# Rate Limit the Store API Against Card Testing

> Turns on WooCommerce's built-in rate limiting for the Store API used by the block cart and checkout, slowing down bots that test stolen cards.

- Type: PHP
- Runs: Run everywhere
- Category: [WooCommerce](https://wpide.com/library/category/woocommerce/)
- Requires: WooCommerce
- Tags: woocommerce, security, checkout, fraud
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/woo-store-api-rate-limit/

## Code

```php
add_filter( 'woocommerce_store_api_rate_limit_options', function ( $options ) {
    return array_merge( (array) $options, array(
        'enabled'       => true,
        'proxy_support' => false, // True behind Cloudflare or a load balancer.
        'limit'         => 25,    // Requests allowed...
        'seconds'       => 10,    // ...per this many seconds.
    ) );
} );
```

## Notes

Allows 25 requests per 10 seconds per visitor; set 'proxy_support' to true only behind a proxy or CDN that passes the visitor IP.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Rate Limit the Store API Against Card Testing" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/