Failed Orders

Hello @willf

I suggested reaching out to us directly. Once you open a ticket with our service desk, we can provide the solution we already have for this type of activity.

Here’s how you can request support: Request Support. Please include the URL of this thread in your ticket for reference so we have the full context. Thank you in advance.

Tried installing reCaptcha but it doesn’t stop them so it looks like they have found a backdoor in

There is no ‘backdoor’ happening here. The failed orders are the result of direct calls to the standard order creation API. This API is being triggered by bots using stolen card details to mimic the behavior of real orders. There’s no vulnerable or modifiable part in this logic on the client side; the actual processing logic is handled far beyond anything exposed via JavaScript or the browser.

Failed orders may still appear when automated traffic interacts with the payment flow. These requests typically hit the endpoint used to create orders, but because ACDC (hosted fields) are not enabled, the logic fails early and returns an error along with the failed order.

Kind Regards,
Krystian

Hello @willf

You can safely ignore the notification about the ticket being closed. It’s an automatic Jira process, and the case can be reopened at any time if needed. You can reopen it just by responding to it.

We’ll have a test package available on Monday that includes improved fraud prevention logic. It introduces an additional layer that filters out automated card testing attempts before they reach the checkout process, preventing unnecessary failed orders altogether.

In the meantime, to avoid bounced email issues, you can disable notifications for failed orders under WooCommerce → Settings → Emails → Failed Order. This will stop WooCommerce from sending messages generated by failed bot orders.

We’ll contact you on Monday once the test package is ready so you can verify it on your site before re-enabling PayPal.

Kind Regards,
Krystian