As if Black Friday was not stressful enough. Since this morning there have been constant order attempts, some successful, for low value items (£4.95). They try over and over... and over again.

This is what the orders look like:

enter image description here

And this is the payment attempts on each order:

enter image description here

I am manually adding their IPs to our .htaccess file however this bot changes IP as soon as they are blocked. I won't be able to keep up. Some of the IPs I have blocked:

deny from
deny from
deny from
deny from
deny from
deny from

If they keep updating their IP address, I suppose there is just no way to sort this out, they will always have a way around what ever guards I put up?

Many thanks for any help or advice.

  • 2
    Couldn't you just auto-decline orders for that particular amount or for that particular name? Nov 26 '20 at 13:34

What's likely happening is the bot is trying to determine which cards are valid.

Have you looked into Wordfence? I don't expect it will solve your problem but it will likely significantly mitigate it because it has a blacklist.

If you have appropriate access, You should also look at the log files for something common and unique. It might be there is something in the REFERER or browser string which could help for example - particularly as it sounds like a bot. If you have this you can isolate this you may be able to use fail2ban to block the IPs.

If its automated, adding a capcha would likely defeat - or at least frustrate it.

Another possibility related to captcha - can you isolate orders placed by something like shipping address (and maybe disallow shipping to that region?)

  • Yes to a captcha
    – Steve
    Nov 26 '20 at 23:43
  • No matter what you do but don’t use a captcha.
    – David
    Nov 28 '20 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.