Title: spam draft orders
Last modified: November 4, 2025

---

# spam draft orders

 *  Resolved [karenkir](https://wordpress.org/support/users/karenkir/)
 * (@karenkir)
 * [9 months ago](https://wordpress.org/support/topic/spam-draft-orders/)
 * I’m getting lots of orders from an unknown source. they are in Draft status and
   therefore using up order numbers. The payment method is stripe but there is nothing
   getting through to stripe. Each order is for the cheapest item on my website.
   I have oopspam installed and am using the checkout shortcode not the block. Initially
   I was getting lots of failed orders (also from unknown source) but after trying
   to stop them by installing **Simple CAPTCHA Alternative with Cloudflare Turnstile**
   and oopsam they have now changed to Draft rather than failed.
 * How can I stop this?

Viewing 15 replies - 1 through 15 (of 22 total)

1 [2](https://wordpress.org/support/topic/spam-draft-orders/page/2/?output_format=md)
[→](https://wordpress.org/support/topic/spam-draft-orders/page/2/?output_format=md)

 *  Plugin Support [shahzeen(woo-hc)](https://wordpress.org/support/users/shahzeenfarooq/)
 * (@shahzeenfarooq)
 * [9 months ago](https://wordpress.org/support/topic/spam-draft-orders/#post-18706030)
 * Hi there!
 * Thank you for bringing this to our attention.
 * Draft orders are created when customers start the checkout process but do not
   complete it. You can find more details about draft orders in this guide:
   [Draft Order Status – WooCommerce](https://woocommerce.com/document/managing-orders/order-statuses/#draft-order-status)
 * It seems that the plugins you installed to prevent failed orders (Simple CAPTCHA
   Alternative with Cloudflare Turnstile and Oopsam) are **blocking the checkout
   from completing**, so draft orders are still being created when someone starts
   but doesn’t finish the checkout.
 * Currently, there is **no built-in option to stop creating draft orders** when
   using the block-based checkout. However, using the **classic checkout** does 
   not create draft orders. For testing purposes, could you please try using the
   classic checkout instead of the block-based checkout and see if you still receive
   draft orders?
 * Additionally, WooCommerce has a scheduled daily cron job (`woocommerce_cleanup_draft_orders`)
   that deletes all draft orders that are no longer active.
 * Please let us know if this works for you.
 *  Thread Starter [karenkir](https://wordpress.org/support/users/karenkir/)
 * (@karenkir)
 * [9 months ago](https://wordpress.org/support/topic/spam-draft-orders/#post-18706207)
 * Thank you for your quick response
 * I do not use the block based checkout – I do use the old checkout shortcode so
   how are these draft orders being created?.
 * These draft orders appear to be spam. They are using up order numbers and clogging
   up reports.
 * here are some examples
 * Order Number Email (Billing) First Name (Billing) Last Name (Billing) Transaction
   ID Order Date Quantity Item Name SKU Product Current Price Coupon Code Item Cost(
   inc. tax) Customer Note Customer IP address Payment Method Full Name (Shipping)
   City, State, Zip (Shipping) Order Status Origin
 * 8014 [christinahayes.vnz9tk1@yahoo.com](https://wordpress.org/support/topic/spam-draft-orders/christinahayes.vnz9tk1@yahoo.com?output_format=md)
   christina hayes 2/11/2025 18:39 1 Teddy Bear backpack accteddybp 3 3 176.222.61.164
   stripe christina hayes Arcadia, NSW, 2159 Draft Unknown
   8015 [kellyhowell-3xq4pp@outlook.com](https://wordpress.org/support/topic/spam-draft-orders/kellyhowell-3xq4pp@outlook.com?output_format=md)
   kelly howell 2/11/2025 19:49 1 Teddy Bear backpack accteddybp 3 3 212.237.123.177
   stripe kelly howell Euabalong West, NSW, 2877 Draft Unknown8016 [josephbrown.cvd0@gmail.com](https://wordpress.org/support/topic/spam-draft-orders/josephbrown.cvd0@gmail.com?output_format=md)
   joseph brown 2/11/2025 20:59 1 Teddy Bear backpack accteddybp 3 3 168.210.178.63
   stripe joseph brown Pennant Hills, NSW, 1715 Draft Unknown
 *  [LovingBro (woo-hc)](https://wordpress.org/support/users/lovingbro/)
 * (@lovingbro)
 * [9 months ago](https://wordpress.org/support/topic/spam-draft-orders/#post-18706223)
 * Hi [@karenkir](https://wordpress.org/support/users/karenkir/),
 * Thanks for the clarification. Since you’re using the classic checkout shortcode
   and still seeing spam draft orders, this could indicate automated bots interacting
   with your checkout page directly. The most effective way to mitigate this is 
   by adding **Cloudflare Turnstile**, which offers a lightweight and privacy-friendly
   method to verify real users and block spam bots. You can follow the setup guide
   here: [https://wordpress.org/plugins/simple-cloudflare-turnstile/](https://wordpress.org/plugins/simple-cloudflare-turnstile/).
 * Also, as a quick reminder, please avoid sharing email addresses in public forums
   to help protect privacy and prevent further spam issues.
 * Once you’ve enabled Cloudflare Turnstile, let’s monitor your site to see if the
   spam orders stop. If they persist, please share your System Status Report through
   [https://pastebin.com](https://pastebin.com) so we can look into it further. 
   Let’s see how it goes!
 *  Thread Starter [karenkir](https://wordpress.org/support/users/karenkir/)
 * (@karenkir)
 * [9 months ago](https://wordpress.org/support/topic/spam-draft-orders/#post-18707140)
 * Thank you for your response
 * I already have **Simple CAPTCHA Alternative with Cloudflare Turnstile** installed
 * The email addresses I shared were from the spam orders so made up
 * I’ve put my status report in pastebin
 *  [LovingBro (woo-hc)](https://wordpress.org/support/users/lovingbro/)
 * (@lovingbro)
 * [9 months ago](https://wordpress.org/support/topic/spam-draft-orders/#post-18707159)
 * Hi [@karenkir](https://wordpress.org/support/users/karenkir/),
 * Thanks for your update and I appreciate you confirming that the Simple CAPTCHA
   Alternative with Cloudflare Turnstile is installed. Can you verify that the plugin
   is configured to show a CAPTCHA on your checkout page? According to the plugin
   documentation, Turnstile supports WooCommerce checkout forms ([Simple CAPTCHA Alternative with Cloudflare Turnstile – WordPress plugin | WordPress.org](https://wordpress.org/plugins/simple-cloudflare-turnstile/#:~:text=Supported%20Forms)),
   so if it’s installed and set up correctly the previously shared email addresses
   are likely not from spam orders. Please check the settings for Simple Cloudflare
   Turnstile to ensure the Turnstile field is visible on the checkout form, then
   monitor your orders for a few days and let us know if the issue persists.
 * I also noticed that you mentioned putting your status report on Pastebin but 
   there was no link included. Could you provide the Pastebin link so we can review
   it? If you need any guidance on configuring the Turnstile settings, you can check
   the plugin’s setup guide ([Simple CAPTCHA Alternative with Cloudflare Turnstile – WordPress plugin | WordPress.org](https://wordpress.org/plugins/simple-cloudflare-turnstile/#:~:text=Supported%20Forms)).
 *  Thread Starter [karenkir](https://wordpress.org/support/users/karenkir/)
 * (@karenkir)
 * [9 months ago](https://wordpress.org/support/topic/spam-draft-orders/#post-18707285)
 * Yes it is configured to have a captcha on the checkout page
 * Heres the link to pastebin [spam draft – Pastebin.com](https://pastebin.com/pTSQn8DL)
 *  [Sai (woo-hc)](https://wordpress.org/support/users/saivutukuru/)
 * (@saivutukuru)
 * [9 months ago](https://wordpress.org/support/topic/spam-draft-orders/#post-18707390)
 * Hi [@karenkir](https://wordpress.org/support/users/karenkir/),
 * Thanks so much for sharing your System Status Report, that’s very helpful! From
   reviewing it, everything looks up to date and configured correctly, which helps
   narrow down what’s happening here.
 * Since you’re using the classic checkout shortcode and have both OOPSpam and the
   Simple CAPTCHA Alternative with Cloudflare Turnstile active, these “Draft” orders
   are almost certainly being created by automated bots submitting the checkout 
   form directly, bypassing the visible checkout page.
 * Here’s what we recommend next:
    1. **Add a Cloudflare Firewall Rule: **Because you’re already using Turnstile, 
       the easiest next step is to add a Cloudflare firewall rule that challenges automated
       requests targeting your checkout page.
    2.  - Go to your Cloudflare dashboard → **Security → WAF → Firewall Rules → Create
          Rule**
        - Set the condition to:`(http.request.uri.path contains "/checkout")`Action:**
          Managed Challenge**
          This helps prevent bots from even reaching your checkout
          endpoint.
    3. **Verify the Turnstile Field Renders Properly**
       Open your checkout page in a
       private/incognito window — do you see the CAPTCHA box appear before placing 
       an order?If not, the CAPTCHA isn’t being injected correctly, and bots can still
       bypass it.
    4. **Check for a Theme Override: **Since your site uses the Botacora theme, please
       check if this file exists:
        `/wp-content/themes/botacora/woocommerce/checkout/
       form-checkout.php`If it does, it may be overriding the default checkout template
       and missing the Turnstile display hook.(Look for this line inside the file:`
       <?php do_action( 'woocommerce_checkout_after_customer_details' ); ?>`— if missing,
       the CAPTCHA won’t appear.)
    5. **Automatic Cleanup: **WooCommerce automatically deletes old draft orders via
       the `woocommerce_cleanup_draft_orders` daily cron job, so those entries will
       be removed periodically.
 * If spam orders still appear after these steps, please let us know whether they
   arrive in bursts (many per hour) or randomly throughout the day. That will help
   determine if it’s a targeted bot pattern.
 * You’re doing everything right so far; these last few checks should help stop 
   the drafts completely.
 *  Thread Starter [karenkir](https://wordpress.org/support/users/karenkir/)
 * (@karenkir)
 * [9 months ago](https://wordpress.org/support/topic/spam-draft-orders/#post-18708767)
 * Hi
 * Thank you for your reply
 * I do not have WAF access – when I click on WAF in my cloudfare dashboard it says
 * **Account-level web application firewall (WAF)**
 * I**mplement uniform and robust security for all domains under xxxxxxxxxxxxxxxxxxxxxxxs
   Account**
    - Configure WAF rules for some or all incoming traffic to your domains with 
      an Enterprise plan
    - Save resources by configuring WAF for multiple domains at once
    - Extend your existing protection to new domains as your organization grow
    - and asks me to contact sales!
 * 3. I do not use the Botacora theme? I’m using Astra.
 * wp-content/themes/astra/woocommerce/checkout/form-checkout.php or
 * wp-content/themes/astra-child/woocommerce/checkout/form-checkout.php
 * do not exist.
 * 4. The orders do seem to come in bursts. today we got a burst with the following
   timestamps
 * 4/11/2025 15:18
   4/11/2025 16:194/11/2025 16:504/11/2025 17:214/11/2025 18:224/
   11/2025 19:234/11/2025 20:244/11/2025 21:24
 *  [Sai (woo-hc)](https://wordpress.org/support/users/saivutukuru/)
 * (@saivutukuru)
 * [9 months ago](https://wordpress.org/support/topic/spam-draft-orders/#post-18708814)
 * Hi [@karenkir](https://wordpress.org/support/users/karenkir/),
 * Thanks for clarifying, that’s very helpful! Since you’re on a Cloudflare plan
   without WAF access, here are some alternative ways to block these automated checkout
   submissions:
    1. **Use a free Cloudflare “Rate Limiting Rule” (available under Security → Bots
       → Rate Limiting):**
    2.  - Add a rule targeting `/checkout*` with an action like _Managed Challenge_
          or _Block_ if there are more than a few requests per minute.
        - This works similarly to WAF but is available on free plans.
    3. **Add an extra field validation at checkout:**
       A lightweight plugin like **Checkout
       Honeypot for WooCommerce** or a simple anti-spam field (invisible to humans,
       but bots fill it) can stop automated submissions even before a CAPTCHA.
    4. **Turnstile verification:**
       Since you’ve confirmed it’s showing on the checkout
       page, please also check that it appears **before the “Place Order” button; **
       if it’s rendered too early in the form, some bots can still bypass it.
    5. **Automatic cleanup:**
       WooCommerce will automatically clear old draft orders
       daily, so these spam drafts shouldn’t accumulate permanently.
 * The fact that the orders arrive in bursts confirms they’re from automated bots
   running scripts; adding the rate-limiting rule or honeypot will usually stop 
   them completely.
 * Please try these and let us know if the bursts reduce after implementing them.
 *  Thread Starter [karenkir](https://wordpress.org/support/users/karenkir/)
 * (@karenkir)
 * [8 months, 3 weeks ago](https://wordpress.org/support/topic/spam-draft-orders/#post-18720081)
 * **Hi Apologies for the delay in responding the spam orders seemed to stop but
   they are now happening again**
 * I have rate limiting set in WooCommerce but there doesn’t appear to be an option
   in Simple turnstile plugin
 * **Checkout Honeypot for WooCommerce** – I cannot fin d this plugin
 * Turnstile is enabled for checkout and WooCommerce pay for order.
 * Are there any logs I can look at to see what is happening with these fake orders?
 *  [Sai (woo-hc)](https://wordpress.org/support/users/saivutukuru/)
 * (@saivutukuru)
 * [8 months, 3 weeks ago](https://wordpress.org/support/topic/spam-draft-orders/#post-18720137)
 * Hi [@karenkir](https://wordpress.org/support/users/karenkir/),
 * Thanks for the update, and no worries about the delay. Since the spam draft orders
   have returned, I’d like to clarify one quick detail that will help narrow down
   what’s happening:
 * In these draft orders, are the checkout fields (name, address, phone, etc.) being
   filled in, or is it mostly just the product + a random email?
   This helps determine
   whether bots are interacting with the visible checkout form or if they’re hitting
   the checkout endpoint directly.
 * Regarding logs: WooCommerce itself does not log draft-order creation events or
   bot submissions, so there isn’t a WooCommerce log that would show the source.
   These requests typically come from external automated traffic, and identifying
   them usually requires server-level or CDN-level logs.
 * Let me know what you find in the draft-order fields, that will help us confirm
   the next step.
 *  Thread Starter [karenkir](https://wordpress.org/support/users/karenkir/)
 * (@karenkir)
 * [8 months, 3 weeks ago](https://wordpress.org/support/topic/spam-draft-orders/#post-18720157)
 * The details are being filled in see examples below – I have changed the email
   addresses slightly
 * customer Type, order# ,contact email, contact name contact surname, month date,
   QTY, product, SKU Price, ip address payment method shipping name shipping address
   order status origin
 * failed 8082 jamesfletcher7########ug@yahoo.com james fletcher 12-Nov 0 Teddy 
   Bear backpack accteddybp 3                            –   45.167.69.214 stripe
   james fletcher Tahlee, NSW, 2324 Draft Unknown
 * failed 8083 robertbanks_5######93k@outlook.com robert banks 12-Nov 0 Teddy Bear
   backpack accteddybp 3                            –   94.59.33.78 stripe robert
   banks Moerlong, SA, 5278 Draft Unknown
 * failed 8084 elizabeththompsonu###@yahoo.com elizabeth thompson 12-Nov 0 Teddy
   Bear backpack accteddybp 3                                –   93.47.49.10 stripe
   elizabeth thompson Kingston On Murray, SA, 5331 Draft Unknown
 *  [Sai (woo-hc)](https://wordpress.org/support/users/saivutukuru/)
 * (@saivutukuru)
 * [8 months, 3 weeks ago](https://wordpress.org/support/topic/spam-draft-orders/#post-18720304)
 * Hi [@karenkir](https://wordpress.org/support/users/karenkir/),
 * Thanks for the updates and examples. Since the draft orders are filled, it looks
   like automated bots are submitting the checkout form directly.
 * The most effective next steps are:
    - **Turnstile Placement:** Confirm the CAPTCHA appears immediately before the“
      Place Order” button. Check in a private/incognito window to ensure it displays
      correctly; if it renders too early or elsewhere, some bots may bypass it.
    - **Add a Honeypot:** A lightweight invisible field can block bots before they
      reach payment. While OOPSpam and your current Turnstile plugin do not include
      a honeypot, you can use a plugin like [Invisible reCAPTCHA for WooCommerce](https://woocommerce.com/document/invisible-recaptcha/?utm_source=chatgpt.com),
      which includes a honeypot feature and logs blocked attempts.
 * After implementing these changes, monitor your draft orders for a few days. The
   bursts you’ve seen are typical of automated bot activity, and these measures 
   usually stop them.
 *  Thread Starter [karenkir](https://wordpress.org/support/users/karenkir/)
 * (@karenkir)
 * [8 months, 3 weeks ago](https://wordpress.org/support/topic/spam-draft-orders/#post-18720754)
 * Thanks
 * Can I use  [Invisible reCAPTCHA for WooCommerce](https://woocommerce.com/document/invisible-recaptcha/?utm_source=chatgpt.com),
   alongside **Simple CAPTCHA Alternative with Cloudflare Turnstile** or do I need
   to disable the later plugin?
 *  [Frank Remmy](https://wordpress.org/support/users/frankremmy/)
 * (@frankremmy)
 * [8 months, 3 weeks ago](https://wordpress.org/support/topic/spam-draft-orders/page/2/#post-18720801)
 * Hi [@karenkir](https://wordpress.org/support/users/karenkir/),
 * Generally, it is not recommended to run multiple CAPTCHA or anti-spam plugins
   simultaneously on the same form because they can conflict, causing issues with
   user experience or form submission. In your case, since both plugins aim to block
   spam at checkout, running both could cause duplication or errors.
 * A good approach would be to disable one plugin temporarily and test how well 
   the remaining solution handles spam. Since Cloudflare Turnstile is newer and 
   designed for low-friction user experience, many users prefer it for reducing 
   spam with minimal impact. However, Invisible reCAPTCHA for WooCommerce offers
   a honeypot feature that can be effective against bots.
 * If you are specifically interested in the honeypot functionality, Invisible reCAPTCHA
   might be worth prioritizing, but be sure to disable Simple CAPTCHA Alternative
   to avoid conflicts. Alternatively, consider thoroughly configuring and testing
   Cloudflare Turnstile alone first, as it may suffice.
 * I hope that helps. Let us know if you need anything else.

Viewing 15 replies - 1 through 15 (of 22 total)

1 [2](https://wordpress.org/support/topic/spam-draft-orders/page/2/?output_format=md)
[→](https://wordpress.org/support/topic/spam-draft-orders/page/2/?output_format=md)

The topic ‘spam draft orders’ is closed to new replies.

 * ![](https://ps.w.org/woocommerce/assets/icon.svg?rev=3234504)
 * [WooCommerce](https://wordpress.org/plugins/woocommerce/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/woocommerce/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/woocommerce/)
 * [Active Topics](https://wordpress.org/support/plugin/woocommerce/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/woocommerce/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/woocommerce/reviews/)

 * 24 replies
 * 7 participants
 * Last reply from: [thelmachido a11n](https://wordpress.org/support/users/thelmachido/)
 * Last activity: [8 months ago](https://wordpress.org/support/topic/spam-draft-orders/page/2/#post-18746231)
 * Status: resolved