WooCommerce Anti-Fraud Plugins Compared

Short answer: WooCommerce anti-fraud plugins fall into four groups: full rule-and-score plugins (OPMC's Anti-Fraud for WooCommerce, YITH WooCommerce Anti-Fraud, Anti-Fraud Shield), outside fraud-scoring services (FraudLabs Pro), free blocklists (Fraud Prevention For WooCommerce and EDD, Blacklist Manager), and the tools already inside your gateway (WooPayments fraud rules, Stripe Radar). Which one you need depends on your problem. Card-testing bursts need limits on failed payments that also cover the Store API. Risky one-off orders need readable scores and a review queue. Repeat abusers only need a blocklist.

Disclosure: PluginLoom makes ChargeWarden, one of the plugins in this comparison. Facts about other plugins come from their own listing or pricing pages, checked on 24 October 2026. We did not install and test competitors for this article, so we have not rated them; where a listing does not say something, we write "not stated".

What should an anti-fraud plugin do in 2026?#

Three facts shape the answer.

1. Attackers skip the checkout page. WooCommerce's developer blog wrote on 18 December 2024 that it had seen "card attacks specifically targeting the Store API alone, even without the use of the Checkout block", and that many captcha plugins were "not protecting the Checkout Block/Store API".
2. WooCommerce core now has a limiter, but it is off by default. Since WooCommerce 9.6 you can turn on "Rate limit Checkout", which allows 3 place-order requests per 60 seconds on the Store API checkout. It counts requests, not failed payments, and it does not cover the classic checkout.
3. Card networks now count card testing against you. Visa's monitoring program includes an enumeration ratio for card testing, and since 1 April 2026 Visa's excessive-merchant fraud and dispute threshold in the US, Canada, the EU and Asia Pacific is 1.5%, down from 2.2%. See Visa VAMP 2026.

So the criteria we used are:

• Store API coverage: does it check orders placed through the Store API, not just the classic checkout form?
• Failed-payment counting: does it limit by failures per IP, network, email, browser or card, not just orders?
• Smart challenge: can it show a captcha only to risky shoppers?
• Readable scores: can you see why an order was flagged?
• Data sharing: does shopper data go to an outside service?
• Price: the listed price on 24 October 2026.

The plugins compared#

On Store API coverage, only some listings say it outright. Blacklist Manager names Checkout Blocks and REST API orders. OPMC's own card-testing documentation tells users to make sure nothing blocks wp-json/wc/store/v1/checkout, which points to Store API support. For the others, the listings we read do not say, so ask the vendor before you buy.

Which type fits your problem?#

Many stores need two layers: the gateway's own tool for payment risk, and a plugin for checkout velocity, which the gateway cannot see because the attack hits WooCommerce first.

What does it cost to do nothing?#

The costs are real even when no stolen card ever succeeds:

• Failed orders and gateway fees. OPMC's documentation describes attacks that "flood stores with hundreds or thousands of fake transactions, often within minutes".
• Fraud that follows the test. Visa says enumeration, which it describes as "a rapid, brute force card testing attack at scale", leads to $1.1 billion a year in fraud losses. Cards confirmed on your checkout can come back to you as fraud reports and disputes.
• Card network monitoring. Visa counts fraud reports and disputes against settled card-not-present sales. In the US the excessive-merchant level has been 1.5% since 1 April 2026, with a minimum of 1,500 fraud and dispute reports a month. A small store will not reach that count, but Visa also measures each acquirer's whole portfolio and requires acquirers to take "proactive steps" against enumeration, so expect that pressure to reach you through your payment provider.

How to choose, step by step#

1. Turn on WooCommerce's own limiter under Settings, Advanced, Features, "Rate limit Checkout". It is free.
2. Turn on your gateway's tools. Check WooPayments' fraud protection level or your Stripe Radar plan.
3. Name your problem: bursts, risky orders or repeat offenders.
4. Check Store API coverage in writing for any plugin you consider.
5. Check what data leaves your site. Outside services score better with more data but it is shopper data.
6. Test on a staging site. Place a real order, then a burst of failed orders, and confirm real customers still pay.

Questions to ask any vendor before you buy#

A listing page rarely answers the questions that decide whether a plugin will hold up during an attack. Ask these in writing, and keep the answers:

1. Does it check orders placed through POST /wp-json/wc/store/v1/checkout when the store does not use the Checkout block?
2. Does it count failed payments, or only orders and requests?
3. Can it limit by IP network as well as single IP addresses, since attackers rotate addresses?
4. Does it work with my gateway's card fields, such as WooPayments, Stripe or PayPal, and does it read their risk results?
5. What happens to a real customer who is blocked by mistake? Do blocks expire, and can I allowlist an office or a trusted buyer?
6. Which shopper data is sent off my server, to whom, and under which terms?
7. Does it work with HPOS order storage?
8. What does it log, for how long, and can I export or erase a customer's data on request?

If a vendor cannot answer the first two, the plugin may still be useful for risky orders, but it is not a card-testing defence.

How ChargeWarden does it#

ChargeWarden was built around the Store API problem. It counts checkout attempts and failed payments per IP address, per /24 or /64 network, per email, per browser, per card BIN and last four, and per session, on the classic checkout, the Store API, the pay for order page and the add payment method form. Blocks expire on their own. If failed payments spike store-wide, attack mode divides every limit by three and can ask every shopper for a Turnstile or hCaptcha check. Each order gets a 0 to 100 score with a written reason for every point, using WooPayments, Stripe and PayPal risk data your gateway has already saved. Scores use your own data and free public IP lists checked on your server; nothing is sent to a fraud service.

You can see blocked attacks, held orders and scores on the live demo, read how the limits work, and buy it here. For the background on attacks, see WooCommerce card testing.

This guide is general information. Prices and listing figures are from public pages on 24 October 2026 and change over time.