OrderSieve
Sooner or later every WooCommerce store gets them. Orders from names that are just random letters. A burst of checkouts testing stolen card numbers. Sign-ups from addresses that disappear an hour later. Each one lands in your orders list, sends you an email and throws off your reports. OrderSieve lo
Sooner or later every WooCommerce store gets them. Orders from names that are just random letters. A burst of checkouts testing stolen card numbers. Sign-ups from addresses that disappear an hour later. Each one lands in your orders list, sends you an email and throws off your reports.
OrderSieve looks at every checkout before the order is placed and turns away the ones that were clearly not made by a person. The checks run in the background, so your customers check out exactly as before. The recommended settings are on as soon as you activate the plugin, and you can fine-tune them from one settings tab.
OrderSieve requires WooCommerce 8.0 or later.
What it checks
- A hidden field. The checkout form gets an extra field that people never see. Bots that fill in every field give themselves away. This one needs the classic checkout.
- How fast the checkout was. A person needs a few seconds at least to fill in a checkout form. Checkouts submitted faster than that, 3 seconds by default, are turned away. On the classic checkout the start time is signed and tied to the shopper’s session, so it cannot be forged or reused. On the block checkout it is the moment the shopper first added something to the cart.
- The email address. Addresses from throwaway providers such as mailinator.com or temp-mail.org are rejected, along with any subdomain of them. You can add your own domains to the list.
What happens to a blocked checkout
The shopper sees your rejection message and the order is not placed. On the classic checkout no order is created at all. On the block checkout the check runs before WooCommerce creates a customer account, holds coupons, reserves stock or takes payment. The unfinished order is cancelled and gets a note with the reason, and you are not sent a “Cancelled order” email about it.
With logging on, which is the default, every blocked attempt is logged with the reason, the email address entered and the IP address.
It fails on the safe side
When OrderSieve cannot tell how long a checkout took, for example for a shopper whose cart was started before the plugin was activated, it lets the order through. A lost sale costs more than a stray junk order, so the time check only ever blocks when it is sure.
Keep an eye on what was blocked
Tools → OrderSieve Logs shows the 100 most recent blocked attempts, with the time, the reason, the email address and the IP address. The same entries are in WooCommerce → Status → Logs under the source ordersieve , whether WooCommerce writes its logs to files or to the database. From the logs screen you can clear the log or run the junk order cleanup straight away.
