Unknown records may be attacker tests, bot registrations, imported/staging data or legitimate customers staff do not recognise. Deleting them immediately can destroy evidence and remove real paid orders.
Classify each record using payment, account and access evidence before cleanup.
Contain risky actions
Pause checkout, account creation or affected API routes if unknown activity continues. Disable fulfilment for disputed orders while retaining their data.
Do not cancel/refund every order automatically; that can create financial harm. Assign an authorised person to approve each business action.
Record containment and last normal order times.
Preserve order/user records
Snapshot the database and relevant WooCommerce tables before edits. Record order/user IDs, creation times, status, role and transaction references with personal fields minimised.
Do not publish customer addresses, password hashes or complete order exports. Preserve notes and audit relationships.
Check HPOS versus legacy order storage.
Compare payment evidence
Search the payment provider for each unknown order’s transaction ID, amount, currency and state. Determine whether it was authorised, captured, failed, refunded or absent.
An order marked Processing without a matching provider event may be manipulated. A genuine provider charge requires reconciliation even if the WordPress record looks suspicious.
Never change payment state cosmetically.
Review creation channels
Determine whether the record came from checkout, administrator, REST API, import, subscription renewal or webhook. Inspect logs by path, authenticated user/token and time.
Do not rely on IP alone. API clients and staff can use changing networks, while stolen tokens retain familiar account names.
Preserve application-password/API-key identifiers.
Inspect user privileges
Separate ordinary customer accounts from administrators, shop managers and custom roles. Review email/role changes, application passwords, sessions and multisite context.
Disable unknown privileged users after preserving evidence. Do not remove every unfamiliar customer account simply because registration spam exists.
Check whether code hides users from dashboard lists.
Check fraud and checkout logs
Review gateway fraud results, checkout validation, failed attempts, address/velocity patterns and security/WAF events. Use these as supporting evidence, not an automated guilt decision.
An attacker test may use no successful payment, while a legitimate customer can trigger fraud controls. Keep the transaction/provider status authoritative for money movement.
Protect device/IP/customer data under the incident policy.
Audit API keys and webhooks
Review WooCommerce REST API keys, owners, permissions, last-used evidence and webhook destinations. Revoke unknown keys and rotate exposed integrations through named least-privilege accounts.
Do not store replacement secrets in tickets. Verify legitimate ERP/CRM/shipping integrations after rotation.
Check provider and tag-manager access too.
Look for database manipulation
Inspect database-access users/logs where available, custom import tools, code snippets and scheduled actions. Direct SQL can create inconsistent orders that do not follow normal checkout hooks.
Use precise queries on protected copies. Do not delete order/user rows without related metadata/order-item review.
Record where evidence is unavailable.
Check customer communication
Determine whether unknown orders/users triggered welcome, receipt, password-reset or shipping emails. Preserve message/provider IDs and stop further automated mail.
Do not contact an unverified address with incident details. For legitimate customers, use the organisation’s approved support channel and explain only confirmed status.
Remove suppressed/bounced synthetic recipients after investigation.
Reconcile and clean
Classify records as legitimate, fraudulent/attacker-created, test, bot registration or undetermined. Preserve incident references, then cancel/refund/remove/anonymise through approved WooCommerce and provider processes.
Avoid sending automated customer emails until status is correct. Keep accounting/stock/fulfilment in sync.
Document every manual adjustment.
Verify after recovery
Test sandbox checkout, registration, payment webhooks, API integrations, order emails and roles. Monitor new records, privileged changes and provider events.
Request urgent store recovery when unknown orders show paid or privileged accounts exist. Share secure order/transaction IDs and redacted logs—never card data, passwords, secrets or customer exports.