by PinMaster 1 (0 reviews)

Carthound – Stop Card Testing & Fake Orders

Name: Carthound – Stop Card Testing & Fake Orders
Author: PinMaster

Stops bots testing stolen cards at your WooCommerce checkout: limits on declined cards and tries, bot checks with no captcha, and an attack mode.

Carthound ranks #62,070 among WordPress.org plugins with 1+ active installations, is #7,243 of 14,124 in the E-commerce category, a 1/5 rating from 0 reviews, and was last updated Oct 24, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v1.0.1 Current Version v1.0.1

Updated 1 week ago Last Update on 24 Oct, 2026

Refreshed 1 week ago Last Refreshed on

#7,243 of 14,124 in E-commerce Downloads -26.4% this week Actively maintained

View on WordPress.org

Rank

#62,070

— No change

Active Installs

— No change

KW Avg Position

79.7

0.4 worse

Downloads

121

+7 today

Support Resolved

— No change

Rating

20%

Review 1 out of 5

1 (0 reviews)

Next Milestone 10

Total Progress 20%

0+ 10+

49,133

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 8 more installs to reach 10+

Rank Changes

Current #62,070

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

1.0

0 reviews

Overall 20%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.0.1
Last Updated: Oct 24, 2026
Requires WP: 6.9+
Tested Up To: 7.1
PHP Version: 7.4 or higher
Author: PinMaster

Support & Rating

Rating: ★ ☆ ☆ ☆ ☆ 1
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

card-testing carding fake orders fraud prevention woocommerce

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)

Google for WooCommerce

800K+ installs

#74

WooPayments: Integrated WooCommerce Payments

800K+ installs

#76

WooCommerce PayPal Payments

800K+ installs

#82

WooCommerce Stripe Payment Gateway

700K+ installs

#85

WooCommerce Tax (formerly WooCommerce Shipping & Tax)

500K+ installs

#115

View all Ecommerce plugins

Frequently Asked Questions

Common questions about Carthound – Stop Card Testing & Fake Orders

Carthound is built so that a real customer is not the price of stopping a bot. A returning customer (logged in, with a paid order at least 7 days old that was never refunded) is judged by their own tries only. Outside attack mode, a missing pass, a form sent too fast or a filled hidden field only add to a try's score. The settings start cautious, every refusal is in the log with its reason in plain words, and "Let this customer through" undoes it in one tap. A refused shopper sees a calm message with your shop's e-mail address.

Yes. Behind Cloudflare or Fastly, Carthound reads the visitor's address from the CDN's own header, but only when the request really comes from that CDN's published addresses (the lists ship inside the plugin and are never fetched). Behind your own load balancer, add its address in Settings and Carthound reads the visitor's address it passes on. Until then, the limits per address only write to the log, so real shoppers who share an address are never refused together.

Any payment method that runs through WooCommerce's checkout: the checkout, pay for order and Add payment method are guarded on the server whatever the method, and a declined payment is counted whenever the method tells WooCommerce the payment failed. The card fields' own doors of WooCommerce Stripe Payment Gateway, WooPayments, WooCommerce PayPal Payments and WooCommerce Square are guarded too, each read by name from that plugin's code, and each refusal answers in that plugin's own shape so the checkout never keeps spinning. Every release is tested with each of them installed beside it. Their Apple Pay, Google Pay and PayPal buttons pay through the same guarded doors.

They judge each payment once it reaches them. Carthound refuses the tries before they reach your payment company, guards doors it does not see, and cleans up the junk orders and e-mails an attack leaves on your shop. The two work together.

Yes — a small script (under 2 KB) from your own site, with nothing loaded from another site. It asks your own site for a pass and never reads the card fields, which stay in your payment plugin's own frame. It runs only on the checkout, pay for order and Add payment method pages, and on the cart and product pages when your payment plugin shows express buttons there. A checkout that arrives without the pass only adds to its score, except during attack mode, when it is refused and the shopper is asked to refresh the page — and never while real orders from an app or a custom checkout are arriving without one.

Yes. Each shopper's browser asks for a pass of its own, and the pass is never stored in a page, so a saved copy of a page never carries one. Every release is tested with WP Super Cache, W3 Total Cache, WP Fastest Cache and Cache Enabler switched on, and with a Redis object cache.

No. Everything Carthound keeps stays in your own site's database.

No. Your shoppers never see a puzzle.

The order goes through as if Carthound were not there, and the log says so. If its script cannot load or its table cannot be written, your checkout works as before.

Press Test my shield on the Shield tab. In about 10 seconds you see the practice tries and the one Carthound refuses, with the reason. No order is made and nothing is charged.