I got a message from a store owner last month. Subject line: “Stripe froze my account.”
He woke up on a Tuesday to 800+ failed orders in WooCommerce. Small amounts. $1.49, $2.00, $4.99. Different card numbers. Different names. All from the same IP range. All within a 4-hour window overnight.
Card testing attack. Classic one.
By the time he noticed, Stripe had already flagged his decline rate. Account under review. No payments for 9 days. For a store doing $40K a month, that’s roughly $12,000 in revenue sitting in limbo because bots decided his checkout was a good place to validate stolen credit cards.
He had no fraud protection installed. Not even Stripe Radar’s custom rules configured.
That conversation is why I’m writing this. Because most WooCommerce store owners don’t think about fraud prevention until they’re already dealing with the fallout. And by then, you’re choosing between bad options.
So here’s the breakdown. Every major fraud prevention option for WooCommerce in 2026, what each one does, what it costs, and which ones are worth installing.
Pre-Checkout vs. Post-Payment: The Distinction That Matters
Before I get into the rankings, you need to understand the single biggest difference in how fraud plugins work. It changes everything about their value.
Post-payment detection is what most plugins do. They let the transaction attempt go through to your payment processor, then analyze the result. If it looks fraudulent, they flag it, hold it, or cancel it. The problem? Your processor already saw that transaction. If it was declined, you already paid the decline fee. If it went through, you’re now dealing with a chargeback.
Pre-checkout blocking stops the attempt before it ever touches your payment gateway. The suspicious request gets rejected at the WooCommerce level. Your processor never sees it. No fee. No declined transaction on your record. No impact on your decline rate.
This matters because payment processors track your decline rate. Stripe, PayPal, Square. They all do it. If your decline ratio spikes because bots hammered your checkout with 500 stolen card numbers, your processor doesn’t care that you were the victim. They see a high-risk merchant. They freeze your account first and ask questions later.
Pre-checkout blocking keeps those bot attempts off your processor’s radar entirely.
The Comparison Table
| Plugin | Type | Pre-Checkout Blocking | Velocity Limits | IP Geolocation | VPN/Proxy Detection | Email Filtering | Pricing |
|---|---|---|---|---|---|---|---|
| Refinery Fraud Guard | WP Plugin | Yes | Yes | Yes | Yes | Yes | $49-99/yr |
| Stripe Radar | Gateway Built-in | No | Partial | Yes | No | No | Free (Radar Lite) / from $10/mo |
| WooCommerce Anti-Fraud (discontinued) | WP Plugin | No | No | Yes | No | Yes | No longer sold |
| CleanTalk | SaaS + WP Plugin | Partial | Yes | Yes | Yes | Yes | $12-200/yr |
| Wordfence | WP Plugin | Partial (firewall) | Yes (login/general) | Yes | No | No | Free / paid Premium |
| YITH Anti-Fraud | WP Plugin | No | No | Yes | No | Yes | Paid, annual |
1. Refinery Fraud Guard (Best Overall)
Best for: WooCommerce stores that want to block fraud before it costs money.
Fraud Guard runs entirely pre-checkout. When a customer (or bot) initiates a checkout, the plugin evaluates the request against multiple risk signals before the order reaches your payment gateway.
Here’s what it checks:
- Velocity rate limiting. How many checkout attempts has this IP made in the last X minutes? 3 attempts in 10 minutes is a customer re-entering their card number. 50 attempts in 2 minutes is a bot. Fraud Guard catches the difference and blocks the bot automatically.
- IP geolocation. If you only ship to the US and Canada, checkout attempts from IP ranges in countries you don’t serve get blocked. Simple, but it eliminates a huge chunk of automated attacks.
- VPN and proxy detection. About 60% of card testing attacks route through VPNs or proxies. Fraud Guard doesn’t blanket-block all VPN users (plenty of legitimate customers use them). It treats VPN traffic as a risk signal and weighs it against other factors. VPN + velocity spike + disposable email = blocked. VPN + normal behavior + real email = allowed.
- Suspicious email detection. Bots use disposable email services. Mailinator, Guerrilla Mail, TempMail, and hundreds of others. Fraud Guard maintains a database of known disposable email domains and flags checkout attempts using them. It also catches obviously generated email patterns: random strings, no real name structure, domains registered within the last 48 hours.
- Blocklist management. Once you’ve identified a bad actor, add their IP, IP range, email, or email domain to a permanent blocklist. Future attempts from those sources get rejected before the checkout page even loads.
The key differentiator: none of these checks touch your payment processor. Every block happens at the WooCommerce application layer. Your Stripe decline rate stays clean. Your PayPal dispute ratio stays clean. Your processor never knows the attack happened.
Pricing: $49-99/year depending on plan.
Best for: Any WooCommerce store that processes payments. If you accept credit cards, you need pre-checkout fraud prevention. Stripe Radar alone isn’t enough.
2. Stripe Radar (Best Baseline, Already Included)
Best for: Stores already on Stripe who want a zero-effort starting layer.
If you use Stripe as your payment gateway, you already have Radar. It’s built into every Stripe account. The basic version runs automatically on every transaction.
Radar uses machine learning trained on data from millions of Stripe merchants. It scores every transaction for fraud risk and can automatically block high-risk charges. The model is good. It catches a lot of obvious fraud.
But here’s the limitation: Radar only sees the transaction after it hits Stripe. By the time Radar evaluates the charge, you’ve already incurred the processing attempt. If Radar blocks a fraudulent charge, that’s a declined transaction on your record. Multiply that by hundreds of bot attempts, and your decline rate spikes even though Radar “caught” every one.
Radar also can’t see WooCommerce-level data the way a WordPress plugin can. It doesn’t know the customer’s browsing behavior, how fast they moved through checkout, or whether they’ve been flagged in your store before. It only sees what Stripe sees: card number, amount, IP, billing address.
The paid Radar tiers (Standard from $10/month, Plus from $14, Pro from $20) add custom rules, manual review queues, and more granular controls. Worth it for high-volume stores doing $500K+ a month. For most WooCommerce stores, Radar Lite is fine as a second layer.
What to do: Keep Radar active (it’s on by default). Enable its custom rules: block transactions under $5 from new customers, require 3D Secure for international cards, flag orders where billing and shipping countries don’t match. Then add a pre-checkout plugin like Fraud Guard in front of it. Radar catches what gets past your first layer. Two layers are better than one.
Pricing: Radar Lite is included at no extra charge on standard Stripe payments pricing. Paid tiers start at $10/month.
3. CleanTalk (Best Budget Anti-Spam + Fraud Combo)
Best for: Stores dealing with both spam and fraud who want one cheap tool.
CleanTalk started as an anti-spam service and expanded into fraud prevention. It works differently from most WordPress plugins. Your checkout data gets sent to CleanTalk’s cloud servers for analysis, and the response comes back with a risk score.
The upside: CleanTalk’s database is massive. They process data from over 600,000 websites, so their IP reputation and email reputation databases are extensive. If an IP has been flagged as a spam source across thousands of other sites, CleanTalk knows about it before that IP ever reaches your checkout.
The downsides: latency and data handling. Every checkout request makes a round trip to CleanTalk’s servers. On a fast connection, that’s 100-200ms. On a slow day, it’s more. For most stores, that’s invisible. For high-traffic stores running optimized checkouts, it’s worth testing.
The bigger concern for some store owners is that checkout data (IP, email, billing info) leaves your server and hits CleanTalk’s API. If you’re in a regulated industry or your customers are privacy-conscious, that matters.
CleanTalk does offer some pre-checkout blocking through its JavaScript checks, but the core fraud analysis happens server-side after the form submission. It’s not true pre-gateway blocking the way Fraud Guard handles it.
Pricing: $12/year for a single site, scaling to $200/year for 40 sites. Dirt cheap, honestly.
Best for: Budget-conscious stores, stores that also have spam problems (comment spam, registration spam), stores that want a “set it and forget it” cloud service. Not ideal if you need granular WooCommerce-specific controls or full pre-checkout blocking.
4. Wordfence (Best General Security, Limited Fraud Focus)
Best for: Stores that need a general WordPress security plugin and want basic bot protection.
Wordfence is a WordPress security plugin, not a fraud prevention plugin. But its firewall and rate-limiting features provide some fraud prevention as a side effect.
The Web Application Firewall (WAF) can block known malicious IPs, rate-limit requests to specific endpoints (including your checkout URL), and detect bot patterns. If you configure custom firewall rules to limit checkout attempts per IP per minute, you get basic velocity protection.
But Wordfence doesn’t understand WooCommerce. It doesn’t know what a checkout attempt looks like versus a product page view. It doesn’t analyze email addresses for disposable domains. It doesn’t score orders for fraud risk. It’s protecting WordPress at the network/application level, not analyzing commerce transactions.
If you already run Wordfence for security (and you should run something for site operations and security), its rate limiting adds a thin layer of fraud protection. But don’t rely on it as your fraud prevention strategy.
Pricing: Free tier, plus a paid Premium licence billed annually. Check wordfence.com for the current rate.
Best for: General WordPress security. Not a replacement for WooCommerce-specific fraud prevention.
5. YITH Anti-Fraud for WooCommerce
Best for: Stores that want basic post-payment fraud flagging with WooCommerce integration.
YITH Anti-Fraud analyzes orders after they’re placed and assigns a risk score. It checks billing and shipping address mismatches, email domain reputation, geolocation of the customer’s IP versus their billing address, and order amount relative to store averages.
High-risk orders get flagged for manual review or automatically cancelled.
The limitation is the same one most post-payment tools share: the transaction already happened. If the order was fraudulent and the payment went through, you’re now dealing with a cancellation, a refund, and potentially a chargeback. If it was a declined card test, the decline is already on your processor’s record.
YITH’s risk scoring is basic compared to dedicated fraud tools. It doesn’t do velocity checking (how many attempts per minute from one IP). It doesn’t detect VPN or proxy usage. It doesn’t maintain a blocklist that persists across sessions.
Pricing: $69/year.
Best for: Stores that want a simple “flag suspicious orders” system inside WooCommerce. Works as a supplemental layer, not a primary defense.
6. WooCommerce Anti-Fraud (No Longer Available)
I’m including this because it still shows up in search results and old blog posts.
The original WooCommerce Anti-Fraud plugin, since delisted from the WooCommerce marketplace, was one of the first dedicated fraud plugins for WooCommerce. It checked IP geolocation, email domains, billing/shipping mismatches, and proxy detection.
As of early 2026, the plugin is no longer available on the WooCommerce marketplace. The developer’s updates stopped, and compatibility issues with WooCommerce 8.x and 9.x went unresolved. If you’re still running it, you should replace it. Unmaintained security plugins are a liability.
How to Stack Your Fraud Prevention
You don’t need five fraud plugins. You need two layers that complement each other.
Layer 1: Pre-checkout blocking (Fraud Guard). This is your front line. Velocity limits, IP geolocation, VPN detection, email filtering, and blocklist management. Stops bot attacks before they touch your payment processor. Your decline rate stays clean. Your processor stays happy.
Layer 2: Gateway-level detection (Stripe Radar). This is your safety net. Radar evaluates every transaction that gets past Layer 1 using Stripe’s machine learning model. Configure custom rules: block sub-$5 charges from new customers, require 3D Secure on international orders, flag billing/shipping country mismatches.
Two layers. That’s it. Layer 1 handles volume attacks and known bad actors. Layer 2 catches the sophisticated fraud that uses real-looking data and doesn’t trigger velocity limits.
If you want to add CleanTalk as a third layer for its global IP reputation database, go for it. At $12/year, the cost is negligible. But Fraud Guard + Stripe Radar covers 95%+ of what WooCommerce stores face.
What About reCAPTCHA?
I get this question a lot. “Can’t I just add reCAPTCHA to my checkout?”
You can. And it helps with unsophisticated bots. But modern card testing bots solve reCAPTCHA. Services like 2Captcha and Anti-Captcha solve them programmatically for fractions of a penny per solve. reCAPTCHA v3 (the invisible one) is better, but it still lets through a meaningful percentage of automated traffic.
reCAPTCHA also adds friction for real customers. Every extra step in checkout costs you conversions. If you’re spending effort optimizing your cart experience and trimming checkout fields, adding a CAPTCHA challenge works against that.
Use reCAPTCHA if you want. It’s free and it filters out the laziest bots. But don’t count on it as your fraud prevention strategy.
The Real Cost of Skipping Fraud Prevention
Here’s the math on doing nothing.
A single card testing attack with 500 attempts costs $75-125 in processor decline fees. That’s one attack. Bots come back. If you get hit twice a month (common for stores in certain verticals like supplements, CBD, and digital products), that’s $150-250/month in fees alone.
But the decline fees are the small number.
The big number is what happens when your payment processor freezes your account. 7-14 days of no payment processing. For a store doing $30K/month, that’s $7,000-14,000 in revenue you can’t collect. Orders you can’t fulfill. Customers who leave and don’t come back.
And if chargebacks stack up from the few test transactions that actually went through? Each one costs $15-25 in fees, plus you lose the product and revenue. Hit enough chargebacks and your processor puts you on a monitoring program, or drops you entirely.
A fraud prevention plugin costs $49-99/year. One prevented attack pays for itself 10 times over.
My Recommendation
Install Fraud Guard. Configure Stripe Radar’s custom rules. Done.
That combination handles card testing, credential stuffing, VPN-masked attacks, disposable email abuse, and repeat bad actors. Pre-checkout blocking keeps your processor’s decline rate clean. Stripe Radar catches anything that slips through.
If you’re running a WooCommerce store and you’re also thinking about revenue optimization more broadly, fraud prevention is the foundation. You can’t optimize conversions if bots are inflating your transaction data and threatening your payment processing. Get the fraud layer locked down first. Then build on top of it.
Same principle applies to subscription retention. If you’re running WooCommerce Subscriptions, failed payment recovery only works when your payment processor account is healthy. A fraud-triggered account freeze kills your dunning sequences and recovery automations overnight.
Fraud prevention isn’t glamorous. Nobody tweets about their fraud plugin. But it’s the layer that protects everything else you’re building.
Set it up before the bots find you. Because they will.
Mike Valera builds WooCommerce growth tools at RefineryWP.