January 20, 2025
Table of Contents As the new year kicks off, it's the perfect time to take stock of your website and ensure it's up to...
September 7, 2026
TL;DR
- There are a lot more bots hitting websites than there used to be, and AI is only adding to the traffic.
- Some bots try to overwhelm websites and knock them offline, while others use online stores to test stolen credit card numbers.
- Being targeted by these attacks does not mean your website was hacked or your data was stolen.
- We're actively monitoring and blocking this traffic before it can cause problems whenever possible.
- If you see a slowdown, checkout issues, or a "verify you're human" screen, don't panic. There's a good chance the protection systems are simply doing their job.
At B&B Media, I'm in and out of WordPress websites all day long, and lately I've been noticing more mischief than usual out there. Since I'm always keeping an eye on things for my clients, I wanted to pass along something I've been seeing more and more: denial of service attacks and credit card testing attacks.
Consider this an FYI. Not a scare tactic, not a sales pitch, just me letting you know what it is, why it's happening, and why it's not something you need to lose sleep over.
These attacks aren't happening because anyone did anything wrong. AI is making bots cheaper and smarter to run, so there's just more automated traffic hitting every website these days, good and bad. And that automated bot traffic is now landing on small business sites that never used to be worth targeting, including plenty of the ones we build and host right here at home in Cape Girardeau, Jackson, and the Southeast Missouri region.
If your site has gone down recently, even for just a few minutes, slowed to a crawl, or acted strange for no clear reason, this post is for you.
What's Actually Happening: DDoS Attacks Explained
A denial of service attack, or DoS attack, is exactly what it sounds like. It's an attempt to deny people access to your website by overwhelming it with traffic or requests until it can't keep up.
When that traffic comes from a bunch of different sources at once, usually a network of compromised devices, it's called a distributed denial of service attack, or DDoS attack. That's the version most small business sites tend to get hit by.
Picture a single cashier trying to check out an entire stadium of shoppers who all showed up at the same register in the same ten minutes. The line backs up out the door, and real customers give up and leave. That's a denial of service attack in everyday terms.
There isn't one single denial of service attack example that covers every case either, since attackers can target different layers of your site.
There are a few types of DDoS attacks worth knowing about, since they don't all look the same from the outside.
- Volumetric attacks flood your site with sheer traffic volume. Think of a mailbox buried under a mountain of junk mail until the real letters can't get inside.
- Protocol attacks tie up the technical handshake between your server and visitors. It's a bit like someone repeatedly picking up the phone and hanging up before you can say hello, keeping the line busy so nobody else can call in.
- Application layer attacks mimic real visitor behavior, like a table at a restaurant that never orders and never leaves, just sits there tying up a spot other paying customers could be using. These are the hardest to spot right away because they look like a real, albeit slow, customer.
Whichever type hits, the goal is the same. Knock your site offline, or slow it down so badly that real customers give up and leave.
Credit Card Testing Attacks: The Other Threat Hitting WooCommerce Stores
The second thing I'm seeing lately is card testing attacks, sometimes called credit card testing or card not present fraud.
This one applies specifically to WooCommerce stores and any WordPress site that takes payments online. If your site is more of a brochure or informational site without a checkout, this section won't apply to you the same way the DDoS side does.
Here's how it works. Someone gets their hands on a list of stolen credit card numbers. Instead of trying each one manually, they run the whole list through a checkout page or order form using automated bots to see which cards still work.
It's a bit like a real life credit card thief buying a pack of gum before trying to buy a TV. Whoever's using the stolen card doesn't care about the gum. They just want to know the card still works before trying it somewhere else for something bigger.
In this scenario, your store isn't the target of the fraud itself. It's just being used as a free testing ground for stolen cards, which is exactly what makes card not present transaction fraud so frustrating for small business owners.
You'll usually see a spike in failed transactions, small odd looking orders repeating the same inexpensive item, or a sudden slowdown around checkout. None of that has anything to do with your product catalog or your customers.
This kind of ecommerce fraud prevention has become a bigger part of my job over the last year, and it's not unique to any one store or platform. Shopify, Wix, Squarespace; they're all getting hit by the same type of attacks. In the hands of you and me, AI can be a great tool, but in the hands of bad guys, it's just another, faster way to attempt mischief.
Fraud prevention for ecommerce sites of every size has gotten harder as these bots have gotten more sophisticated. That's exactly why I wanted to give you the heads up now instead of you finding out the hard way.
Why These Attacks Are Increasing: AI Crawlers and Bot Traffic
Here's the part that ties both of these together. A big chunk of all traffic hitting websites today isn't human at all. It's bot traffic: automated programs crawling, scraping, and testing sites nonstop.
Some of it is harmless, like search engines indexing your pages. Some of it is AI crawlers, the newer wave of bots built to feed AI tools and large language models with fresh content from across the web. But some of it is straight up malicious, built to find weak points or run stolen card numbers.
What is bot traffic, in plain terms? Any visit to your site that didn't come from a real person clicking around.
Picture your website as a storefront on Main Street. Most of the foot traffic is harmless: window shoppers, people browsing for the perfect gift, and folks just passing by on their way somewhere else. But a few are going around back and rattling every doorknob on the block to see which ones are unlocked. That's bot traffic in a nutshell.
As AI crawlers multiply and get cheaper to run, the overall volume of bot traffic online keeps climbing. A bigger slice of it is aimed at small business sites, WooCommerce stores and plain WordPress sites alike, that never used to be worth an attacker's time.
It's not that WordPress or WooCommerce got less secure. It's that the internet as a whole got a lot noisier.
Part of what we do behind the scenes is bot traffic detection, watching the patterns coming from a given bot traffic host or IP range and telling the difference between a legitimate crawler, a curious customer, and something that needs to be blocked.
We can't stop every bot from showing up. Nobody can.
But we can detect bot traffic early enough to keep it from actually hurting your site or your checkout.
One thing you might start noticing because of this: more of those quick "confirm you're human" screens, like the ones from Cloudflare, popping up before a page loads. That's not a glitch, and it's not us locking anyone out. It's one of the tools sites and hosts everywhere use to sort real visitors from bots, and it's becoming more common across the internet as this kind of traffic increases.
A Site Going Down Doesn't Mean It's Insecure, Hacked, or Breached
This is the single most important thing I want you to take away from this post, so here's the bottom line.
If your site gets hit by a DDoS attack or a wave of card testing, that is not the same thing as your site being hacked or breached.
A denial of service attack is an availability problem, not a break in. Nobody accessed your files, your customer data, or your admin dashboard. The whole point of the attack is to bog your server down or knock the site offline from the outside, not to get inside it.
Credit card testing works the same way. Attackers aren't breaking into your store to steal information. They're using your checkout page from the outside to test cards they already have from somewhere else entirely, usually a data breach that has nothing to do with you or your website.
That distinction matters because it changes what actually needs to happen next. We don't need to assume your site was compromised, reset every password, or treat it like a security failure.
What we do need to do is protect your website from a DDoS attack the way we'd protect against bad weather. Not because something is broken, but because it's part of running a site on the modern internet. Good DDoS protection is about absorbing and filtering that traffic before it ever reaches your server, not about patching a hole that let someone in.
What We're Doing (and What You Can Do)
On our end, every site we host gets layered protection built in. We keep an eye on ddos protection solutions and anti DDoS protection tools that make sense for a small business budget, not just enterprise level services built for banks. That includes network level DDoS protection at the hosting layer, rate limiting on checkout and login pages to slow down card testing bots, and monitoring so we catch a spike before it turns into real downtime.
Part of that protection is services like Cloudflare, which is why you or your visitors might occasionally see a quick "checking your browser" or "verify you're human" screen before a page loads. That's the system doing its job, filtering out bad traffic before it ever reaches the site, not a sign of a problem.
If you're a client and you ever see your site slow down, throw checkout errors, or go down entirely, reach out to us right away.
Don't assume the worst, and don't try to troubleshoot it as if something was stolen or exposed. Let us look at the traffic first. Most of the time, it's exactly what we've described here: an attack aimed at availability or at testing stolen cards, not a break in.
If you have questions about any of this, or you want to talk through what we're doing on your specific site, just reach out. That's what we're here for.
Austin Bollinger
Founder and Lead Developer
Frequently Asked Questions
What is a denial of service attack?
A denial of service attack is an attempt to make a website unavailable by overwhelming it with more traffic or requests than it can handle. When that traffic comes from a bunch of sources at once, it's called a distributed denial of service attack. The goal is to knock the site offline or slow it down, not to access anything inside it.
What is credit card testing (card not present fraud)?
Credit card testing, also called card not present fraud, is when someone runs a list of stolen credit card numbers through an online checkout page using automated bots to see which cards are still active. The store's checkout is used as a testing tool. The fraud itself happened somewhere else, usually a data breach unrelated to the store being tested.
How do I know if my site is under attack?
The most common signs are a sudden slowdown, the site becoming unreachable, a spike in failed or unusually small orders, or checkout acting strange with no clear cause. If you notice any of that, don't guess. Reach out to us and we'll check the traffic and server logs directly.
Does a DDoS attack or card testing attack mean my site was hacked or breached?
No. Both of these attacks happen from the outside and target your site's availability or its checkout process, not its data. Nobody gains access to your files, your database, or your customer information through a DDoS attack or a card testing run. Being targeted is not the same thing as being hacked, and it doesn't mean your site is insecure.
Why am I seeing more "verify you're human" screens lately?
As bot traffic and these kinds of attacks increase, more sites rely on quick verification screens, like the ones from Cloudflare, to separate real visitors from bots before a page loads. If you or your customers run into one occasionally, that's protection working as intended, not a sign that something is wrong with the site.
Related Posts
July 17, 2024
Table of Contents Website maintenance is crucial for ensuring your WordPress site remains secure, performs well, and continues to meet your business goals. In...
