WebMe Carding Shield User Documentation
What It Protects
WebMe Carding Shield helps reduce automated checkout abuse, especially card-testing and fake-checkout patterns that repeatedly submit WooCommerce checkout requests.
First Setup
- Install and activate WebMe Carding Shield.
- Confirm WooCommerce is active.
- Open WooCommerce > Carding Shield.
- Start with Monitor mode if the store is already receiving normal traffic.
- Review WooCommerce > Carding Shield Log.
- Move to blocking once thresholds look safe for the store.
Settings
| Setting | Meaning |
|---|---|
| Protection | Enables or disables checkout protection. |
| Preset | Stores the intended operating posture: Conservative, Balanced, Aggressive, or Monitor. |
| Monitor mode | Logs risk without blocking or holding orders. |
| Default high-risk action | What to do when high-risk threshold is reached: block, hold, or monitor. |
| IP threshold | Number of recent attempts from an IP hash before IP velocity triggers. |
| Email threshold | Number of recent attempts from an email hash before email velocity triggers. |
| Fingerprint threshold | Number of recent attempts from a request fingerprint before fingerprint velocity triggers. |
| High-risk score | Score at which high-risk action applies. |
| Log retention days | Intended retention window for compact event logs. |
Decisions
- Allow: checkout continues.
- Monitor: checkout continues and event is logged.
- Hold: order is marked for manual review.
- Block: checkout stops with a generic customer-facing message.
Reviewing Events
Open WooCommerce > Carding Shield Log to see recent events. The log shows:
- time
- decision
- score
- triggered rules
- truncated IP hash
- truncated email hash
Reviewing Orders
Orders with risk metadata show a Carding Shield Risk panel in the order editor. It includes score, level, decision, and triggered rules.
Privacy Notes
The plugin does not store raw card data. Event records use hashed identifiers for email and request fingerprints. The log is designed for incident review, not permanent customer profiling.
Operational Cautions
- If the site uses Cloudflare, a reverse proxy, or a load balancer, confirm real customer IPs are available to WordPress.
- Start in Monitor mode on busy stores to reduce false-positive risk.
- Do not use the plugin as a replacement for payment gateway fraud tools.
- Do not delete failed orders automatically unless accounting/legal retention requirements are understood.
FAQ
Does this replace CAPTCHA?
No. It protects server-side checkout paths. CAPTCHA can still be useful when correctly validated server-side.
Does it send customer data to WebMe?
No. V1 protection is local-first and does not call an external fraud API.
Can it stop every fraudulent order?
No. It targets checkout abuse and velocity/card-testing patterns. Human fraud and chargeback management remain outside V1 scope.
Why start in Monitor mode?
Monitor mode lets operators see how the rules behave against real store traffic before enabling blocking.