[cport1]

Classic WooCommerce checkout silently skipped WebDecoy validation and attempt tracking when WordPress loaded WebDecoy before WooCommerce. The constructor checked class_exists('WooCommerce') before WooCommerce's entry point ran. Register these callbacks on plugins_loaded after includes load, while retaining the checkout-protection option gate. Release version: 2.10.6.

Validation: 205 dependency-free tests pass; PHP lint and shell syntax pass. The WooCommerce compatibility smoke script now asserts all three classic callbacks exist. In an isolated WordPress 7.1 / WooCommerce 11.2.1 / PHP 8.3 store, classic checkout initially accepted all four synthetic decline attempts; after the fix, attempts 1–3 reached the local decline gateway and attempt 4 was refused with “Suspicious checkout activity detected.” An independent Blocks run likewise refused attempt 4 with webdecoy_carding / 403. Separate offline normal test orders completed on both paths. No payment processor or real card was used.