內容簡介
KossLabs Anti-Carding & Bot Shield 外掛專為線上商家設計，防止信用卡測試詐騙攻擊。它能在交易過程中攔截自動化機器人提交的詐騙請求，保護商家的支付平台，降低因詐騙而產生的費用與風險。
【主要功能】
• 四層防禦架構，無需自訂資料庫
• 隱形蜜罐陷阱，攔截自動化機器人
• 加密時間戳令牌，阻擋快速提交的腳本
• Cloudflare Turnstile，無縫的隱私友好挑戰
• 瞬時 IP 限制，嚴格控制每個 IP 的嘗試次數
• 完全兼容 Classic Checkout 和 WooCommerce Blocks Store API
外掛標籤
開發者團隊
② 後台搜尋「KossLabs Anti-Carding & Bot Shield」→ 直接安裝（推薦）
原文外掛簡介
KossLabs Anti-Carding & Bot Shield protects online merchants from card testing fraud (carding attacks) by intercepting automated bot submissions before they reach payment gateways such as Stripe, PayPal, Square, or local payment providers.
When carding fraudsters target a WooCommerce store, they automate thousands of micro-authorization attempts using stolen credit card dumps. Even when transactions fail, merchants incur expensive authorization fees ($0.15 – $0.50 per attempt) and risk payment account suspension.
This plugin delivers a 4-layer zero-bloat defense that halts card testing attacks at the gateway threshold without adding custom database tables:
Layer 1: Invisible Honeypot Trap: Traps naive automated bots that blindly fill all form inputs.
Layer 2: Cryptographic Timestamp Token: Blocks headless scripts that submit forms faster than humanly possible (< 1.5 seconds) using HMAC-signed tokens.
Layer 3: Cloudflare Turnstile (Bring Your Own Key – BYOK): Frictionless, privacy-friendly bot challenge. Store owners use their own free Cloudflare credentials—no third-party proxy or developer API quota shared.
Layer 4: Transient IP Rate Limiter: Enforces strict attempt thresholds per IP (e.g., 3 failed attempts in 10 minutes) stored entirely in RAM (Transients API / Redis / Memcached).
Dual-Shield Architecture: Full compatibility with Classic Checkout and modern WooCommerce Blocks Store API (/wp-json/wc/store/v1/checkout).
Privacy Policy & External Services
This plugin integrates with Cloudflare Turnstile to protect your checkout against card testing and automated bot abuse.
Service: Cloudflare Turnstile
Provider: Cloudflare, Inc.
Service Description: Frictionless, privacy-preserving bot detection challenge.
Terms of Service: https://www.cloudflare.com/website-terms/
Privacy Policy: https://www.cloudflare.com/privacypolicy/
Data Transmitted: During checkout, the customer’s IP address and Turnstile response token are transmitted to Cloudflare’s validation endpoint (https://challenges.cloudflare.com/turnstile/v0/siteverify) to verify whether the submission is from a legitimate human. Store owners use their own Cloudflare account credentials (BYOK).
