ChargeWardenCard-testing and fraud protection for WooCommerce, with ACH return monitoring for BankBridge stores.
ChargeWarden stops card-testing attacks on the WooCommerce classic checkout and on the Store API that the Checkout block uses, scores every order with written reasons, tracks ACH return rates and WEB debit account validation for BankBridge, and inventories the scripts on your payment pages.
- WordPress
- WooCommerce
- BankBridge
- 14-day refund policy
- Secure checkout by Stripe
- License, updates and support for a year
Every plan includes
- The BankBridge plugin for the sites on your plan
- Plugin updates for one year
- Support from our team for one year
- Move your license between sites from your account
- Full refund within 14 days of purchase
Features
What ChargeWarden does
Grouped by job: card testing, order risk, ach monitoring, script monitor, admin.
Card testing
Limits where card testers actually hit
Counts attempts and failed payments on the classic checkout, the Store API checkout used by the Checkout block (and called directly by attack scripts), the pay for order page and the add payment method form.
Card testing
Six ways to count a shopper
Limits per IP address, per /24 or /64 network, per email, per browser, per card BIN and last four digits where the gateway exposes them, and per session. Emails, browsers and cards are stored only as keyed hashes.
Card testing
Temporary blocks, a blocklist and an allowlist
Automatic blocks expire on their own. Add your office network or a trusted buyer to the allowlist so they are never limited.
Card testing
A challenge only when risk is elevated
Optional Cloudflare Turnstile or hCaptcha, shown on the classic checkout and the Checkout block only to shoppers who are halfway to a limit, or to everyone during attack mode.
Card testing
Attack mode
Switch it on by hand or let ChargeWarden turn it on when failed payments spike store-wide: tighter limits, a challenge for every checkout and no checkout without the browser signal.
Order risk
Order risk scores you can read
Every order gets a score from 0 to 100 and a written reason for every point: country mismatches, disposable email, a high first order, many cards tried, Tor and cloud hosting networks, proxy headers and gateway risk data.
Order risk
Hold, review, tag or cancel
Choose what happens at each score band. A review queue gives one-click approve or reject, and can block a rejected order's email, browser and IP.
Order risk
Uses the risk data your gateway already has
Reads WooPayments' risk level and fraud outcome, PayPal's card security code, address and 3D Secure results, Stripe Radar reviews, and the Plaid Signal score that BankBridge saves.
ACH monitoring
ACH return rates against the Nacha levels
Rolling 60-day unauthorized, administrative and overall return rates for BankBridge payments, with alerts as a rate approaches 0.5%, 3% or 15%.
ACH monitoring
WEB debit account validation record
Records how each bank account was validated through Plaid when the debit was created, and flags first-use accounts without a record.
ACH monitoring
Monthly evidence report for your bank
A PDF and CSV report of volumes, return rates, return codes, account validation and checkout controls. It supports your own risk-based process; it is not a certification.
Script monitor
Payment page script inventory
Lists every script on the checkout and pay for order pages, from WordPress, from shoppers' browsers and from a daily scan, with a written justification for each one you authorize.
Script monitor
Change and tamper alerts
Content hashes, alerts for new and changed scripts, a check of the checkout page's security headers and a CSV evidence export, as a helper for PCI DSS 6.4.3 and 11.6.1.
Admin
Setup wizard, dashboard and WP-CLI
A five-step wizard with safe defaults, a dashboard of blocked attacks, held orders and return rates, email alerts, logs with retention, privacy export and erase tools, and wp chargewarden commands.
Use cases
How sites use it, by integration
- WooCommerce
Stop a card-testing attack on the Store API
Attack scripts post straight to /wp-json/wc/store/v1/checkout, often from many IP addresses. Network, card and browser limits stop them while real shoppers keep paying.
How it works with WooCommerce: Stop a card-testing attack on the Store API - WooCommerce
Hold risky high-value orders for a look
A first order of $900 shipped to another country from a disposable email goes on hold with its reasons listed. Approve or reject it in one click.
How it works with WooCommerce: Hold risky high-value orders for a look - BankBridge
Keep evidence for your ACH bank
Download a monthly report of return rates and account validation to show your bank how you monitor ACH fraud.
How it works with BankBridge: Keep evidence for your ACH bank - WooCommerce
Know what runs on your checkout
See every script on the payment page, write down why each one is there, and get an email when one appears or changes.
How it works with WooCommerce: Know what runs on your checkout
ChargeWarden is a WooCommerce plugin that stops card-testing attacks and explains every fraud decision it makes. It protects the classic checkout and the Store API that the Checkout block uses, scores each order with written reasons, and, for stores that take bank payments with BankBridge, tracks ACH return rates and account validation and builds a monthly evidence report for your bank.
What problem does it solve?#
Card testers use your checkout to find out which stolen card numbers still work. WooCommerce's developer team wrote on 18 December 2024 that it had seen "card attacks specifically targeting the Store API alone, even without the use of the Checkout block" (WooCommerce developer blog (opens in a new tab)), and that many captcha plugins were not protecting that endpoint at the time.
WooCommerce ships a Store API rate limiter, but it is off by default and counts requests, not failed payments (rate limiting docs (opens in a new tab), checked 24 October 2026). The classic checkout has no rate limit in core. ChargeWarden fills those gaps and builds on the core limiter instead of replacing it.
How does the card-testing defence work?#
ChargeWarden counts two things for each shopper: checkout attempts and failed payments. It counts them six ways, so a botnet that rotates IP addresses is still caught by its network, its browser or the card it keeps trying.
| Counted per | Default limit | Then |
|---|---|---|
| IP address | 5 failed payments in 10 minutes | Blocked for 1 hour |
| /24 or /64 network | 12 failed payments in 10 minutes | Blocked for 1 hour |
| Email (normalised) | 4 failed payments in 1 hour | Blocked for 24 hours |
| Browser | 5 failed payments in 1 hour | Blocked for 6 hours |
| Card BIN and last 4 | 3 failed payments in 1 hour | Blocked for 24 hours |
| Session | 3 failed payments in 10 minutes | Blocked for 1 hour |
| IP address | 15 attempts in 10 minutes | Challenge, or a 15 minute block |
Every number can be changed. Attack mode divides every limit by three and, if you set up a challenge provider, asks every shopper to complete it.
How are orders scored?#
Each order gets points from simple rules, and every point comes with a reason a person can read.
| Rule | Default points |
|---|---|
| Billing and shipping countries differ | 10 |
| Shopper IP country differs from billing country | 15 |
| Disposable email domain | 20 |
| First order at or above your high-value amount | 15 |
| Three or more cards tried in 24 hours | 25 |
| Tor exit node (free Tor Project list) | 30 |
| Cloud hosting network (free AWS, Google Cloud, DigitalOcean and Oracle lists) | 15 |
| Gateway rated the payment elevated or highest risk | 20 or 40 |
| Gateway asked for a review | 25 |
| Matches an order you rejected as fraud | 40 |
At 40 points an order goes to the review queue, and at 60 it is put on hold. You choose the actions.
What does it add for BankBridge stores?#
Nacha's fraud monitoring rules now cover every business that originates ACH debits: Phase 1 took effect on 20 March 2026 and Phase 2 on 19 June 2026, in practice 22 June 2026 (Nacha (opens in a new tab)). ChargeWarden reads every ACH entry BankBridge makes and gives you:
- Rolling 60-day return rates for the unauthorized, administrative and overall return families, against Nacha's levels of 0.5%, 3.0% and 15.0%, with alerts before you reach them.
- A record of how each WEB debit account was validated through Plaid, captured when the debit was created.
- A monthly PDF and CSV evidence report for your bank.
These support your own risk-based process. They are not a certification.
What about payment page scripts?#
PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1, in force since 31 March 2025, ask merchants to manage and monitor the scripts on their payment pages (PCI SSC (opens in a new tab)). ChargeWarden lists the scripts on your checkout, asks you to authorize each with a written reason, and alerts you when one appears or changes. It cannot see inside a payment provider's iframe, and it does not make you compliant. The script monitor doc lists exactly what it does not cover.
What do I get with a license?#
- The ChargeWarden plugin for the number of sites on your plan
- Plugin updates and support for one year
- A 14-day refund policy
ChargeWarden keeps working if you do not renew; renewing keeps updates and support coming.
Last updated October 24, 2026.
Compare
ChargeWarden vs building it yourself
| What you need | ChargeWarden | WooCommerce core rate limit | Checkout captcha only |
|---|---|---|---|
| Covers the Store API checkout | Yes | Yes, when turned on (off by default) | Only if the captcha plugin validates Store API requests |
| Covers the classic checkout | Yes | No rate limit on the classic checkout | Usually |
| Counts failed payments, not just requests | Yes | No, counts requests | No |
| Limits per network, email, browser and card | Yes | Per IP or user (fingerprinting filter since 9.8) | No |
| Challenge shown only when risk is elevated | Optional | No challenge | Shown to everyone |
| Order risk scores with reasons | Yes | No | No |
| ACH return rates and account validation record | With BankBridge | No | No |
| Payment page script inventory | Yes | No | No |
Compatibility
Requirements
Check these before you buy. If you are unsure about your setup, ask us first.
| Works with | WordPress, WooCommerce, BankBridge |
|---|---|
| Requires WordPress | 6.0 or newer |
| Requires PHP | 7.4 or newer |
| Tested up to | WordPress 6.9 |
| WordPress | 6.0 or newer (6.9 or newer recommended) |
| PHP | 7.4 or newer (8.3 recommended) |
| WooCommerce | 8.0 or newer. HPOS order storage, the classic checkout and the Checkout block are all supported |
| Paid services | None required. Cloudflare Turnstile or hCaptcha (both have free plans) are optional, and so is the Stripe Radar lookup, which uses your own Stripe account |
| ACH monitoring | Needs BankBridge with Plaid Transfer. Entries a different processor originates are not visible to ChargeWarden |
Changelog
Every release, in the open
1.0.0Oct 24, 2026
First release.
Our promises
14-day refund policy
If ChargeWarden is not right for you, ask for a full refund within 14 days of purchase.
Read the refund policySupport by ticket, in your account
Open a ticket from your account. Your license and site details are attached, so you do not repeat yourself.
Visit supportGPL code, license for updates
The plugin code is GPL. Your license key turns on updates and support for the year.
Read the license terms
FAQ
ChargeWarden questions, answered
What is card testing?
Card testing is when a criminal sends many small payments with stolen card numbers to find out which cards still work. The failed payments can cost you gateway fees and put your payment account at risk.
Does ChargeWarden protect the WooCommerce Checkout block?
Yes. It checks requests to the Store API checkout endpoint that the Checkout block uses, and the same endpoint when attack scripts call it directly. WooCommerce's developer blog reported attacks on the Store API even on stores that do not use the Checkout block.
Do I need WooCommerce's own rate limiting too?
It helps and costs nothing. WooCommerce can limit the Store API checkout to 3 requests per 60 seconds (Settings, Advanced, Features, Rate limit Checkout). ChargeWarden works with or without it and records its hits on the dashboard.
Do I need a captcha?
No. ChargeWarden blocks on limits by itself. If you add free Cloudflare Turnstile or hCaptcha keys, shoppers who look risky are asked to complete a check instead of being stopped outright.
Does it send shopper data to a fraud service?
No. Scores use the order, your own checkout history, free public IP lists checked on your server, and the risk data your gateway already saved. The optional challenge provider and the optional Stripe Radar lookup are the only outside calls.
Will it block real customers?
Limits count failed payments and blocks expire. Returning customers can skip challenges, and you can allowlist IP ranges, emails and users. Our attack simulator checks that real customers still pay during an attack.
Is the ACH report a Nacha compliance certificate?
No. It summarises your own records to support your risk-based fraud monitoring process. Your bank calculates official return rates from every entry you originate.
Does the script monitor make my store PCI DSS compliant?
No. It helps you keep the script inventory, justifications and change alerts that PCI DSS requirements 6.4.3 and 11.6.1 describe. Your acquirer or a QSA decides what you need, and some merchants can use their payment provider's written confirmation instead.
Does it work without BankBridge?
Yes. Card-testing defence, order scoring and the script monitor work on any WooCommerce store. ACH monitoring needs BankBridge.
What is the refund policy?
You can ask for a full refund within 14 days of purchase. See the refund policy for details.
Ready to connect WordPress to Plaid?
Pick your sites, pay once a year, and get your license key right away.
Plaid is a trademark of Plaid Inc. PluginLoom and BankBridge are independent products that work with Plaid. We are not affiliated with, endorsed by or sponsored by Plaid Inc.