Failed & Spam Order Cleaner for WooCommerce

The problem

A card-testing attack can leave thousands of failed orders in a single night. Bots run stolen card numbers through your checkout, most are declined, and every attempt leaves a failed or pending order behind. WooCommerce’s Orders screen bulk-edits one page of orders at a time, so clearing tens of thousands means hundreds of rounds of select all, move to trash and wait. Until they’re gone, they bury your real orders.

How a cleanup works

1. Under WooCommerce → Spam Order Cleaner, tick the statuses to clear (Failed, Pending payment, On hold or Draft) and set a date range.
2. Preview them. You see how many orders match, split by status, and the newest ones with their email, IP address and total. Nothing has changed yet.
3. Click Clean Up. The orders move to the trash, in the background, in batches that stop after a few seconds, so nothing times out. You can leave the page.
4. Read the attack report: how many orders, the time span they were placed in, and how many distinct emails, IP addresses and countries were behind them. Export it as CSV.
5. Changed your mind? Restore the whole run from its report in one click.

What it leaves alone

Orders with a recorded payment date are skipped by default, even if they match, because they took real money once. The protection is a checkbox on the Settings tab, called Never touch orders that have a recorded payment, and it stays on unless you switch it off. So are orders linked to a WooCommerce Subscriptions subscription, orders from the last hour (a customer may still be paying) and anything placed after the cleanup started. On our test store we seeded 541 failed and pending orders, one of which had been paid. The preview counted 540.

Trash first, delete on purpose

Every cleanup moves orders to WooCommerce’s trash unless you choose otherwise. Deleting permanently takes a ticked box and typing DELETE, and the server checks both again. Once you’ve checked the report and the trash, you can delete the trashed orders for good from the same screen.

What it doesn’t do

• It cleans up after an attack. It doesn’t block one: there’s no CAPTCHA, rate limiting or fraud scoring. Pair it with an anti-fraud or bot-blocking tool.
• It never blocks an email or IP address automatically. Attackers change both, so a blocklist built from one attack rarely stops the next.
• Deleting orders here doesn’t remove data already sent to Stripe, PayPal, a shipping service or an email tool. You manage that in each service.
• It doesn’t touch completed or processing orders. It is for failed, unpaid and abandoned ones.