Hello @marketingbugle , thank you for reaching out.
Wordfence offers a variety of security services for our members.
We offer several forms of login security in the form of reCAPTCHA to filter out bot users, Brute Force Protection in the form of IP blocking users after a set number of failed attempts, and Two Factor Authentication to further secure user and administrator accounts. We also offer WooCommerce Integration as well as allowing you to add Two Factor Authentication to custom pages.
Wordfence comes with IP Blocking, as well as protection against other forms of malicious activity such as SQL Injections and DOS Attacks through our Firewall.
Since the traffic typically will look like valid traffic, Wordfence cannot detect a good credit card vs. a bad credit card, or a valid purchase vs. an invalid purchase. We don’t want to block anything that might be actual business for your site.
When it comes down to it, in Wordfence, blocking the IPs or user-agents (if you notice patterns between either) are a few things to consider.Rate Limiting can be an excellent tool in providing help, depending on how frequently the IPs are changing. Wordfence Rate Limiting can detect an increase in requests and can be used to throttle the attack from both human and bot traffic. You can check that out below to reference our recommended settings. You can set those up to be a bit more strict than we recommend, however, if you set them too strict, you will see warnings and may have unexpected blocking occur: https://www.wordfence.com/help/firewall/rate-limiting/
You might also want to consider using a captcha specific to your billing plugin. You can also look into AVS and CVV matching. The Address Verification System (AVS) checks the billing address that buyers provide at checkout against the address that the credit card company has on file for them. The credit card company sends a response immediately to let you know if the billing address matches. You will want to check with the billing system for information on AVS verification.
While preventing Carding Attacks completely is nearly impossible, we can provide you the tools to limit their abilities and make it a lot harder for them. We covered carding attacks on a Wordfence Live episode which has helpful information on this issue:
For any additional information you can reach out to presales @ wordfence . com for assistance.
Hope this helps,
Christian