Take it easy. We'll cache you outside.

Pressable is proud to support the WP Minute. We had a whole pitch ready about how Pressable MCP makes everything you do easier, but take care of you first. Go drink some water. Have another cup of coffee. Take a deep breath. Go for a walk. (We're ready to chat managed WordPress hosting when you're ready.)

Eric's Notebook: Protect Your WooCommerce Sites Against Spam Orders

You may have noticed that spam is the web’s unrelenting and unwanted guest. It’s there to annoy and trick you, wherever you may roam. Like that kid in school who insisted on being your friend, even if you had nothing in common (sorry about that).

There’s no place to hide from spammers. I’ve found that to be true even with the e-commerce sites I manage. I’ve seen several instances of sites flooded with fake WooCommerce orders, most within the past year. The attacks have only become more sophisticated.

It started with a client who used the Cash on Delivery (COD) payment gateway, which is an easy target for abuse. Shutting it off and adding a Cloudflare Turnstile widget on the checkout page fixed the issue. But that was only the beginning.

It didn’t take long for a few other WooCommerce sites to experience similar attacks. Once again, a Turnstile widget stopped those orders dead in their tracks. Take that, evil bots! We have a solution and aren’t afraid to use it.

Well, malicious actors don’t quit so easily. A site already equipped with Turnstile was recently targeted with a credit card testing attack. Suddenly, thousands of failed orders were flooding my client’s inbox. Each order included the same customer name and a variation of the same address. They also used a different IP address each time. Even more creative: the bot timed the fake orders so that they wouldn’t get caught by common rate-limiting rules. Ugh.

Cloudflare ended up as our best (and most immediate) option. I fed a raw server log to Claude Code (not my idea of a great diet, but I digress), and the model provided a few security rules to implement. This may work for now, but these troublemakers will inevitably find their way back.

To be clear, this problem isn’t limited to WooCommerce. Every transactional platform is going through the same thing. Here’s hoping the open-source community will create a free (or low-cost) solution for combating spammers. We need something that’s well-documented and easy to install. Maybe something baked directly into WooCommerce core.

With that, here’s my public service announcement: Monitor your WooCommerce sites for suspicious activity. Be proactive and add Turnstile or another protection method. Put your site behind a firewall. Each step makes it harder for spammers to take advantage.

As for me, I’m going to take a walk in the woods. I’m guessing spam can’t reach me there – as long as I leave my phone at home.

What we published this week

Ditching Corporate Sponsors for Attendee-Funded Events Matt and Brian discuss the evolving economics of event sponsorship and the restructuring of LoopConf US. Watch or Listen

AI Is Changing WordPress Agencies Faster Than We Think Toby and Kurt talk about using Claude to rebuild WordPress sites, the shrinking size of some development projects, and what happens when clients can build functioning apps themselves with AI. Watch or Listen

How do we get Agents to use WordPress? When people ask AI agents to build a website, WordPress isn’t always the recommendation. This video digs into why that is, what agents actually need from WordPress, and whether the platform is moving quickly enough. Watch or Listen