Stop Bots.
Keep Customers.
Enterprise-grade bot protection for WordPress and WooCommerce. Block carding attacks, spam bots, and credential stuffing, without CAPTCHAs. Googlebot and SEO crawlers stay protected.
Open the WordPress installer
Enter your WordPress site URL. We’ll open its plugin search with WebDecoy ready to find.
WordPress may ask you to sign in. Then choose Install Now and Activate.
Prefer a manual install? View WebDecoy on WordPress.org.
186
Known Agents Recognized
2 min
Install Time
0
CAPTCHAs Required
$0
To Start
Stop Carding Attacks Before They Cost You
Fraudsters test stolen credit cards on WooCommerce stores. Every declined transaction costs you fees, chargebacks, and payment processor trust. WebDecoy flags them at checkout, and can block them once you turn on enforcement.
- Card Testing Detection
Identifies patterns: multiple small transactions, rapid attempts, different cards from same IP
- Checkout Velocity Limiting
Configurable checkout attempts per address per time window, to slow bulk card validation from a single IP
- Monitor First, Then Block
The plugin installs in monitor mode and records carding attempts. Review them, then turn on enforcement to block detected carders at checkout
{
"ip_address": "185.x.x.x",
"source": "woocommerce_card_testing",
"score": 100,
"threat_level": "HIGH",
"created_at": "2026-09-29 14:02:11"
}Your SEO Bots Stay Welcome
WebDecoy recognizes crawlers from a shared registry of 186 known agents and allows the legitimate ones. Your search rankings, social previews, and monitoring services keep working.
Googlebot
Bingbot
Twitter/X
Search Engines
Googlebot, Bingbot, Yahoo Slurp, DuckDuckBot, Baiduspider, YandexBot
Always AllowedSocial Platforms
Facebook, Twitter, LinkedIn, Pinterest, WhatsApp, Slack, Discord
Always AllowedMonitoring & SEO
Pingdom, UptimeRobot, Semrush, Ahrefs, Moz, Screaming Frog
Always AllowedServer-Side + Client-Side Detection
WebDecoy analyzes visitors from multiple angles, both on your server and in the browser, making it extremely difficult for bots to evade detection.
Server-Side Detection
- User-agent pattern analysis
- HTTP header inspection
- Request rate limiting
- IP reputation checking
- Request pattern analysis
Client-Side Detection
- Headless browser detection
- Automation framework detection
- Browser consistency checks
- API timing analysis
- Behavioral fingerprinting
- Geographic consistency (VPN detection)
Why WebDecoy Beats the Alternatives
Other solutions leave gaps. WebDecoy provides complete protection.
| Feature | WebDecoy | OOPSpam | Kasada |
|---|---|---|---|
| WordPress Plugin | |||
| WooCommerce Carding Protection | Enterprise only | ||
| Self-Serve Pricing | |||
| Server + Client Detection | Server only | Client only | |
| VPN/Proxy Detection (Geo Consistency) | Enterprise only | ||
| Zero CAPTCHAs | |||
| SEO Bot Whitelist | 186-agent registry | Not applicable | Blocks all |
| Predictable Pricing | Per API call | Sales required | |
| Centralized Dashboard | |||
| Starting Price | Free, then $20/month | $23/month* | $$$$/month |
*OOPSpam charges per API call. Costs spike during attacks. WebDecoy has predictable monthly pricing.
Complete WordPress Protection
Extend coverage before PHP with a separately deployed Cloudflare or AWS CloudFront clearance validator. For a frontend hosted on Netlify, its extension protects requests that reach that deployment. Installing the plugin does not automatically deploy an edge validator or protect a separate origin. See the WordPress setup documentation.
Every attack surface covered. Every form protected. Every bot caught.
Comment Spam
Block bot-submitted comments without requiring CAPTCHAs. Real commenters never see friction.
Login Protection
Stop brute force attacks and credential stuffing. Protect admin and user accounts automatically.
Registration Spam
Prevent fake account creation by automated scripts. Keep your user database clean.
Checkout Fraud
Stop carding attacks and checkout abuse. Protect your payment processor relationship.
Content Scraping
Prevent bots from stealing your content and product data. Protect your competitive advantage.
Frequently Asked Questions
Does WebDecoy block Googlebot or other SEO bots?
No. The plugin recognizes crawlers from WebDecoy's shared registry of 186 known agents, and legitimate search engine crawlers such as Googlebot and Bingbot are allowed through. Your SEO keeps working while bad bots are flagged, and blocked once you turn on enforcement.
How does WebDecoy protect WooCommerce from carding attacks?
WebDecoy detects card testing patterns including multiple small transactions, rapid checkout attempts, multiple declined cards from the same IP, and automated checkout behavior. The plugin installs in monitor mode and records these attempts; turn on enforcement and detected carders are blocked at checkout.
Do customers see CAPTCHAs with WebDecoy?
No. WebDecoy works invisibly in the background using multi-layer detection. Legitimate customers never see challenges or interruptions. With enforcement on, only detected bots are blocked.
What's the difference between WebDecoy and OOPSpam?
OOPSpam is a form spam filter that only analyzes text after submission. WebDecoy is a complete bot protection platform with server-side and client-side detection that catches bots before they submit forms, protects WooCommerce checkout, and includes a centralized dashboard for all your sites.
How long does installation take?
About 2 minutes. Install and activate the plugin. Detection runs locally with no account or API key, starting in monitor mode so nothing is blocked until you turn on enforcement. Connect a WebDecoy account if you want the central dashboard.
Does WebDecoy work with page builders and form plugins?
Yes. WebDecoy protects WordPress core forms (comments, login, registration) and integrates with WooCommerce checkout. Form-specific protection works with any form that submits to WordPress.
Protect Your WordPress Site in 2 Minutes
Install the plugin, enter your credentials, and start blocking bots. No complex configuration. No ongoing maintenance. Just protection that works.