WAF Not stopping carding attacks

Website, Application, Performance Security
1

What is the name of the domain?

What is the issue you’re encountering

We’ve been getting a lot of carding attacks on our woocommerce store so we decided to add a WAF managed challenge to the /checkout page. However it doesn’t seem to be stopping anything or to be working. On the WAF dashboard the CSR is 0%. Carding attacks still coming through. Help would be appreciated. Thanks

What steps have you taken to resolve the issue?

Checked connection to website,
Tried changing managed challenge to interactive and nothing changes, checkout page loads fine without any challenge popping up.

Was the site working with SSL prior to adding it to Cloudflare?

Yes

What is the current SSL/TLS setting?

Full

2

Can you try Full (strict)?

Can you see the attack in your event log? https://dash.cloudflare.com/?to=/:account/:zone/security/events

3

It is on full (strict). And can’t see anything on the activity log

4

They may be bypassing cloudflare and hitting your server directly, if so, your hosting provider should be able identify that traffic. If that is the case, review this

When configured, your origin will only serve requests from Cloudflare.

2 Likes
5

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.