $349 for unlimited stores, with a 14-day store credit return. Pick a plan.

This guide is general information, not legal or financial advice. Prices, plans and features are from Stripe's and WooCommerce's public pages and code on 26 October 2026 and change over time. Stripe and Stripe Radar are trademarks of Stripe, Inc.; WooCommerce is a trademark of Automattic Inc. PluginLoom is not affiliated with or endorsed by either.