Stop bots creating draft orders

Change _my_special_cookie to a cookie that loads on your site, such as Google Analytics, Cloudflare, etc. Beware that the bots can simulate cookies too, so expect to review your setting periodically.

add_action( 'init', function() {

	// Target URIs
	$endpoints = [
		'/?wc-ajax=checkout',
		'/?wc-ajax=ppc-approve-order',
		'/?wc-ajax=ppc-create-order',
		'/?wc-ajax=ppc-data-client-id',
		'/?wc-ajax=update_order_review',
		'/checkout',
		'/checkout/',
		'/wp-json/wc/store/cart',
		'/wp-json/wc/store/checkout',
	];
	if( empty( $_SERVER['REQUEST_URI'] ) || in_array( $_SERVER['REQUEST_URI'], $endpoints ) ) {

		// Require A Global Site Cookie
		if( ! is_array( $_COOKIE ) || ! array_key_exists( '_my_special_cookie', $_COOKIE ) ) {
			wp_die( 'Suspicious activity detected.' );
		}
	}

}, 10 );