diff --git a/changelog.txt b/changelog.txt
index 20cc3bc..1e8231b 100644
--- a/changelog.txt
+++ b/changelog.txt
@@ -1,5 +1,15 @@
 *** WebDecoy Bot Detection Changelog ***
 
+= 2.3.3 - 2026-07-29 =
+Follow-up to the 2.3.2 safety release. Four WooCommerce and reporting fixes; no behaviour change for anyone not running WooCommerce.
+
+* Fixed (WooCommerce): the 2.3.2 card-testing fix did not apply to stores using Cash on Delivery, Direct Bank Transfer or Cheque. Those gateways never mark an order paid, so no checkout attempt was ever closed and every genuine order kept counting toward card testing and the hourly checkout limit. Whether an order was real is now decided from the order's own status, which every gateway reaches. This completes the fix promised in 2.3.2.
+* Fixed (WooCommerce): a customer retrying a declined card could be mistaken for card testing on their own. Attempts are recorded per checkout submission, and WooCommerce reuses the same order across retries, so several attempts against one order looked like several attacks. The small-amount, decline-count and rapid-succession patterns now need more than one order or more than one card before they fire. Detecting several different cards from one address is unchanged.
+* Fixed (WooCommerce): payment results arriving from a gateway callback — the normal case for redirect and webhook gateways — did not close the checkout attempt they belonged to, because the record was matched on the address of the callback rather than the order. Attempts stayed open and kept counting.
+* Fixed: the cross-site attacker list is read again. In 2.3.2 it was collected hourly and then consulted by nothing, so a Pro site paid for the sync and got no benefit. It now answers "has this address attacked other sites?" for the CRITICAL trap notice, which previously made a live network request while rendering the page.
+* Fixed: two notices claimed an attacker had been blocked network-wide, or would have been blocked on Pro. Neither is true since 2.3.2 stopped the list from blocking anything. They now say the actor is recognised, which is what actually happened.
+* Fixed: the monitor-mode summary could report that nothing had met the bar for enforcement while rate limiting was being withheld on every request. Rate limiting is now included in the count.
+
 = 2.3.2 - 2026-07-29 =
 Safety release. Please update. This version deliberately makes the plugin do LESS by default.
 
diff --git a/readme.txt b/readme.txt
index d73baff..ec9ac3e 100644
--- a/readme.txt
+++ b/readme.txt
@@ -4,7 +4,7 @@ Donate link: https://webdecoy.com
 Tags: security, bot detection, spam protection, woocommerce, firewall
 Requires at least: 6.1
 Tested up to: 7.0
-Stable tag: 2.3.2
+Stable tag: 2.3.3
 Requires PHP: 7.4
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -195,6 +195,16 @@ The bundled good-bot list (sdk/src/GoodBotList.php) stores a documentation URL f
 
 == Changelog ==
 
+= 2.3.3 =
+Follow-up to the 2.3.2 safety release. WooCommerce and reporting fixes.
+
+* Fixed (WooCommerce): the 2.3.2 card-testing fix did not reach stores using Cash on Delivery, Bank Transfer or Cheque — those gateways never mark an order paid, so every genuine order kept counting as a card-testing attempt. Now decided from the order's status, which every gateway reaches.
+* Fixed (WooCommerce): a customer retrying a declined card could look like card testing on their own. The small-amount, decline-count and rapid-succession patterns now require more than one order or more than one card.
+* Fixed (WooCommerce): payment results arriving from a gateway callback did not close the checkout attempt they belonged to, so attempts stayed open and kept counting.
+* Fixed: the cross-site attacker list is actually read again — in 2.3.2 it was synced hourly and consulted by nothing.
+* Fixed: two notices claimed an attacker was blocked network-wide, or would be on Pro. Neither has been true since 2.3.2 stopped that list from blocking. They now say the actor is recognised.
+* Fixed: the monitor-mode summary no longer reports that nothing met the bar for enforcement while rate limiting is being withheld.
+
 = 2.3.2 =
 Safety release — please update. This version deliberately makes the plugin do less by default.
 
diff --git a/webdecoy.php b/webdecoy.php
index 5e57a76..fb34c4c 100644
--- a/webdecoy.php
+++ b/webdecoy.php
@@ -3,7 +3,7 @@
  * Plugin Name: WebDecoy Bot Detection
  * Plugin URI: https://webdecoy.com/wordpress
  * Description: Protect your WordPress site from bots, spam, and carding attacks with WebDecoy's advanced threat detection.
- * Version: 2.3.2
+ * Version: 2.3.3
  * Requires at least: 6.1
  * Requires PHP: 7.4
  * Author: WebDecoy
@@ -41,7 +41,7 @@ function str_starts_with(string $haystack, string $needle): bool
 }
 
 // Plugin constants
-define('WEBDECOY_VERSION', '2.3.2');
+define('WEBDECOY_VERSION', '2.3.3');
 define('WEBDECOY_PLUGIN_FILE', __FILE__);
 define('WEBDECOY_PLUGIN_DIR', plugin_dir_path(__FILE__));
 define('WEBDECOY_PLUGIN_URL', plugin_dir_url(__FILE__));