Ask a store owner about security and they picture a defaced homepage. But the attacks that actually drain WooCommerce revenue are quieter, ongoing and often invisible until the invoice arrives. Here are the three we see most.
Card testing: paying gateway fees for criminals
Fraudsters validate stolen card numbers by running small purchases through your checkout. You pay a gateway fee for every attempt — successful or declined — and enough declines can get your merchant account suspended. Defence: velocity limits per IP and per session, checkout CAPTCHAs triggered only under attack conditions, and blocking requests to the payment endpoint that skip the normal cart flow.
Credential stuffing against customer accounts
Password dumps from other breaches are replayed against your login. Stored cards and loyalty balances make customer accounts valuable. Defence: rate limiting on login endpoints, breach-password checking at registration, and optional 2FA — mandatory for accounts with stored payment methods.
Inventory and price scraping
Competitors and resellers hammer product endpoints thousands of times per hour, degrading performance for real shoppers and undermining your pricing strategy. Defence: bot detection on catalogue endpoints and rate limits on the store API.
The pattern
Each of these attacks exploits normal store functionality rather than a software vulnerability — which is why generic security plugins miss them. Store security has to understand commerce.