There are three certainties in life: taxes, the passing of time, and if you’re a WooCommerce store owner, spam orders.
Spam is an everyday occurrence for website owners and it’s something we’re all going to have to learn to deal with while running an online store.
Luckily for us, WooCommerce spam prevention doesn’t have to be complicated. By taking just a few simple steps, you can significantly reduce the number of fake orders and other forms of spam you have to deal with.
Stay tuned as we explore some of the best security measures to protect your e-commerce store from pesky online spam.
Contents
What’s a spam order?
Spam orders are fake orders, often (but not always) with no intent to actually purchase anything. They are often placed by automated spam bots, allowing bad actors to place a large number of fake orders quickly.
By placing a large number of fake orders, attackers can flood a WooCommerce site’s system, causing the website to crash, become very slow, or prevent real orders from being submitted successfully. Attackers can also use it to test for certain bugs or check the validity of stolen credit cards.
How to spot spam orders
There are many red flags that can indicate a spam order, many of which are very easy to spot. Some of these include:
- An exceptionally high number of orders in a short period of time.
- Many different orders from the same IP address.
- Very similar orders using different contact details.
- Orders clearly using fake emails, address details, payment information or other details.
- Orders being flagged as potentially fraudulent by your payment provider.
Preventing fake orders in WooComerce using CAPTCHA
When trying to protect your WooCommerce store from spammers, CAPTCHA is your best friend. CAPTCHA stands for “Completely Automated Public Turing test to tell Computers and Humans Apart” and does exactly what it says on the tin – it tells humans and bots apart. This allows you to block (most) bots while still allowing real users to place an order, drastically reducing the number of spam orders you receive.
The benefits of CAPTCHA
CAPTCHA forces users to verify they are indeed real visitors and not automated bots, allowing you to block bots from taking any further action on your website. Some of the main benefits of CAPTCHA include:
- It blocks most automated bots, including many advanced bots, significantly reducing the number of spam form submissions and orders.
- It’s very easy to implement in WooCommerce using a WordPress plugin.
- It offers a great user experience: Buyers simply check a button, after which they can proceed with the rest of the buyers’ journey. This means it has very little impact on your conversion rates or other website performance metrics.
Different types of CAPTCHA
There are a few different types of CAPTCHA, each of which has its own advantages and disadvantages.Traditional CAPTCHAs
Traditional CAPTCHAs generate a string of words, numbers and/or images. The user then types these into a field in order to prove they’re a real user. There are a number of downsides to this method though, including the fact that bots can be adapted to complete many of these challenges. Also, the more difficult the challenge is, the more of a negative impact it has on the user experience.
Example of traditional CAPTCHA.
reCAPTCHA
ReCAPTCHA is a service offered by Google, that solves many of the issues associated with traditional CAPTCHA. It offers a standardized solution and a far superior user experience than traditional CAPTCHA. If you’ve ever seen those check boxes asking you to verify that you’re not a robot, you’ve likely used reCAPTCHA before.
Example of Google reCAPTCHA
ReCAPTCHA version 1 was the very first version of reCAPTCHA and worked in much the same way as traditional CAPTCHA. However, this version has been retired as of 2018. Version 2 and 3 are the two versions used currently.
- ReCAPTCHA version 2
ReCAPTCHA v 2 is the most common reCAPTCHA solution used today. It offers a no CAPTCHA reCAPTCHA solution that works by asking a user to check the “I’m not a robot” checkbox. Then, depending on the user’s behavior and the estimated level of risk, the user is either allowed to continue or they are asked to solve a challenge to prove they’re a real user.
By only showing the challenge to a select group of users with a higher risk profile, its impact on conversion rates is small. By always showing similar challenges that most people have seen and completed before, it also offers a far superior user experience than traditional CAPTCHA.
ReCAPTCHA v 2 can also be made invisible, meaning the user doesn’t have to check the checkbox themselves. This allows the main submit button on the form to initiate the process automatically, reducing the amount of friction even further. If there’s reason to suspect the user might be a bot, they will be prompted to complete a challenge automatically.
- ReCAPTCHA version 3
Version 3 is the newest version of reCAPTCHA and works without a checkbox. It calls an API which returns a score estimating how likely it is that the user is a bot based on their previous actions on the site. It only shows a challenge if there is a high likelihood that the user is a bot.
hCAPTCHA
HCAPTCHA is an alternative to reCAPTCHA that collects less user data than Google’s reCAPTCHA and offers slightly harder challenges. There are many similarities between the two, including the need to solve challenges and the fact they’re both free for non-enterprise users. HCAPTCHA is generally considered more secure, blocking more bots and more advanced bots than reCAPTCHA, but also more challenging for users to complete, potentially affecting a store’s user metrics.
Other CAPTCHA solutions
ReCAPTCHA and hCAPTCHA are the two most commonly used CAPTCHA solutions, but there are many alternatives available too. Some of these include CloudFlare Turnsite, DataDome, Friendly Captcha and CaptchaFox. Which one you choose will depend on your individual situation. That being said, reCAPTCHA is generally a good option for most WooCommerce stores.
How to implement CAPTCHA on your WooCommerce store
There are many different ways to implement CAPTCHA in WooCommerce, but the easiest way is to use an anti-spam plugin.
CAPTCHA 4WP is a great option that offers many customization options and one-click WooCommerce integration. It’s the only plugin that allows you to add CAPTCHAs from multiple different providers to your e-commerce store, including reCAPTCHA as well as some privacy-focused providers like hCAPTCHA and Cloudflare Turnstile. This allows you to choose the provider that’s right for you, ensuring you comply with important national and regional privacy laws and regulations, like the GDPR. It also has a reCAPTCHA v3 failover to effectively deal with false positives.
Best of all – it only takes a few clicks to get up and running!
Head over to the CAPTCHA 4WP homepage and click on “Get CAPTCHA 4WP” to get started.
Next, you can select the package you want to go for.
Screenshot of pricing page on the CAPTCHA 4WP homepage, detailing the pricing starting at $14 per year.
All packages come with a 30-day money-back guarantee so you can try it out risk-free.
After signing up, you’ll receive an email with the installation details and instructions on how to download the plugin files.
Example of the email you’ll receive from Melapress, with instructions on how to install the CAPTCHA 4WP plugin.
Screenshot of the WordPress dashboard showing how to upload a plugin.
Once you’ve downloaded the plugin, head over to the plugins page in your WordPress dashboard.
After uploading and activating the plugin, you can configure it to use the type of CAPTCHA you’d like.
Screenshot of the CAPTCHA 4WP configuration screen with reCAPTCHA v2 selected.
For this example, I’ll choose reCAPTCHA v2.
On the next screen, you need to add your site key. You can generate this key by following the instructions in this guide on how to get Google reCAPTCHA keys.
Screenshot of a new site registration for Google reCAPTCHA.
After submitting the form, you’ll then be shown a screen with both a site key and a secret key. These need to be added to the CAPTCHA 4WP plugin in order to start implementing reCAPTCHA on your site.
First, add your site key and complete the reCAPTCHA.
Screenshot showing where to add the site key in the CAPTCHA 4WP configuration.
Then, add your secret key and click on “Validate & proceed”.
A screenshot showing where to add the secret key in the CAPTCHA 4WP configuration.
You’ll then be redirected to the CAPTCHA 4WP dashboard.
Fantastic!
You’re all set to add your newly-created reCAPTCHA solution to your store.
To do this, navigate to “Settings & Placements” and then select the types of pages you’d like to display the reCAPTCHA on.
Screenshot of the CAPTCHA 4WP dashboard in WordPress, showing where to select the WooCommerce pages to display a CAPTCHA on.
The selected pages should now use the chosen reCAPTCHA solution and protect you from most types of spam.
Other steps you can take to reduce spam WooCommerce orders
When it comes to spam protection, CAPTCHA tends to be the most effective solution with the least impact on a site’s usability. However, there are many other security controls you can implement to reduce the number of spam form submissions and fake orders.
It can even be worth layering them for the best results.
Many of these play a broader role in WordPress security and are therefore definitely worth considering. We’ll cover some of them below.
Limit countries
Another practical way to reduce the number of spam orders you get is to limit the countries from which you accept orders.
It’s important to mention that this method is only feasible for stores that sell to specific countries and/or regions. If you regularly get orders from countries all around the world, this one’s not for you.
Restricting the countries you sell to prevents spammers and bots from those countries from placing orders, potentially helping to reduce the number of spam orders/submissions.
This isn’t nearly as effective as reCAPTCHA and shouldn’t be used as a standalone solution, but they work great together.
It’s also really easy to set up.
First, navigate to general settings in WooCommerce (WooCommerce > Settings > General).
A screenshot showing the general settings in WooCommerce.
In the dropdown labelled “Selling location(s)” you can choose to either sell to all countries, exclude certain countries, or sell to specific countries.
A screenshot showing the selling locations dropdown.
In the example above, I chose to only sell to specific countries and then add the United Kingdom in the field below. You can configure this to match the countries you sell to.
Bear in mind that even though this will prevent spam orders from those countries, it will also prevent real orders. So be careful which countries you exclude here!
Require an account before ordering
To prevent spam orders, you can also choose to force your users to create an account before ordering. This forces website visitors to take multiple steps, including submitting the registration details, verifying their email address and subsequently logging in. This makes it far more difficult for automated bots to create spam orders.
It’s important to consider that this does add some friction to the ordering process, which may reduce your conversion rates – especially when it comes to impulse buys.
If you’re facing a major spam problem then this can still be a good option. However, if you’re already using a CAPTCHA solution, perhaps combined with some of the other security controls we’ve covered, requiring an account may not be necessary.
Even so, I’ll quickly show you how to do it since it’s very easy to set up.
Simply navigate to the WooCommerce settings and click on the “Accounts & Privacy” tab (WooCommerce > Settings > Accounts & Privacy).
Screenshot showing the accounts & privacy tab in WooCommerce, with the guest checkout and account creation sections labelled.
You can then uncheck the box labelled “Allow customers to place orders without an account” and check the boxes labelled “Allow customers to log into an existing account during checkout” and “Allow customers to create an account during checkout”.
It’s that easy!
WordPress firewall
A firewall can help detect and block malicious traffic before it can cause issues. It can also reduce the number of bots visiting other pages of your website and can help protect you against various other cyber security threats too.
The easiest way of implementing a firewall on your WooCommerce store is by using a plugin.
There are countless different WordPress firewall plugins to choose from and it’s important to pick the right one for your use case. Since this is a relatively large topic, I won’t go into this here. Instead, I’ll refer you to this guide on firewalls in WordPress.
FAQs
How do I stop fake accounts in WooCommerce?
The steps outlined in this post can also help you prevent spam registrations and fake accounts. By implementing a CATPCHA solution in your WooCommerce registration forms, you can prevent most bots from automatically creating accounts. A good anti-spam plugin can help you achieve this.
How do I stop fake orders in WooCommerce?
CAPTCHA remains one of the most effective and least intrusive ways of protecting your store from fake orders. By only asking suspicious users to verify they’re a real person and not a bot, it has minimal impact on a store’s conversion rates while still offering a good level of spam protection.
How can I prevent spam comments in WooCommerce?
CAPTCHA is a great tool to stop spam comments on your WordPress site, although there are other ways to protect your site from bots too. By forcing suspicious traffic to verify they’re not a robot, you can block most automated forms of spam form submissions, drastically reducing the number of spam comments on your site.
Is CAPTCHA enough to prevent WooCommerce spam?
Although implementing a CAPTCHA solution is one of the most effective and practical ways to prevent spam e-commerce orders, it won’t stop 100% of the fake orders you get. Fake orders can also be placed by real people who can bypass the checks implemented by hCAPTCHA or reCAPTCHA. It’s important to remain vigilant when running an online store and to combine various security measures, including a firewall, strong payment security (stripe 3D secure, for example), and various other measures.
