Pro pattern library is now a signed, auto-updating rule pack. No action required.<\/p>","0.1.0":"
Initial release.<\/p>"},"ratings":[],"assets_icons":{"icon-256x256.png":{"filename":"icon-256x256.png","revision":3533528,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3533528,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.1.0","0.2.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3533528,"resolution":"1","location":"assets","locale":"","width":1200,"height":540},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3533528,"resolution":"2","location":"assets","locale":"","width":486,"height":179},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3533528,"resolution":"3","location":"assets","locale":"","width":1200,"height":900},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3533528,"resolution":"4","location":"assets","locale":"","width":1200,"height":900},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3533528,"resolution":"5","location":"assets","locale":"","width":1200,"height":900}},"screenshots":{"1":"Settings page \u2014 velocity rule thresholds, failed-payment blocklist, IP whitelist, REST API protection toggle.","2":"Dashboard widget \u2014 blocked attempt counts at a glance (24h \/ 7d \/ 30d).","3":"Event log \u2014 recent block events with rule name, source IP, and detail.","4":"Pro settings panel \u2014 per-feature settings (visible to Pro users).","5":"Recent events showing pattern-library rule matches blocking curl-style bot user agents."},"jetpack_post_was_ever_published":false},"plugin_section":[262246],"plugin_tags":[262525,12891,171765,600,286],"plugin_category":[45,54],"plugin_contributors":[263125],"plugin_business_model":[],"class_list":["post-312371","plugin","type-plugin","status-publish","hentry","plugin_section-dashboard-widgets","plugin_tags-card-testing","plugin_tags-fraud","plugin_tags-rate-limit","plugin_tags-security","plugin_tags-woocommerce","plugin_category-ecommerce","plugin_category-security-and-spam-protection","plugin_contributors-junkoe","plugin_committers-junkoe"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/velocity-guard-for-woocommerce\/assets\/icon-256x256.png?rev=3533528","icon_2x":"https:\/\/ps.w.org\/velocity-guard-for-woocommerce\/assets\/icon-256x256.png?rev=3533528","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/velocity-guard-for-woocommerce\/assets\/screenshot-1.png?rev=3533528","caption":"Settings page \u2014 velocity rule thresholds, failed-payment blocklist, IP whitelist, REST API protection toggle."},{"src":"https:\/\/ps.w.org\/velocity-guard-for-woocommerce\/assets\/screenshot-2.png?rev=3533528","caption":"Dashboard widget \u2014 blocked attempt counts at a glance (24h \/ 7d \/ 30d)."},{"src":"https:\/\/ps.w.org\/velocity-guard-for-woocommerce\/assets\/screenshot-3.png?rev=3533528","caption":"Event log \u2014 recent block events with rule name, source IP, and detail."},{"src":"https:\/\/ps.w.org\/velocity-guard-for-woocommerce\/assets\/screenshot-4.png?rev=3533528","caption":"Pro settings panel \u2014 per-feature settings (visible to Pro users)."},{"src":"https:\/\/ps.w.org\/velocity-guard-for-woocommerce\/assets\/screenshot-5.png?rev=3533528","caption":"Recent events showing pattern-library rule matches blocking curl-style bot user agents."}],"raw_content":"\n
Is your store getting waves of failed orders and surprise payment-processor fees?<\/strong> That's almost always a card-testing attack \u2014 and Velocity Guard stops it automatically.<\/p>\n\n What is card-testing?<\/strong> Criminals buy lists of stolen card numbers and need to find which ones still work. They do it by running hundreds of small orders through real checkouts like yours. Every attempt can cost you a processing fee, and a flood of declines can get your Stripe or PayPal account flagged or frozen. It's automated \u2014 it can hammer your store overnight while you sleep.<\/p>\n\n What Velocity Guard does:<\/strong> It watches how fast orders arrive from the same shopper, email, or device. A real customer places one order; an attack tool tries dozens in minutes. When Velocity Guard sees that burst, it quietly turns away the extra attempts before they reach your payment processor \u2014 the attacker gets nothing and you don't get billed. Genuine shoppers never notice; the limits sit well above normal buying behavior.<\/p>\n\n Set it and forget it.<\/strong> Install, activate, done. The defaults are tuned to be invisible to real customers, and it runs entirely on your own site with no account to create.<\/p>\n\n Under the hood, Velocity Guard tracks how many checkout attempts come from each identity (IP address, email address, session, or combination) inside a sliding time window. Once an identity crosses the configured threshold, further attempts are rejected before WooCommerce ever processes the order \u2014 including direct hits to the REST API that skip your normal checkout page. Repeated failed payments auto-blocklist the source for hours.<\/p>\n\n Pro upgrades available via the in-plugin Upgrade screen:<\/p>\n\n The default velocity thresholds are tuned to be invisible to normal shoppers. You can adjust per-rule and add staff IPs to the whitelist.<\/p>\n\n\n No. Velocity Guard runs entirely on your WordPress server. The free version has no external dependencies.<\/p><\/dd>\n The default thresholds (5 orders per IP per 10 minutes, 3 per email per hour, 3 failed payments before auto-blocklist) are tuned to be invisible to normal shoppers. Every block is logged with rule + source so you can audit and tune per-rule from the settings page. Whitelist your staff IPs to bypass entirely.<\/p><\/dd>\n Yes. Velocity Guard protects both the classic checkout ( Yes, but you need to tell the plugin which header carries the real client IP. Go to WooCommerce \u2192 Velocity Guard \u2192 Reverse proxy \/ CDN<\/strong> and select your provider (Cloudflare uses Yes, built HPOS-native from day one. No legacy meta-table queries.<\/p><\/dd>\n Yes. The plugin won't activate without WooCommerce 8.0+ active.<\/p><\/dd>\n The free version stops bots that don't load your page (curl, scripts, direct API hits without a session cookie) and rate-limits per identity (IP \/ email \/ session). Pro adds device fingerprinting (catches attackers that rotate IPs but keep the same browser), real-time alerts, and an updatable pattern library sourced from active vulnerability research.<\/p><\/dd>\n Velocity Guard stores: timestamps of checkout attempts, source IPs, billing emails, session identifiers, and block reasons. It does NOT store card numbers, CVCs, or any PCI-sensitive data.<\/p><\/dd>\n\n<\/dl>\n\n\nFree version features<\/h4>\n\n
\n
\/wc\/v3\/orders<\/code>, \/wc\/store\/v1\/checkout<\/code>, and \/wc\/store\/checkout<\/code> (the routes modern card-testing bots target directly)<\/li>\nVelocity Guard Pro<\/h4>\n\n
\n
\n
velocity-guard-for-woocommerce<\/code> folder to \/wp-content\/plugins\/<\/code>.<\/li>\n\n
Does this require an external API or service?<\/h3><\/dt>\n
Will this block legitimate customers?<\/h3><\/dt>\n
Does it work with WooCommerce Blocks \/ Cart-Checkout Blocks?<\/h3><\/dt>\n
woocommerce_checkout_process<\/code> hook) and the Cart\/Checkout block Store API (woocommerce_store_api_checkout_order_processed<\/code> and rest_pre_dispatch<\/code> for direct REST hits).<\/p><\/dd>\nI run my site behind Cloudflare \/ Sucuri \/ Akamai \u2014 will per-IP velocity still work?<\/h3><\/dt>\n
CF-Connecting-IP<\/code>, Akamai uses True-Client-IP<\/code>, etc.). Default is REMOTE_ADDR<\/code> which is the safe choice when no proxy is in front of your site.<\/p><\/dd>\nIs this HPOS-compatible?<\/h3><\/dt>\n
Do I need WooCommerce installed?<\/h3><\/dt>\n
What's the difference between the free version and Pro?<\/h3><\/dt>\n
Does the plugin store any sensitive data?<\/h3><\/dt>\n
0.2.0<\/h4>\n\n
\n
0.1.0<\/h4>\n\n
\n
\/wc\/v3\/orders<\/code>, \/wc\/store\/v1\/checkout<\/code>, \/wc\/store\/checkout<\/code>.<\/li>\nFeaturesUtil::declare_compatibility<\/code>.<\/li>\n