# Checklist — WooCommerce REST API rate limiting

## Volade · Public resource · July 2026

> Print or tick while deploying **WC API Rate Limiter by Volade**.

---

## Phase 0 — Scoping (15 min)

- [ ] Live **WooCommerce** store confirmed
- [ ] Admin + identical staging environment
- [ ] Online payment gateway active (Stripe, PayPal, Mollie…)
- [ ] Technical owner assigned (you or agency)
- [ ] Full backup before any change

## Phase 1 — Card testing warning signs

- [ ] Spikes in **€0 or micro-amount** orders
- [ ] **Random** customer emails (`test@`, disposable domains)
- [ ] **Payment declined** bursts in gateway logs
- [ ] Abnormal **REST** traffic on `/wc/v3/orders` or `/customers`
- [ ] Chargeback or acquirer fraud alerts

## Phase 2 — Plugin install

- [ ] Download **WC API Rate Limiter by Volade**
- [ ] Activate on **staging** first
- [ ] Check **Site Health** → WARL section
- [ ] Apply **Card testing shield** preset on staging

## Phase 3 — Preset and scope

- [ ] Preset chosen: card_testing / woocommerce / agency / api_keys
- [ ] Scope verified (`wc_sensitive` vs `wc_all`)
- [ ] Window: __________ req / __________ seconds
- [ ] Block mode enabled
- [ ] `X-RateLimit-*` headers if headless integration

## Phase 4 — Allowlist and exceptions

- [ ] Office / agency VPN IP allowlisted
- [ ] ERP or middleware server IP listed
- [ ] Legitimate WooCommerce API keys tested
- [ ] Payment webhooks unaffected (not WC REST)

## Phase 5 — Staging tests

- [ ] 10 rapid REST calls → **429** on sensitive routes
- [ ] Normal checkout order succeeds
- [ ] Headless product sync OK (agency preset if needed)
- [ ] 429 log visible in WARL admin
- [ ] JSON export of events generated

## Phase 6 — Production

- [ ] Short maintenance window announced
- [ ] Preset applied in production
- [ ] 24 h monitoring: 429 rate, real orders
- [ ] Agency runbook filed in client folder

## Phase 7 — Monthly follow-up

- [ ] Review 429 log (top IPs, routes)
- [ ] Tune thresholds if false positives
- [ ] Align with host / security team
- [ ] `wp warl status` in maintenance report

---

**Plugin:** [WC API Rate Limiter by Volade](https://volade.com/en/cms/wordpress/extensions/wc-api-rate-limiter-by-volade)  
**Article:** [WooCommerce card testing — REST API rate limits](https://volade.com/en/blog/woocommerce-api-rate-limiting-2026)