Blocking Malicious /cart?remove_item= Requests

Hi there

Thank you for sharing these details it sounds like your site is experiencing automated bot attacks targeting the /cart?remove_item= endpoint. This is a known type of behavior where bots attempt to manipulate cart sessions, often looking for vulnerabilities, but it is not a vulnerability in WooCommerce itself.

1. WooCommerce Validation
   • WooCommerce already performs server-side validation for cart actions, including remove_item.
   • Requests without a valid cart session (woocommerce_cart_hash cookie) are ignored and will not modify your cart.
2. Securing /cart?remove_item= requests
   • Ensure your site is using the latest WooCommerce version. Security patches and nonce checks are built in for cart actions.
   • Use security/firewall plugins (e.g., Wordfence, Sucuri) or server-level firewall rules to block suspicious IP ranges, particularly from datacenter or cloud provider IPs.
   • Consider limiting access to /wp-admin/admin-ajax.php if possible, since AJAX requests are the usual attack vector.
3. Distinguishing legitimate vs. bot requests
   • Legitimate AJAX cart requests include cookies like woocommerce_cart_hash and wp_woocommerce_session_….
   • Requests without these cookies, coming in large numbers from datacenter IPs, are almost always bots.
4. Additional measures
   • Enable reCAPTCHA on checkout/login forms.
   • Monitor server logs to identify IPs generating repeated malicious requests and block them.
   • Use caching or rate-limiting plugins to reduce CPU load from repeated attacks

I hope this helps.

Hi there!

Thank you for the clarification.

Since these requests are coming from a large and variable range of data center IPs, it can be difficult to block them effectively at the application level. A more reliable approach is to implement server-level or hosting/CDN protections.

We recommend reaching out to your hosting provider to see if they can help you:

• Block or challenge bot traffic targeting /cart?remove_item=
• Apply rate-limiting for cookieless requests

Alternatively, I recommend you take a look at this guide and take steps to try to block bots by editing .htaccess file instead: https://www.seoblog.com/block-bots-spiders-htaccess/.

I hope this helps.