About this plugin
Your uptime monitor is green, the store looks fine, and orders have quietly stopped. Or the Orders screen fills with dozens of failed orders overnight and you cannot tell whether your payment gateway broke or someone is testing stolen cards on your checkout.
Checkout Doctor watches every checkout attempt and answers the question that matters: what went wrong, and whose fault is it.
What it does
- Reads every failed checkout, on the block checkout and the classic checkout, with any payment method. It records the error the customer actually saw, not just that an order failed.
- Says whose fault it is. Each failure is sorted into the customer’s bank or card, the customer’s input, your store’s rules (stock, shipping, coupons), your store’s configuration (a wrong API key, an account not activated), or the site itself (expired sessions, errors in code). Only the last two are yours to fix, and those are the ones it raises.
- Recognises card testing. Many failed payments in a short time, from few visitors or many throwaway email addresses, refused by the bank: that is an attack, not a broken gateway, and it says so in one sentence.
- Notices when paid orders stop. It learns your store’s normal pace from its own history and tells you when the time since the last paid order is out of character. Three quiet hours mean nothing for a small store and a lot for a busy one; it knows the difference.
- Shows what changed. Plugin, theme and WordPress updates sit on the same timeline as new kinds of failure, so “it started after that update” is visible at a glance.
- Checks your protection. Test mode left on in a live store, checkout rate limiting switched off, guest checkout: read from your real settings.
- Emails you when card testing starts, when the store causes failed checkouts, or when paid orders stop for far longer than usual. One email per problem, not one per failure.
Everything above is free, on every store, with no limit on orders or payment methods, and 90 days of history.
Privacy
No card data, names or addresses are stored. IP and email addresses are kept only as hashes, which can tell repeated attempts apart but cannot be read back. Records are deleted after 90 days.
The plugin adds a suggested paragraph to your privacy policy and supports WordPress’s personal data export and erasure tools. Its detection runs entirely on your own server; the only outside connection is the optional Freemius opt-in described under External Services.
External Services
This plugin connects to one external service:
Freemius, our licensing and update platform. The Freemius SDK is used to apply the Free/Pro state and — only if you opt in on first activation — share basic, non-personal usage and site data used to improve the plugin. com.
No data is sent unless you activate the plugin, and the optional opt-in can be declined without affecting anything. See the Freemius Privacy Policy and Terms of Service.
The plugin makes no other outbound requests. Checkout failures are read from your own store’s requests and orders.