# How to Stop Spam Reviews and Fake Signups in WooCommerce with ActiveLayer Source: https://activelayer.com/docs/how-to-stop-woocommerce-review-spam/ Two kinds of junk arrive through WooCommerce’s own forms. Fake product reviews, increasingly written well enough to pass for real ones. And bot-created customer accounts that clutter your user list, inflate your numbers, and often exist to post those reviews. Product reviews are WordPress comments underneath, so a comment filter catches some of them. Customer registrations are not, and most stores have nothing checking those at all. This guide covers the full ActiveLayer and WooCommerce integration. The setup takes about ten minutes. - [What This Covers, and What It Does Not](#aioseo-what-this-covers-and-what-it-does-not) - [Step 1: Create Your Free ActiveLayer Account](#aioseo-step-1-get-your-api-key) - [Step 2: Install the ActiveLayer Plugin](#aioseo-step-2-install-the-plugin) - [Step 3: Connect Your Key](#aioseo-step-3-connect-your-key) - [Step 4: Turn On WooCommerce Protection](#aioseo-step-4-turn-on-woocommerce-protection) - [Step 5: Decide What Happens to Spam](#aioseo-step-5-decide-what-happens-to-spam) - [Step 6: Test Both Paths](#aioseo-step-6-test-both-paths) - [What About Fake Orders and Card Testing?](#aioseo-what-about-fake-orders-and-card-testing) - [Frequently Asked Questions](#aioseo-frequently-asked-questions) ### What This Covers, and What It Does Not WooCommerce spam means different things to different store owners. ActiveLayer checks **product reviews** and **customer registrations**. Registration protection covers the My Account registration form. Accounts created during checkout, classic or Blocks, are not checked. It does not check guest checkout, orders, coupons, or payments. If your actual problem is fake orders or card testing, that is payment fraud rather than spam, and it is solved at the payment gateway. Stripe Radar and your gateway’s own fraud rules are the right tools there. ### Step 1: Create Your Free ActiveLayer Account First, head over to [activelayer.com](https://activelayer.com/) and sign up for a free or a pro account. The free plan includes 200 spam checks (one-time), and you don’t need to enter a credit card. Once you’ve signed up, you’ll be redirected to the ActiveLayer dashboard at app.activelayer.com. Click the **New Project** button to create a new Project. [image: ActiveLayer new project] Enter your **Project Name **(which can be used to recognize your site), select **WordPress** as your Platform, and then click on the **Create Project** button. [image: project name] From the next page, you’ll be able to copy the API key. This key connects your WordPress site to ActiveLayer, so copy it or keep this tab open. You’ll need the key in Step 3. Also, note that this key is displayed only once. [image: ActiveLayer API key] ### Step 2: Install the ActiveLayer Plugin In your WordPress admin: - Go to **Plugins > Add New**. - Search for **ActiveLayer**. - Click **Install Now**, then **Activate**. [image: install activelayer] Once activated, you’ll see a new **ActiveLayer **item in your WordPress admin menu. ### Step 3: Connect Your Key Next, let’s connect your site to your ActiveLayer account. - In your WordPress Dashboard, go to **ActiveLayer > Settings**. - Paste the API key you copied in Step 1 into the API key field. - Click **Verify Key**. [image: api key activelayer] When the key is verified successfully, you’ll see a green checkmark. That means your site is now talking to ActiveLayer. [image: api added] If you don’t see the green checkmark, double-check that you copied the entire key with no extra spaces at the beginning or end. ### Step 4: Turn On WooCommerce Protection - Go to **ActiveLayer > Integrations > WooCommerce**. - Under **ActiveLayer > Integrations > WooCommerce**, Product Reviews and Customer Registration are enabled by default. Untick either one only if you want to exclude it, then save the settings. - Save. [image: Enabling WooCommerce review and registration spam protection in ActiveLayer] Most stores want both. Turn on reviews alone if customer accounts are not a problem for you, or registration alone if you have disabled reviews entirely. ### Step 5: Decide What Happens to Spam The two protected areas behave differently. **Reviews** go to the WordPress spam folder by default, where you can still see them. There is also an auto-delete option that removes them outright, and it applies at a spam score of 95 or more by default. Leave the Silently Discard option off for your first few weeks. This way it’s safer, and it lets you confirm the filter is calling things correctly before you let it delete anything permanently. Once you have watched it for a while and trust the results, turning auto-delete on stops the folder filling up. **Registrations** are blocked outright. The visitor sees “Registration blocked: your submission was flagged as spam” and no account is created, but you can still view the submission from the **ActiveLayer menu > Submissions** page. ### Step 6: Test Both Paths Open a private browser window, leave a normal product review, and check ActiveLayer > Submissions or the Analytics page in the ActiveLayer app. Reviews from signed-in customers are not checked unless Logged-in Users is enabled in the WooCommerce integration settings. Registrations next, and do this one properly, because a blocked signup is invisible to you. Open a private browser window, go to your My Account page, and register a test customer with a real-looking name and email. It should go through. If a bot/spammer tries to sign up, their account isn’t created. ### What About Fake Orders and Card Testing? This is the most common WooCommerce spam complaint, and ActiveLayer is not the correct tool for it. Card testing, where someone runs stolen card numbers through your checkout in small amounts, is payment fraud. It happens at the gateway, usually through guest checkout, and a content filter never sees it. Handle it where it happens: - Turn on your gateway’s fraud tools. Stripe Radar blocks most card testing with its default rules. - Ask customers to register on the My Account page before buying if you want registration spam checks; checkout account creation is not checked. - Rate-limit checkout attempts at your host or CDN. Cloudflare rules work well for this. - Watch for bursts of small failed payments, which is the signature of card testing. ActiveLayer helps indirectly by stopping the bot accounts that sometimes precede this activity, but it is not a fraud tool and should not be relied on as one. ### Frequently Asked Questions Will this block real customers from registering? It should not, but registration blocks are invisible to you, so test it as described in Step 6. If a real signup is flagged, mark it clean under ActiveLayer > Submissions so the system can learn from the correction. The account was not created; ask the customer to register again. Does it work with Cart and Checkout Blocks? No. ActiveLayer does not check registrations made during checkout, either classic or Cart and Checkout Blocks. Only the My Account registration form is checked. Classic checkout and the My Account page get the complete check. What happens if ActiveLayer’s API goes down? Submissions pass through unchecked. Your store keeps working and nothing is blocked by mistake, which is the right tradeoff for a checkout flow. Next Steps Reviews and registrations are now checked before they reach your store. Every decision, with its risk level and the result, is on the Analytics page in your ActiveLayer dashboard. [Create your free ActiveLayer account](https://activelayer.com) to set this up on your store. ### Need Help? Contact our [support team](https://activelayer.com/contact/) if you run into issues with the installation, API key, or the WooCommerce integration. You can also email us at [support@activelayer.com](mailto:support@activelayer.com) with more details so that the team can help you.