How to protect the “Order Pay” endpoint with Simple Cloudflare Turnstile

  • Resolved albyone

    (@albyone)


    1 year, 11 months ago

    Hello,

    I have a problem where my site is being abused by card testing crooks. Presently the card merchant has disabled their integration until I get this resolved.

    So, I gave your plug-in a whirl and can see that it does indeed protect the standard checkout endpoint URL, however, I believe the endpoint URL that is being used by the card testers is the order-pay URL “https://example.com/checkout/order-pay/1234/?pay_for_order=true&key=wc_order_ABCDefgh1234”

    This URL presents with no protection.

    Would protection for this endpoint URL be possible with your plugin?

    Thanks,
    Al

Viewing 6 replies - 1 through 6 (of 6 total)
  • Thread Starter albyone

    (@albyone)

    I have found a post for your re-captcha plugin (here – “https://www.ads-software.com/support/topic/woocommerce-credit-card-failed-order-checkout-attack/”) that suggests it did have an option for this, but I couldn’t find that option on the re-captcha version of your plugin or this Turnstile plugin.

    Thanks again.

    Thread Starter albyone

    (@albyone)

    Sorry, the correct link to the other post is:
    https://www.ads-software.com/support/topic/woocommerce-credit-card-failed-order-checkout-attack/

    Al

    Plugin Author Elliot Sowersby

    (@elliotvs)

    Hi,

    Thanks for the info, I will take a look into this!

    Thread Starter albyone

    (@albyone)

    Thanks Elliot.

    Some further info on my specific case.

    After looking at the SSL access logs, the card testing attack is using calls to /?wc-ajax=checkout. So, from how I understand it, a human sets up the order all the way through to checkout by filling all order details and placing an order (that fails with card declined) but, the CAPTCHA passes. From there they start a script on the /checkout page that continuously tries credit card numbers using /?wc-ajax=checkout. These subsequent attempts are not intercepted by CAPTCHA.

    I have installed a plugin called bh-wc-checkout-rate-limiter that looks like it, along with your Simple CloudFlare Turnstile plugin will hopefully limit the attack.

    I do still believe that the original issue of the order-pay URL not being protected stands, however, unless your plugin can also protect /?wc-ajax=checkout, both checkout endpoints are susceptible to the style of attack that I’m seeing.

    Thanks again. Your plugin and the time you spend on maintaining it are very much appreciated.

    Al

    Plugin Author Elliot Sowersby

    (@elliotvs)

    Hi,

    Just to let you know this will hopefully be fixed in the next plugin update (1.17.0) with an option to enable Turnstile on the “Pay for Order” page/form.

    Plugin Author Elliot Sowersby

    (@elliotvs)

    Hi,

    Please could you try updating to the latest version (1.17.0). There should now be an option to enable Turnstile on the “Pay for Order” page/form.

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘How to protect the “Order Pay” endpoint with Simple Cloudflare Turnstile’ is closed to new replies.