How to stop WooCommerce card testing with edge cryptography

Hey everyone,

If you run an eCommerce SaaS, or if you manage WooCommerce sites for clients, you probably know the absolute terror of waking up to a suspended Stripe account and a massive authorization fee bill.

For those who haven't faced it yet: it’s called card testing. Hackers buy a list of stolen credit cards on the dark web and write headless bots to run thousands of $1 micro-transactions on your checkout endpoint to see which cards are active. Even if every transaction declines, Stripe still charges you a $0.30 authorization fee per attempt. 10,000 bot requests = you owe $3,000 for sales you never made.

The Problem with the "Standard" Fix

The immediate advice you get when this happens is to slap Google reCAPTCHA v2 or v3 on your checkout page. I tried this, and it introduced two massive problems:

Conversion Friction: Forcing a paying customer to click on pictures of traffic lights right when they have their credit card out absolutely murders conversion rates.

GDPR Liabilities: reCAPTCHA v3 uses cross-site tracking cookies and mouse-movement telemetry to assign a "bot score." In the EU, this explicitly requires a cookie consent banner. Putting a cookie banner on a checkout page is a UX nightmare.

The "Aha" Moment (Building the Solution)

I realized that bots don't act like humans—they bypass the frontend JavaScript completely and send raw POST requests directly to the /?wc-ajax=checkout endpoint.

I needed a way to rate-limit the backend without using IP blocking (which fails against botnets).

The solution was Cryptographic Proof of Work (PoW) combined with HTML5 micro-interactions.

Instead of a puzzle, I built a system where the user plays a frictionless 3-second HTML5 mini-game (like catching a falling object). Because it relies on canvas rendering, headless bots can't parallelize it. When the user wins the 3-second game, the edge network generates a time-stamped, HMAC SHA-256 signed payload.

The Code
I wrote a hook into the WooCommerce backend that intercepts the checkout request before it ever pings Stripe.

php

add_action( 'woocommerce_checkout_process', 'validate_checkout_cryptography' );
function validate_checkout_cryptography() {
$token = $_POST['security_handshake_token'] ?? '';
// If the token is missing, the request came from a headless bot. Reject instantly.
if ( empty( $token ) ) {
wc_add_notice( 'Security validation missing.', 'error' );
return;
}
// Cryptographic verification against the edge network
$is_valid = verify_token_against_edge_network( $token, get_option('my_secret_key') );
// If the cryptography fails, halt the checkout before Stripe is pinged.
if ( ! $is_valid ) {
wc_add_notice( 'Automated bot behavior detected. Checkout halted.', 'error' );
}
}

By verifying the cryptographic signature natively in PHP, the server handles the rejection. The payment gateway is never pinged, and the store owner pays $0 in authorization fees. Plus, because the validation is purely mathematical, it uses zero cookies and zero telemetry.

Packaging it into a SaaS / Plugin

After seeing how well this stopped attacks on client sites, I decided to package the entire infrastructure into a plug-and-play WordPress plugin.

I just launched it on the official WP repository: Conversion Business Gamified CAPTCHA.

It natively hooks into WooCommerce out of the box, is 100% ADA compliant, and completely eliminates the need for frustrating picture puzzles.

I’d love to hear from other technical founders—how are you guys handling automated bot traffic on payment endpoints? Has anyone else tried moving away from telemetry-based CAPTCHAs?

Happy to answer any questions about the crypto-handshake architecture!