Spam Orders Getting past hooks

  • Resolved AshtonSanders

    (@ashtonsanders)


    2 months, 3 weeks ago

    I have a very odd spam order bot hitting my site once every 45-90 minutes. It looks like they are just testing credit cards, because they all fail.

    They submit their orders with some obvious similarities, so I created a plugin to detect and stop the spam orders.

    I hooked up my plugin to all three of these hooks, and none of them were triggered when the spam orders came through:

    add_action(‘woocommerce_checkout_process’,?‘check_order_conditions’);?
    add_action(‘woocommerce_checkout_order_processed’, ‘check_order_conditions’, 10, 3);
    add_action(‘woocommerce_checkout_order_processed’,?‘check_order_conditions’,?10,?3);

    Any idea how these spam orders could be getting into our system (and attempting to charge a card) without triggering any of these hooks? This looks to me like a back-door access or security breach.

    Thank you for your time.
    Ashton

    The page I need help with: [log in to see the link]

Viewing 14 replies - 1 through 14 (of 14 total)

  • Hi @ashtonsanders,

    Thank you for reaching out.

    I’m sorry to hear you’re facing issues with Spam orders in your store. As a first step, could you please help confirm what payment gateway you’re using in your store?

    This way, we can understand how these spam orders are getting through.

    Thread Starter AshtonSanders

    (@ashtonsanders)

    We are using Credit Card Payments thorough paypal. The plugin is: WooCommerce PayPal Payments Version 2.9.4 | By WooCommerce

    Hi @ashtonsanders,

    We are using Credit Card Payments thorough paypal. The plugin is:?WooCommerce PayPal Payments?Version 2.9.4 | By WooCommerce

    Thanks for confirming this with us.

    As a step to investigate this issue further, are you able to temporarily (during off-peak hours) disable the WooCommerce PayPal Payments and check if the issue persists. You can use an alternate Payment Gateway to accept payments in the interim to check if this issue is related with the mentioned plugin.

    Please let us know how this goes.

    Thread Starter AshtonSanders

    (@ashtonsanders)

    Hmmm. We don’t have another payment gateway available. I can test turning it off very late tonight, but I don’t have a way to tell if the spam submits an order or not (unless an order can be completed with no payment system).

    Hi @ashtonsanders,

    We don’t have another payment gateway available. I can test turning it off very late tonight, but I don’t have a way to tell if the spam submits an order or not (unless an order can be completed with no payment system).

    You can try to install any of the Payment Plugins listed here and test this out during off-peak hours to see if the issue persists.

    Let us know how this goes.

    Thread Starter AshtonSanders

    (@ashtonsanders)

    Just to be Clear: We are using the PayPal Payments gateway from that page. Right? You want me to use a different one?

    I looked through the rest and I couldn’t find one that connects with Paypal.

    Any other ideas? Any other way to debug or test where these are coming from? Any logging I can turn on?

    Plugin Support shahzeen(woo-hc)

    (@shahzeenfarooq)

    Hi there!

    Yes, my colleague was suggesting activating another plugin. However, to address spam orders, I recommend checking the settings of your current plugin to see if there are any options to prevent spam orders.

    Alternatively, you can use the following plugin to help prevent spam orders: WooCommerce Anti-Fraud.

    If you prefer not to use this plugin, you can look for other free plugins that offer spam protection for your site.

    Additionally, you can use a reCAPTCHA plugin to add an extra layer of protection to your store. We recommend?reCaptcha for WooCommerce?from the WooCommerce marketplace. This Recaptcha service protects your store from automated attacks and spam bots.

    I hope this helps,

    Thread Starter AshtonSanders

    (@ashtonsanders)

    Hi. Thanks for following up.

    We have chaecked the current plugin for spam settings.
    We have installed reCaptcha. We have installed hCaptcha. We have installed a couple other spam woocommerce plugins.

    I will try this anti-fraud plugin. I haven’t seen that one.

    I’m pretty sure we tried that recaptcha for WC, but I’ll try it.

    I’m not sure if you saw my comment though. These orders are bypassing the normal checkout process. They are not trigerring any of the actions normally associated with completing orders, so nothing has helped.



    Thread Starter AshtonSanders

    (@ashtonsanders)

    Wow. I just saw that the WooCommerce PayPal plugin we’re using has 60%+ 1-star reviews… We’ll switch asap.

    Plugin Support Zubair Zahid (woo-hc)

    (@doublezed2)

    Hello AshtonSanders,

    Thank you for your reply.

    Please let me know if switching the PayPal plugin resolves the issue for you.

    Fee free to contact us again if you have more questions or concerns.
    We are here to help ??

    Best regards.

    Thread Starter AshtonSanders

    (@ashtonsanders)

    Yes, I switched to “PayPal Gateway By Payment Plugins” and the spam orders stopped working.

    It is a much-worse user experience (the CC processing is not on our website, so clients are getting confused), so I really would prefer to use this plugin.

    Any chance you can figure out how to prevent this?

    Thanks
    Ashton

    Plugin Support shahzeen(woo-hc)

    (@shahzeenfarooq)

    Hi there!

    Sorry for the trouble. I can understand your frustration.Card testing is on the rise globally, especially during the holiday season. Our team is currently working on some solutions to help reduce the disruption it may cause. And we also recommend reviewing the steps in?our doc on how to respond to card testing.

    Thank you for your patience and cooperation.

    Thread Starter AshtonSanders

    (@ashtonsanders)

    May, I would really love for this PayPal Plugin to work again. Is this something I should post in that plugins’ support forum?

    Plugin Support Mahfuzur Rahman(woo-hc)

    (@mahfuzurwp)

    Hi @ashtonsanders,

    Yes, posting your issue in the plugin’s support forum is the best step forward. This will allow the team to track and address the issue more effectively. You can create a new thread here:

    https://www.ads-software.com/support/plugin/woocommerce-paypal-payments/.

    As this issue isn’t related to WooCommerce core, I’ll go ahead and mark this thread as resolved. Let us know if there’s anything else we can assist you with!

Viewing 14 replies - 1 through 14 (of 14 total)
  • You must be logged in to reply to this topic.