Rate Limit the Store API Against Card Testing
Turns on WooCommerce's built-in rate limiting for the Store API used by the block cart and checkout, slowing down bots that test stolen cards.
Opens WPIDE on
Code
add_filter( 'woocommerce_store_api_rate_limit_options', function ( $options ) {
return array_merge( (array) $options, array(
'enabled' => true,
'proxy_support' => false, // True behind Cloudflare or a load balancer.
'limit' => 25, // Requests allowed...
'seconds' => 10, // ...per this many seconds.
) );
} );Notes
Allows 25 requests per 10 seconds per visitor; set 'proxy_support' to true only behind a proxy or CDN that passes the visitor IP.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.