Sucuri Firewall configuration may cause duplicate WooCommerce orders

Issue overview

We have received multiple reports from merchants experiencing duplicate orders on their WooCommerce stores. In over 90% of reported cases, the affected stores have Sucuri Firewall enabled, configured via an A record pointing to Sucuri’s servers.

This issue has been observed since March 16th, 2025 across multiple payment gateways, including Stripe, PayPal, and Square. During this time, there was no WooCommerce or gateway release that we could readily observe is tied to this issue. Our initial investigation suggests that the firewall may be inadvertently resending requests, leading to duplicate order creation. 

As of today, we know that the Sucuri team is working to issue a fix for this. You can monitor their blog as well as ours for updates. Continue reading to find out if you were affected and what steps you should take next.

How to determine if you’re affected

Your store may be affected if:

• Customers report being charged twice for the same order
• You notice duplicate orders in your WooCommerce admin with the same customer details
• The issue began around or after March 16th, 2025
• Checkout processing times occasionally exceed 30 seconds
• Your site uses Sucuri firewall (via DNS A record)

To check if your site uses Sucuri firewall via DNS, you can use a tool like DNS Checker’s DNS Lookup, enter your domain name, and search for the A record. If the A record points to Sucuri’s servers rather than your hosting provider’s servers, your site is likely affected.

Many of the affected merchants are hosted with GoDaddy, which offers a Web Application Firewall (WAF) powered by Sucuri and configured through DNS.

What you should be doing

If you are a customer of Sucuri and are affected by the firewall, we recommend you audit orders made on or after March 16th, 2025, for any duplicate orders.

You can identify duplicate orders by checking for orders with the same timestamp from the same customers. If you identify such duplicate orders, they should be refunded.

What we’re doing

The WooCommerce team is:

1. Collaborating with Sucuri and GoDaddy to identify and resolve the underlying cause
2. Exploring potential improvements to WooCommerce checkout to better handle concurrent requests
3. Monitoring support channels for additional reports and confirming when the issue is fully resolved

Support resources

If you’re experiencing this issue:

• Continue to monitor the Woo Developer Blog and this post for any updates.
• If you continue experiencing issues, please open a support ticket

We understand the serious impact this issue has on both merchants and their customers. We’re committed to providing updates as more information becomes available and reaching a solution as quickly as possible.