WooCommerce Protection with ShieldPRO

ShieldPRO provides advanced protection for WooCommerce stores by integrating with all user forms to prevent bots, spam, fake orders, and fraudulent activity. Using silentCAPTCHA, ShieldPRO’s invisible antibot technology, it blocks automated attacks while distinguishing between bots and legitimate users. Combined with optional Two-Factor Authentication (2FA), this keeps your store secure without affecting customer experience.

Once the WooCommerce integration is enabled and the relevant forms are selected, silentCAPTCHA protects your store, including checkout, login, registration, lost password, and social login forms. It helps:

• Block bots from automating checkout orders and fake purchases
• Prevent automated spam registrations and fake accounts
• Stop automated login attempts
• Stop automated lost password requests
• Protect WooCommerce social login forms

Learn more about SilentCAPTCHA here.

To get started, you'll need to enable the integration first by following the below steps.

1. Navigate to ShieldPRO sidebar menu > Configure > Integrations
2. Select "WooCommerce" under the "3rd Party User Forms Bot Checking" tab and click to save settings.

Enable WooCommerce integration

Once enabled, ShieldPRO applies silentCAPTCHA to your WooCommerce forms.

For full protection, select the user forms you want to protect in the Login Zone, including login, registration, lost password, and checkout (checkout is included by default).

To do this, please follow these steps:

1. Go to the main sidebar menu > Configure > select Login.
2. Click Configure next to "Limit Attempts: Login, Register & Lost Password Forms" component.
3. Select user forms from the Protected Forms list.

4. Click to save settings

   (see the screenshot below)

Note: We highly recommend selecting the all forms: login/registration/lost password. This will also protect your WooCommerce checkout form, as silentCAPTCHA is automatically applied to all ShieldPRO sites.

Access to Protected Forms options

For detailed instructions, you can visit the Protected Forms guide here.

Protecting these forms helps prevent automated login attempts, fake registrations, spam password resets, and fraudulent checkout orders.

Once integration is enabled and the user forms are selected (checkout included), Shield’s silentCAPTCHA antibot system will monitor and keep your store protected from bots and fake orders while letting legitimate customers browse and use your store normally.

You can monitor and confirm ShieldPRO's silentCAPTCHA is protecting your WooCommerce forms by using your WP Activity Log.

For examples, when someone attempts to log in through your WooCommerce login form, silentCAPTCHA evaluates the request and the WP Activity Log logs it. You may see entries like:

(see also the screenshot below)

Activity Log: silentCAPTCHA Pass

Or, if it's a bot, then you'll see something like:

(see also the screenshot below)

Activity Log: silentCAPTCHA Fail

When you see a silentCAPTCHA Fail event, that usually means the submission was from a bot. In the log entry you can click the IP address to open up Investigate IP dialog and look at the Overview tab. For example, a Total Reputation Score of -105 with bad bot probability 100% is a strong sign this was an automatic bad bot that Shield has blocked for you.

Example: silentCAPTCHA Fail & Bad Bot

When you see a silentCAPTCHA Pass event, that almost always means the submission came from a real visitor. This shows that Shield is allowing legitimate visitors through while still blocking bad bots in the background.

Example: silentCAPTCHA Pass & Human

If you are unsure whether the visitor is legitimate, you can contact us and send along the screenshots of the WP Activity Log and Investigate IP dialog (Overview tab) for that IP and we'll gladly take a look and make suggestions what you need to do.

ShieldPRO protects your WooCommerce registration forms from spam and bot accounts. This is especially useful if your store requires customers to register to make purchases, though it can also help if guest checkout is allowed.

You can validate email addresses at registration and block disposable or invalid emails, preventing fake accounts from entering your system.

To enable it, go to Shield main sidebar menu > Configure > Block SPAM User Registrations. Turn on email validation and choose how the system should respond to suspicious attempts — log them, mark IPs, or block immediately.

Access to Block SPAM User Registrations options

To improve WooCommerce login security, you can enable Email-based 2FA, which can be enforced for specific user roles. You may also allow customers to opt in via the Allow Any User option.

Additional optional 2FA methods include:

• Google Authenticator
• YubiKey
• Passkeys (WebAuthn)

When 2FA is enabled:

• Users provide a second verification step during login.
• Accounts remain secure even if credentials are compromised.

All 2FA methods settings can be located under the Shield main sidebar menu > Configure > Login.

To support a secure and smoothly running WooCommerce store, we’ve compiled a selection of blog articles you may find valuable:

• How to Protect WooCommerce from Hacking Attempts
• The Definitive Guide to WooCommerce Security
• Tools to Keep Your WooCommerce Store Running Smoothly