Predax Fraud Guard is anti-fraud for WooCommerce: it stops fake orders, card testing and chargebacks before the order exists. Card testers and stolen-card fraudsters typically check out from behind a VPN, proxy, Tor or datacenter IP. Fraud Guard screens the customer’s IP at checkout and scores its f
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 5.8 and PHP 7.4.
SourceWordPress plugins · Nov 13, 2026
01 / Source details
Aboutthistool.
Predax Fraud Guard is anti-fraud for WooCommerce: it stops fake orders, card testing and chargebacks before the order exists. Card testers and stolen-card fraudsters typically check out from behind a VPN, proxy, Tor or datacenter IP. Fraud Guard screens the customer’s IP at checkout and scores its fraud risk from 0 to 100, and for each rule you choose what happens. Block refuses the checkout before payment is taken, so a blocked attempt never becomes a gateway fee or a chargeback. Hold lets the payment go through and keeps the order on hold for your review, so nothing ships until you decide. Or simply tag the order. Works with any payment gateway and with both the classic and block checkout.
See what Predax knows about your own IP — free, no signup.
Off by default. A fresh install sends nothing anywhere. Connect your Predax key and choose a protection mode; until then the plugin does nothing.
What it stops
Card testing — bots running stolen card numbers through your checkout in bulk
Orders from VPNs, proxies, Tor and datacenter IPs
Too many orders, too fast — velocity rules catch rapid repeat attempts
Billing country that doesn’t match the customer’s real location
Disposable email addresses at checkout
Start in tag-only mode
The default once configured is Tag + note : flagged orders get a “Predax: Medium / High / Critical Risk” tag and an order note, and nothing is blocked. Watch what the rules would have done, then turn on Block high risk or Block critical only when you’re confident. Optionally send high-risk orders to On Hold for review instead of rejecting them: the payment is taken and the order waits for you before anything ships, so you can refund a fraudulent one instead of sending the goods.
Safe for real customers and search traffic
Verified search engines are never blocked by your VPN, datacenter, country or risk rules.
Every decision is on the record. The Events Log shows which orders were tagged, held or blocked, and why — so a too-strict rule shows up in the log, not in falling sales.
One-click allow-listing from the Events Log lets a good customer check out again immediately.
Also included
Risk score, threat flags and country saved on every order for reporting · Refund/chargeback feedback that adds the IP to your deny list · IP and CIDR allow/deny lists · Optional Community Threat Network sharing
Free plan
Click Connect with Predax in the setup wizard and your free account and API key are created for you — nothing to copy or paste. The free plan includes 5,000 IP checks a month with full VPN, proxy, Tor and datacenter detection and risk scoring. No credit card. Checkouts are only checked when they happen and results are cached, so it covers a small store comfortably; busier stores can move to a paid plan — same plugin, same settings, same key.
Christmas offer: sign up before 31 December 2026 and your account starts on the Starter plan (100,000 checks a month, 5,000 a day) free for 2 months. It then moves to the free plan on its own. No card is needed and nothing is ever charged.
Third Party Services
This plugin connects to external services operated by Predax (https://predax.io) only after you have saved an API key: checkout screening additionally requires a protection mode to be enabled, and the admin-side account-usage lookup (described below) sends no visitor data at all. By activating this plugin and entering an API key you agree to the Predax Terms of Service and Privacy Policy .
You are responsible for ensuring your use of customer IP data at checkout complies with applicable privacy laws (including but not limited to GDPR, CCPA) and your own store’s privacy policy. This plugin does not assert PCI-DSS, GDPR, or CCPA compliance on your behalf.
Predax IP Intelligence API
Used to look up a risk score and classification signals for each checkout IP.
Data sent: the customer’s IP address at checkout; the browser-reported IANA timezone string (when available on the classic checkout form — used for the timezone-mismatch signal); your custom scoring weights (only if Custom Scoring is enabled).
What is NOT sent: no billing/shipping names, street addresses, phone numbers, email addresses (only the email’s domain part, and only under the separate Email Domain Screening below), product details, prices, or payment data. The billing-country-mismatch rule compares your order’s billing country against the API’s IP-country result locally — billing details never leave your site.
When: during WooCommerce checkout validation, and only while a protection mode is saved in settings.
Caching: classification results are cached in the site’s transients for between 5 minutes and 1 hour per IP (the lifetime the API recommends), so repeat checkouts from the same IP do not generate duplicate API calls.
Endpoint: POST https://predax.io/api/v1/check/ip
Service URL: https://predax.io
Terms of Service: https://predax.io/terms
Privacy Policy: https://predax.io/privacy
Email Domain Screening (only when the Disposable Email rule is enabled)
Used to check whether the billing email’s provider is a disposable/throwaway service, against a server-side list of thousands of domains (the plugin’s built-in list covers only ~50).
Data sent: the domain part of the billing email address only — for example gmail.com . The email address itself is NEVER sent: the part before the @ does not leave your site, and the mailbox-level checks (role account, random-looking name) run locally in PHP on your own server.
When: during checkout validation, and only while the Disposable Email rule is set to Flag or Block. If the API is unreachable, the plugin falls back to its built-in local list and the checkout proceeds normally.
Caching: email-domain results are cached in the site’s transients for up to 6 hours per domain, so repeat checkouts with the same email provider do not generate duplicate API calls.
Endpoint: POST https://predax.io/api/v1/validate/email
Plan usage: email-domain lookups count against your Predax plan allowance, the same as checkout IP checks. Results are cached per domain for 6 hours and the built-in list is checked first, so in practice this is roughly one lookup per new email provider your customers use.
Service URL: https://predax.io
Terms of Service: https://predax.io/terms
Privacy Policy: https://predax.io/privacy
Account Usage Lookup (admin pages only)
Used to show the “API usage this month” meter on the Fraud Guard settings page, and only when an API key is saved.
Data sent: your Predax API key (as the authentication header). No customer or visitor data is sent.
When: when an administrator views the Fraud Guard settings page. The result is cached for 1 hour, so at most one lookup per hour regardless of admin page views.
Endpoint: GET https://predax.io/api/v1/auth/usage
Service URL: https://predax.io
Privacy Policy: https://predax.io/privacy
Predax Community Threat Network (opt-in, off by default)
The plugin can optionally send an anonymised telemetry signal — the IP address, its risk score and detection flags, its network (ASN) number and name, its country code, and the checkout outcome (allowed / monitored / blocked, or refund/chargeback feedback) — to the Predax Community Threat Network so all participating stores benefit from a shared feed. The Refund / Chargeback Feedback “Log” action reports through this same channel, so it requires this opt-in; its “Blacklist” action updates your local deny list regardless.
This feature is off by default . It is controlled by the ipsentry_woo_community_enabled option, which defaults to 'no' , with a checkbox on the Advanced settings tab. The plugin will not send community-feedback telemetry unless you enable it. Customers’ personal data (names, emails, billing/shipping addresses, order contents) is never included in the telemetry payload.
Endpoint: POST https://predax.io/api/v1/telemetry/event
Service URL: https://predax.io
Privacy Policy: https://predax.io/privacy
OAuth One-Click Connect (optional)
Only triggered when an administrator clicks the Connect with Predax button in the setup wizard. Your browser is redirected to predax.io to authorise the connection, which returns an API key to your site.
Data sent: your WordPress site URL, site name, and a PKCE state/code-challenge pair. No customer data is involved.
When: only during the click-to-connect OAuth flow.
Endpoint: POST https://predax.io/api/v1/oauth/token
Service URL: https://predax.io
Privacy Policy: https://predax.io/privacy
Deactivation Feedback (optional, admin-initiated)
Shown only when an administrator deactivates the plugin from the Plugins screen and chooses to answer the “why are you deactivating?” prompt.
Data sent: the plugin slug, the plugin version, and a single pre-defined reason code you select (e.g. “it blocked real customers”). No site URL, no email address, no visitor data, and no IP address are sent.
When: only when you select a reason and click “Send & deactivate”. Clicking “Skip & deactivate” sends nothing at all.
Endpoint: POST https://predax.io/api/v1/feedback/deactivation
Service URL: https://predax.io
Privacy Policy: https://predax.io/privacy
Cookies set by this plugin
ipsentry_tz — set on WooCommerce checkout pages (only while an API key is configured) via assets/js/ipsentry-woo-tz.js . Stores the customer’s browser-reported IANA timezone (string, max 64 chars). Used server-side for the optional timezone-mismatch fraud rule. Expires after 24 hours ( max-age=86400 ), path=/ , SameSite=Lax , and marked Secure on HTTPS stores. The plugin reads this cookie only at checkout-validation time.
The plugin does not set any advertising, analytics, or tracking cookies.
See it in action
Screenshots & previews.
A fraudulent order stopped at checkout: the customer sees a clear message and the order is never placed.The Fraud Rules settings tab: API key, risk thresholds, and per-signal VPN / proxy / Tor / datacenter rules.Order detail: the Predax risk score, flags, and country appear as an order note and order tags.Orders list: the Predax column shows each order's risk score and top threat flag.Advanced rules: order velocity, billing-country mismatch, disposable-email, and timezone checks.Geo blocking: allow, flag, or block checkout by country, region, or IP / CIDR list.Setup Wizard — pick a fraud protection level (Monitor Only, Recommended, or Strict) in one stepEvents Log filtered by reason — narrow blocked attempts down to a single category, like known-malicious IPsEvents Log with one-click allow-listing — approve a genuine customer's IP straight from the log, without editing a settings field
02 / Source details
Gettingstarted.
From your WordPress dashboard (recommended)
01Make sure WooCommerce is installed and activated.
02Go to Plugins → Add New Plugin in your WordPress admin.
03Search for “Predax Fraud Guard” .
04Click Install Now , then Activate .
05The Setup Wizard launches on first activation. Either click Connect with Predax for OAuth one-click connection, or enter your API key manually.
06Pick a protection preset (Recommended / Strict / Monitor Only). This is the step where you opt in — IP lookups begin after this point.
07Fine-tune individual rules at Fraud Guard → Settings any time.
Manual installation
08Download the plugin ZIP from this page and upload it via Plugins → Add New Plugin → Upload Plugin (or extract the predax-fraud-guard-for-woocommerce folder to /wp-content/plugins/ ).
09Activate the plugin through the Plugins menu and follow the Setup Wizard.
03 / Source details
Frequently asked questions.
How do I stop a card testing attack that’s happening right now?
Enable a blocking mode (the wizard’s Recommended preset blocks risk 50 and above), turn on the order velocity rule, and set VPN, proxy and datacenter to Block. Card-testing bots run from datacenter, proxy and VPN addresses, so these rules cut the attack off at the connection. Every blocked attempt is listed in the Events Log, and because screening runs during checkout validation — before the order reaches your payment gateway — a blocked attempt never becomes a transaction, a gateway fee, or a chargeback.
Does it work with Stripe, PayPal, or my payment gateway?
Yes, with any gateway. Screening runs during WooCommerce’s own checkout validation, before the order is created and before any payment provider is contacted, so it does not depend on which gateway you use. It complements gateway-side screening such as Stripe Radar: your gateway only ever sees the orders that already passed the IP screen.
How is this different from other WooCommerce anti-fraud plugins?
Most anti-fraud plugins score orders using rules about the order itself — mismatched names, order size, email patterns. Predax Fraud Guard adds the signal those rules can’t see: live IP intelligence . It knows whether the customer is connecting through a VPN, proxy, Tor, or a datacenter server right now , backed by a continuously-updated commercial threat database — the same signal used to catch card testing and stolen-card fraud before payment is taken. It works well alongside rule-based fraud plugins and payment-processor screening such as Stripe Radar, and alongside security plugins like Wordfence (which protect your site, not your checkout).
Does the plugin phone home before I finish setup?
No. Before you enter an API key and save a protection mode, the plugin makes zero outbound requests to predax.io. Nothing happens silently on activation.
Will it block legitimate customers?
Only if you enable a blocking mode. Until you complete setup, the mode is Tag only (no blocking — orders just get tags and notes). In the setup wizard, the pre-selected Recommended preset enables blocking of high-risk checkouts (risk score 50+); choose Monitor Only instead if you don’t want any blocking yet — each preset card lists exactly what it switches on.
What is the risk score?
A score from 0 to 100 representing how likely an IP is to be associated with fraud, anonymisation, or abuse. 0 = clean residential IP, 100 = the strongest combination of threat signals (for example a known-malicious IP arriving over an anonymised connection). The score combines VPN/proxy/Tor detection, datacenter identification, historical abuse signals, and geographic heuristics.
Does it work with Cloudflare?
Yes — enable Fraud Guard → Settings → Advanced → “Behind a proxy / CDN” (or the same toggle on the WooCommerce → Predax tab). With it on, the plugin reads the real customer IP from the CF-Connecting-IP / X-Forwarded-For headers instead of the Cloudflare edge IP. It is off by default : when your store connects directly to visitors, trusting those headers would let a customer spoof their IP to bypass fraud checks, so you only turn it on when a proxy/CDN really is in front of your site.
How do I test it without affecting real customers?
Fraud Guard → Settings → Developer tab → enter a Test IP Override. Every checkout is then evaluated as if it came from that IP. A red admin banner reminds you test mode is active. Clear the override before going live.
Use 185.220.101.1 (risk 85, Tor-adjacent) to exercise blocking paths, or 1.1.1.1 to verify pass-through.
What order metadata is stored?
On each tagged order the plugin stores:
_ipsentry_risk_score — numeric risk score (0–100)
_ipsentry_ip — detected customer IP
_ipsentry_country_code — detected IP country code
_ipsentry_flags — comma-separated threat flag list
Does it work alongside the Predax Security plugin?
Yes. The plugins are independent but complementary — Security protects logins and registrations, Fraud Guard protects WooCommerce checkout. Both can share the same API key.
Will this block real customers or hurt my store’s SEO?
Search first: verified search engine crawlers — Googlebot, Bingbot and others confirmed by reverse DNS — are never caught by your category rules, on both the classic and the block-based checkout, so screening does not affect how your store is crawled or indexed.
For customers, the plugin is built so you never have to guess. Start in tag-only mode and watch what your rules would have done in the Events Log before you enable any blocking. Every screening decision is recorded with its reason, and a good customer caught by an over-strict rule can be allow-listed in one click straight from the log. If your store serves audiences where VPN use is common, prefer Monitor mode for the VPN rule.
FinderPress Media Auditor helps site administrators scan for broken images, missing Media Library files, unreachable media URLs, and other media issues across WordPress content. Use it to audit images, video, audio, PDFs, featured images, and attachment files without sending scan data to an external
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
