WooCommerce runs card-testing attacks, price scraping and fake account signups straight through the same checkout your customers use. ZeroBot identifies the traffic before WordPress has to process it.
A WooCommerce store is unusually exposed because the checkout, the customer account area and the product catalogue are all public endpoints that must accept input. Security plugins inspect this traffic from inside PHP, which means the request has already booted WordPress, queried the database and rendered a page before anything is decided. ZeroBot runs as a plugin that screens the request first, and it owns the full detection pipeline — fingerprinting, IP and ASN reputation, datacenter and proxy detection — rather than relying on a signature list.
mu-plugins/zerobot-guard.php
Full endpoint reference and an interactive tester are in the API docs. Get a key from the free tier — no card required.
Stolen card numbers are validated against your checkout with small or zero-value orders. The tell is a burst of failed payment attempts from rotating IPs — and every attempt can carry a payment-gateway penalty fee.
Competitors and repricing tools walk your catalogue continuously. It shows up as enormous pageview volume with no add-to-cart and no session depth.
Bulk registrations used for coupon abuse, review spam or credential-stuffing practice. Your store absorbs the database growth and the support load.
No, and you should keep one. Security plugins handle malware scanning and file integrity; ZeroBot handles automated traffic. They are complementary layers, not alternatives.
Detection happens before WordPress boots, so blocked traffic never reaches PHP. For allowed visitors the median verdict is under 50ms, and ZeroBot fails open by default so a ZeroBot outage never takes your store down.
That is the failure mode that matters most. ZeroBot treats a VPN as a signal rather than a verdict, and the composite score means a residential VPN user with normal browsing behaviour is not blocked. Every block is logged with its reason so you can whitelist and adjust.
Free tier, real verdicts, and documentation with a built-in tester.
Get started free →