A checkout is the one page on a store that anyone on the internet can submit to, repeatedly, for free, which is exactly why card-testing bots live there. Because most captcha plugins only hook the classic checkout form, they stop working the moment a store switches to the WooCommerce Checkout block. That block does not submit a form at all. It posts JSON to the Store API, and a plugin listening on woocommerce_checkout_process never sees the request. The route stays open even on stores whose visible checkout still uses the classic shortcode, so a bot does not need your checkout page. It only needs the route.
Rather than ship another captcha checkbox, we built the scanner first. Checkout Bouncer opens the store, works out how the checkout is actually rendered, and reports back in plain English. It recognises the Checkout block, the classic shortcode, and layouts built in Elementor, Divi, WPBakery, Beaver Builder, Bricks or Oxygen by looking inside the builder’s own saved layout. It resolves the Store API route, the pay-for-order page and the add-payment-method endpoint, and it hunts down rogue duplicate checkout pages left behind by theme demos and staging copies. Every route it finds carries a severity and a one-click Protect or Block.
The complication was that not every route can carry a token. reCAPTCHA needs somewhere to attach one, and a Store API route hit directly on a store that checks out through the classic form has nowhere to put it. So the plugin registers proper Store API extension data where a token can travel with the order, and where it structurally cannot, it offers to return a 404 or a 403 for that route instead. Store staff and allowlisted addresses are always let through. Detect, protect, block, in that order.
Around that sits a gateway-agnostic order-rate throttle with a monitor mode that records without blocking, an events dashboard with seven-day statistics and CSV export, per-gateway targeting, an IPv4, IPv6 and CIDR allowlist, and fail-open handling so a Google outage does not become the store’s outage. Client addresses resolve from REMOTE_ADDR only unless a filter explicitly opts into a proxy header, so an allowlist entry cannot be reached with a spoofed one. Logging is anonymised throughout: hashed throttle buckets, salted email digests and a daily retention purge.
The result is a WooCommerce reCAPTCHA plugin that treats a checkout as a set of routes rather than a single page, and closes each one on its own terms. We also designed and built the Checkout Bouncer product site and its custom WordPress theme.
For a related caching problem on WooCommerce, see how we fixed a YITH quote counter stuck behind WP Engine cache.
One of our clients named Davvy operates across multiple e-commerce platforms, including Amazon, Shopify, and eBay. Each of these marketplaces has different conditions, rules, and fee structures. The client needed stock management software that could track stock, sales, profit, delivery fees, platform fees, sales profit graphs, product lists, and more in one place.
Previously, the client managed everything using Excel, which became tedious and inefficient. Seeking a better, all-in-one solution, he turned to an AI software builder platform. Using React.js and a PostgreSQL database, he attempted to build the software himself. After hours of effort, debugging, and frustration, he realized the system wasn’t working properly and lacked the “human touch” needed to bring it to life.
Our team took on the challenge of this complex task. The client provided us with the full source code, Excel sheets, product data, and profit calculations. We carefully studied the codebase over the course of seven days to identify the core issues and determine how to enhance the system with additional features.
After 30 days of development, we delivered a working version of the Grassias stock matrix management system. The client reviewed it, requested a few corrections and additional features, which we quickly implemented.
In the end, we built a powerful, all-in-one stock and sales management solution, with every marketplace rule, fee, and margin visible in one place instead of scattered across spreadsheet tabs. The client was extremely satisfied with the result. We also handled Shopify theme development for Grassias to increase sales.
For another build where an external data source drives the site, see our case study on the WordPress Multisite for Het Groene Brein.
