Is your WooCommerce abandoned cart plugin counting fake (bot) carts?

Your dashboard says you had 4,000 abandoned carts this month — on a store with 200 products and a few hundred real visitors. The math doesn't work, the "recovered revenue" doesn't match your actual sales, and you can't trust the ROI. You're not crazy: most of those carts were never real people. Here's why it happens, the partial fixes, and how to count only genuine abandons.

Short version: Bots and scripts hit add-to-cart directly, without browsing. WooCommerce opens a session, and most abandoned-cart plugins log it as an abandoned cart — inflating your numbers. There's no native WooCommerce setting to keep them out. Partial filters (IP/country exclusion, tracking only from the checkout email step, bot blockers) help but miss direct-API hits. The reliable fix is session-verified tracking — only counting a cart when there's proof of a real human session.

Why fake carts show up

Bots, scrapers and security scanners trigger add-to-cart requests directly — often hundreds a day — without ever loading a product page like a shopper would. WooCommerce starts a session for each, and abandoned-cart plugins that track "any cart" record them as abandoned. It's a well-known problem: see WooCommerce core issue #25721 ("Bots creating hundreds of abandoned carts") and the blunt "Faker than fake" plugin review. On a small store, fake carts can outnumber real ones many times over.

Why it actually matters

The partial fixes (and why they're not enough)

  1. Track only from the checkout email step (not the cart page). Helps — but you lose real early abandons, and bots that reach checkout still slip through.
  2. Exclude bot IPs / countries. A moving target; new IPs appear daily and direct-API hits rotate.
  3. Add a bot blocker (e.g. Blackhole for Bad Bots). Useful site-wide, but not built to clean your abandoned-cart data specifically.

None of these distinguish a real shopping session from a scripted one — which is the actual thing you need.

The reliable fix: session-verified tracking

Instead of counting every cart, count a cart as a real, recoverable abandon only when there's evidence of a genuine human session: proof that JavaScript actually ran (a session-bound, signed token), a prior page view, human interaction, realistic timing. Carts with none of that — typically bots and direct-API calls — go into a separate, clearly labelled bucket instead of polluting your funnel. Then recovered revenue is reconciled against actually-paid orders, so the number on your dashboard matches the money in your store.

That's exactly what Cartright does

Cartright is a WooCommerce abandoned-cart recovery plugin built around data you can trust: session-verified tracking (bots filtered into a transparent "why it wasn't counted" bucket), recovered revenue reconciled to real paid orders, and recovery emails sent through your own SMTP — no per-email fee, no third-party sending. Free core, no nag banners, no phone-home. Pro is a one-time Lifetime licence — no monthly SaaS.

Get Cartright free on WordPress.org See Pro (Lifetime)

FAQ

Why does my plugin show fake abandoned carts?

Bots hit add-to-cart directly without browsing; WooCommerce opens a session and most plugins record it as an abandoned cart. There's no native setting to keep them out.

How do I stop bots creating carts?

Partial fixes (track from checkout email, exclude IPs, bot blockers) help but miss direct-API hits. Session-verified tracking — counting only carts with proof of a real human session — is the reliable fix.

Why don't the recovered-revenue numbers match my sales?

Loose attribution counts sales that would have happened anyway, or without a valid recovery token. Reconciling recovered revenue against actually-paid orders fixes it.

Which plugin only counts real carts?

Cartright uses session-verified tracking and reconciles revenue to real orders — free on WordPress.org.

Related: WooCommerce abandoned cart plugin comparison (Cartright vs Retainful, FunnelKit & CartBounty) →