---
title: "A customer says checkout's being weird. Now what? · Woodshack"
description: "That one-line complaint turned out to be a credit card skimmer that only some visitors ever saw, and that the site's own security plugins had missed. What the owner did right, and what to do if you get that email."
url: https://woodshack.net/notes/a-customer-says-checkout-is-weird/
site: Woodshack (https://woodshack.net/)
about_this_site: https://woodshack.net/for-ai/
---
Field note · October 12, 2026 · security · online stores · ongoing care

# A customer says checkout's being weird. Now what?

Written by Walter. Edited by Tim, who decided it was true before it shipped. [What that means](https://woodshack.net/colophon/).

The whole report was one sentence, passed along from one of the store's own customers: the site was being weird on checkout.

No error message. Nothing obviously broken. The owner could have filed it under "customers say things" and moved on. Instead they passed it to us the same day, and that turned out to be the most important thing anyone did in this story.

## What was actually going on

Hidden in the checkout was a credit card skimmer: a small piece of code that quietly copies card details as people pay and sends them somewhere else. The store still got the order. The customer still got their goods. The card number went to a third party too.

It only showed itself to some visitors, on some browsers, under some conditions. Everyone else saw a normal checkout, which is why it took a customer, and not the owner or anyone looking after the site, to notice something was off.

The site had more than one well-known security plugin running the whole time. None of them had said a word.

## Why it matters

A skimmer doesn't break anything, which is exactly what makes it expensive. Every day it runs, some of your customers' card numbers leave with their orders. The bill, when it comes, isn't a repair bill. It's chargebacks, a hard conversation with your payment processor, and the email to customers that no owner wants to write. The trust takes longest to get back.

## What we did

We weren't sure what we were looking for. "Nothing looks broken" used to mean nothing was wrong. Attackers have gotten careful, and with AI tools in the mix they're getting better at it fast, so we took the report seriously and started digging.

We found the skimmer and cleaned it out. Then we spent a long time taking it apart, because something that careful doesn't get there by accident. One of its tricks: nobody's account had been upgraded to administrator, which is the thing a security plugin watches for. Instead, an ordinary user role had quietly been given administrator powers. Every account still showed its usual role. The user list looked normal. The role itself was the back door.

We moved the store to clean hosting and cleared out the bad code. That fixed the day. The bigger change was deciding to stop asking WordPress to watch WordPress. A security plugin lives inside the site it protects, and it sees the site the way the site shows it. Whoever gets deep enough to plant a skimmer can get deep enough to shape what the plugin sees. So we built a way to keep watching from outside, with nothing installed on the site, looking for the kinds of changes a skimmer leaves behind. That tool became [Walter Sentry](https://woodshack.net/sentry/). The store has been clean since.

The longer version is in our work: ["Checkout's being weird."](https://woodshack.net/work/the-skimmer/)

## What you can do

- **Treat a vague complaint about checkout as a real report.** Pass it on the day you get it, to someone who will look even when nothing is obviously broken.

- **Go through your own checkout the way a stranger would.** Once in a while, do it logged out, on a phone, on cellular data, not from the office computer you always use. This one only showed itself to some visitors. The browser you use every day may be the one it hides from.

- **Ask whoever looks after your site one question:** "If someone planted a skimmer, how would we find out?" If the whole answer is "the security plugin would tell us," that's one plugin's word against an attacker who has already walked past it.

- **Know who gets the "something's weird" email, and what happens next.** If the honest answer is "it goes to a shared inbox and someone gets to it eventually," fix that while nothing is wrong. The owner in this story had a person to send it to. That's the whole reason it's a short story.

If this sounds like your setup, or there's an email like that sitting in your inbox right now, [tell us about it](https://woodshack.net/contact/).

We write these when something in the work turns out to be worth writing down. If you're hitting the thing described above and want a second set of eyes on it, [tell us what's not working](https://woodshack.net/contact/).

[← All notes](https://woodshack.net/notes/)