Checkout Origin Guard

Key Features

• 🛡️ Bot Block ; Detects and blocks automated bots by analyzing user agents, referrers, and checkout behavior patterns.
• ⚡ Checkout Attempt Limits ; Scores more than ten final order submissions from one IP within a fixed minute, without counting cart refreshes, coupon changes, or payment callbacks.
• 🧠 Company Shield ; Reviews configured deny fragments, disposable email domains, and corroborating company-name patterns at checkout.
• 🌎 Allowlist Controls ; Preserve access for search engines, uptime monitors, and essential WordPress and WooCommerce services.
• 🔒 Hard / Soft / Monitor Modes ; Choose between logging only, soft blocking, or full hard blocking.
• 🧾 AVS “U” Risk Signals (optional) ; Treat “Address not checked / unavailable” as a post-payment risk signal; add notes, increase risk score, or hold the order.
• 🗂️ Log Viewer ; See activity including timestamps, IPs, user agents, paths, and detection outcomes.
• 🧩 One-Page Dashboard ; Configure settings, review logs, and manage allow/deny lists from a single screen.
• 🚫 Manual Block / Unblock ; Instantly remove or restore access for specific IPs with one click.
• 💾 CSV Export ; Download checkout-origin activity logs for security review or record keeping.

Why Online Shops Need it

WooCommerce checkouts are frequent targets for:

• Card testing and BIN probing
• Fake business registrations and spam accounts
• Automated scripts hammering your checkout endpoints

Checkout Origin Guard focuses on checkout behavior and identity quality , not just generic firewall rules. It helps you:

• Reduce chargeback and fraud risk
• Keep your order list clean and reviewable
• Shorten the time spent cleaning up junk orders and bogus signups

The plugin works alongside any existing firewall, CDN, or WAF; it does not rely on external APIs or subscriptions. All data stays on your server.

Use Cases

• Prevent card testing or order spam
• Review orders with suspicious company names and email addresses
• Detect rapid repeat checkout attempts from the same IP
• Block suspicious POST requests that hit checkout endpoints
• Add an extra layer of review for orders where the gateway reports “AVS unavailable / not checked”
• Maintain cleaner order history and logs for real customers

Traffic protection and checkout compatibility

Monitor records traffic without enforcing score-based limits. Soft block returns HTTP 429 for scores of 60 or higher. Hard block returns HTTP 429 for scores of 60–79 and HTTP 403 for scores of 80 or higher. The separate Block Common Exploits setting is enabled by default and returns 403 for recognized sensitive-file, ALFA, and PHP-CGI probes in every mode, before allowlists. This protection applies only to requests that reach WordPress.

Classic checkout submissions and POST requests to the Store API checkout route are counted separately from ordinary browsing. More than ten submissions from the same IP within a fixed minute receive a high-risk score. GET/PATCH draft updates, cart refreshes, coupon requests, and gateway callbacks are excluded from this checkout-attempt limit. WooCommerce retains responsibility for nonce/cart-token validation and payment processing.

Company Shield supports classic checkout and Checkout Blocks. A lowercase name, missing referrer, role-based email address, or non-Latin company name alone does not reject or hold an order. Configured deny fragments, disposable domains, or multiple corroborating company-pattern signals can trigger the selected mode. Soft mode requests manual review; when payment advances a flagged order to processing/completed, it is placed on hold once. Staff can subsequently release it. This does not reverse or prevent an authorized payment.

Traffic logs include rule matches, crawler classification, request body type, and observed HTTP status in the dashboard and CSV export. The homepage is shown as /, and checkout routing is retained without recording arbitrary query strings, request bodies, or payment details. Logs are automatically retained for 30 days by default, configurable from 7 to 90 days. Older entries have blank values for the new details.

If your store is behind a CDN or reverse proxy, configure its actual connecting IP addresses or IPv4 CIDRs in Trusted proxies before enabling traffic blocking. Forwarded client-IP headers are ignored for untrusted peers. With no trusted proxies configured, the connecting address is used. Use Monitor to verify client addresses and legitimate checkout behavior before enabling enforcement.

Credits

Developed by Michael Winchester For documentation and updates, visit https://michaelwinchester.com