WordPress problem fix
A card skimmer is a small hidden script on your checkout page that copies card details as customers type them. The store keeps working, which is why it can run for months.
If several customers report card fraud after shopping with you, the most likely cause is a skimmer: JavaScript injected into your WooCommerce checkout that sends card numbers, security codes and billing addresses to the attacker. In 2026 attackers used a flaw in the Funnel Builder plugin, fixed in version 3.15.0.3 and used by more than 40,000 stores, to plant fake Google Tag Manager scripts that loaded a skimmer on every checkout. Others hide the skimmer in checkout template files or in a rogue plugin that does not show in the plugin list. The fix is to remove the skimmer, close the hole it came through, and tell your payment provider so they can advise on next steps.
If any of these match, you are on the right page.
More than one customer reports card fraud after ordering from you
Your payment provider or bank contacts you about suspicious activity
Checkout loads scripts from domains you do not recognise
You see Google Tag Manager or analytics codes you did not add
An antivirus warns customers on your checkout page
Usually through a plugin with a known hole, a stolen admin login, or a compromised hosting account. The Funnel Builder flaw let attackers write their own script into the plugin's settings without logging in.
Attackers copy the look of Google Tag Manager and analytics snippets, and sometimes register domains that look like Google's. A quick glance at the page code shows what seems to be ordinary tracking.
If card details are typed into a field on your own page, a skimmer on that page can read them. Hosted payment pages that open on the provider's own site are much harder to skim, which is one reason we often recommend them after a cleanup.
The real method, in the order it works.
Update Funnel Builder to 3.15.0.3 or later if you use it, and update every other plugin.
List every script your checkout loads and remove anything you cannot explain.
Check plugin settings that accept custom scripts, plus checkout template files like form-checkout.php.
Look for hidden plugins, unknown admin users and new PHP files in uploads.
Change admin, hosting and payment provider API credentials.
Tell your payment provider what happened and follow their guidance.
Monitor the checkout for new scripts so a reinfection is caught in hours, not months.
How we handle it
This page draws on public research from Sansec, Sucuri and Wordfence on WooCommerce skimmers. The common thread in their cases is that the store itself kept working perfectly, orders came in, and the owner only found out when customers or the bank complained. That is why our store care includes watching which scripts load on checkout, not just whether the site is up.
Written by Ali Yasin Jatoi
Founder of WebCare Studios. Ali has worked with WordPress for more than 10 years, including managing a Pearl Lemon internal fleet of 150+ sites with WP-CLI automation for updates, security cleanup, and malware removal. He has hands on experience across major hosts including Cloudways, A2 Hosting, Hostinger, and Bluehost.
Site down, hacked, or broken checkout gets a senior engineer within 4 hours. No ticket queues, no bots.
Flat quote up front. If we cannot get you back online, you do not pay. Risk sits with us, not you.
We work on a snapshot first and never touch your live database until the fix is verified safe.
Our founder managed 150+ Pearl Lemon internal WordPress sites. The errors you are seeing are ones we have closed hundreds of times.
If you can confirm a skimmer is live, pausing checkout until it is removed stops more customers being hit. We can usually leave the rest of the site browsable.
Rules differ by country and by what data was taken. Your payment provider and a legal adviser can tell you what applies to you.
We reply within 8 to 12 hours. Emergency cleanup starts from $249, quoted before we start. Ongoing store care is from $99 a month.
Two fields. Email and your URL. A senior WordPress engineer reads it within minutes and replies on email and WhatsApp with what is wrong and what we will do next.
Real proof and field guides tied to "WooCommerce checkout card skimmer".
