Hey @bruno05,
Glad you reached out.
For a bit of context, this is the order of how GiveWP works with the payment gateway to process the donation:
1. The donor fills out the donation form and submits the donation.
2. A donation (and subscription, if applicable) is created on the GiveWP side and set to “pending.”
3. All of the information is sent to the gateway to process the transaction, as well as ongoing subscription renewals.
4. The gateway processes it and notifies the site (via the webhook or IPN) that it went through.
5. GiveWP processes that webhook/IPN and sets the donation to complete.
If the webhook/IPN is unable to reach your site for any reason, the donation will remain “Pending” and eventually change to “Abandoned”.
Also, if your donors decide not to donate during the transaction, then the donation will also be marked as abandoned.
If you are not sure if the donors are real donors, what you might be experiencing is most likely what we call “donor spam.” This can happen for a wide variety of reasons. Let me give you some context and a broader picture of all the ways we address this.
1) Our Akismet Integration
Install or activate the free Akismet plugin. Then go to “Donations > Settings > Advanced” and ensure that our Akismet SPAM protection is enabled there and save changes.
2) Use Cloudflare or Sucuri
These are third-party services that help both speed up your website and provide protection against bot attacks like what you are experiencing. Some sites get added to bot lists and there’s nothing you can do to prevent them from just continually attacking your site, except using a strong and dedicated firewall/security service like these two.
3) Set a higher minimum donation amount
Sometimes, simply increasing the minimum donation amount is a huge method of preventing these types of attacks. Bots tend to test forms with $1 or up to $5 amounts. If your form only accepts donations of $10 or higher you can prevent these low-hanging easy bots.
4) The Stop Donor Spam plugin
If that still does not help, I would suggest you install and activate a plugin we are developing internally called Stop Donor Spam. This plugin works out of the box without any settings. Simply activate it and it will filter your attempted donations through a known spambot database before proceeding.
5) Implementing a reCAPTCHA
We don’t generally recommend the reCAPTCHA option because it slows down the donation experience and looks unsightly. It can harm your donations sometimes more than benefit them. But sometimes it’s really your last line of defense. So if you really want to implement it, here’s how:
Here is the link to that code.
Make sure to follow steps 1-4 listed at the top of the snippet within the comments.
If you need assistance implementing custom PHP code on your website we have this guide:
https://givewp.com/documentation/resources/adding-custom-functions-to-your-wordpress-website/
Please note that this code snippet is provided as an example of how you can extend GiveWP with code. It’s up to you to implement and customize to your liking. We cannot provide support for custom code on your website, only the code that we create and distribute.
Please let us know if you have further questions on this or need any additional assistance!
