Checkout Guard – Block Fake Orders, Spam & Fraud for WooCommerce

Set Protection Mode to Learning first. Every rule runs and records what it would have caught, but nothing is blocked and no customer is turned away. When the results look right, switch to Enforce.

Around 22,000, bundled with the plugin and based on the public disposable email domains list. The settings screen links to the source so you can check any domain. It is a copy taken when the plugin was released, so it will not match the source exactly.

No. Firefox Relay, Apple Hide My Email and Addy deliver to a real permanent inbox, so blocking them would reject a paying customer. They are excluded from the bundled list.

No. Matching is exact and whole-field, never a substring, so test blocks a customer who types "Test" as their whole name but never affects Testa, Contestabile or Testani. The full list is shown on the settings screen so you can check it before switching the rule on.

Enter *@bad-domain.com on its own line in the email blocklist. That blocks every billing email at that domain, and nothing else. You can also enter the bare domain, bad-domain.com. The difference is precision: a bare domain matches anywhere in the address, so it will also catch someone@notbad-domain.com. The *@ form matches the domain exactly. Prefer the wildcard unless you specifically want the looser match.

Enter two lines: *@bad-domain.com for the domain itself and *@*.bad-domain.com for every subdomain under it, such as mail.bad-domain.com or x.y.bad-domain.com. Neither line touches notbad-domain.com.

The * wildcard stands for any run of characters, and the pattern must match the whole address:

• *@bad-domain.com blocks every address at that domain.
• spam*@bad-domain.com blocks spammer@bad-domain.com but leaves nice@bad-domain.com alone.
• *@*.bad-domain.com blocks every subdomain, such as mail.bad-domain.com, but not bad-domain.com itself.
• *.edu blocks every address ending in that TLD.

Yes. 203.0.113.* covers that whole IPv4 range. Each * stands for one whole number, so 192.168.*.1 covers 192.168.7.1 but not 192.168.7.2, and the first number must be written out. For IPv6, or for ranges that do not end on a dot, use CIDR notation: 203.0.113.0/24, 198.51.100.128/25, 2001:db8::/32. IPv6 addresses match however they are written, so 2001:db8::1 also blocks 2001:0db8:0:0:0:0:0:1.

Yes. Checkout Guard reads forwarded proxy headers by default, so IP rules match the real visitor rather than the CDN edge. If your store is not behind a proxy you can switch that off in Store setup.

Not currently. The country rule is a blocklist: you list the countries to turn away.

Yes. The classic checkout, the WooCommerce Checkout block and express checkouts are all enforced, with one known exception noted below, and the plugin declares HPOS compatibility.

Apple Pay is, including on product and cart pages. The WooCommerce PayPal Payments gateway sends it through WooCommerce's own checkout, so every rule runs and a blocked attempt is stopped before the order is created. Express buttons in general are checked whenever the gateway creates its order through WooCommerce. WooPayments is covered in full: its Apple Pay, Google Pay, Link and WooPay buttons all place the order the same way the Checkout block does, so every rule runs wherever you put the button. A blocked attempt leaves nothing in your orders list. There is one known exception. WooCommerce PayPal Payments has a setting called "Pay Now Experience", which lets customers skip the Order Review page and is switched on for new merchants during its setup. With it on, the PayPal button on a product or cart page builds the order itself without going through WooCommerce's checkout, and Checkout Guard does not see those orders. Support for them is planned. In the meantime, switching "Pay Now Experience" off in the PayPal settings sends those customers through the checkout page instead, where every rule runs. Apple Pay is unaffected either way.

No. Checks run during checkout validation, not on normal browsing, so browsing speed is unaffected. The bundled disposable-domain list is only loaded when you enable it, and the optional deliverability lookup is the only rule that touches the network.

The free attempt limit turns away a source that tries checkout too many times in a short window, which is how card testing looks from the store. Checkout Guard Premium Security also reacts to declined payments, the clearest sign of card testing, and can close checkout for an hour during an attack.

Only if you switch recording on, and it is off by default. When enabled, each blocked attempt (and, in Learning mode, each attempt that would have been blocked) stores the billing email, IP address, first and last name, country, postcode and phone number, the cart total and product IDs, the customer's account if they were logged in, and which rules matched. Repeat attempts from the same source within 10 minutes are kept as one record with a count. Records are deleted automatically after the retention period you choose, 90 days by default. Deleting the plugin from the Plugins screen always removes its tables, including every record of blocked checkouts. Your settings are kept, so a reinstall picks up your rules, unless you switch on Delete settings on uninstall in Store setup. The attempt limit keeps short-lived counters so it can count attempts. They are stored as hashes rather than readable email or IP addresses, and are cleared out daily once their time window has passed. In Premium Security, a shopper blocked for declined payments is listed by IP or email address on the Blocked attempts tab until the block expires, so you can see and lift it.

Checkout itself never calls an outside service, with one exception you switch on yourself: the mail deliverability check looks up the email domain in DNS. Licensing and the Premium Security trial run on Freemius. When you activate the plugin, it asks whether you want to share basic diagnostic information with Freemius, such as your site address, WordPress and PHP versions, and the admin email address, to receive security and feature updates. Skip it and nothing is sent. You can change your mind later from the Plugins screen.

At thewpgarden.com/docs/checkout-guard: setup, plus a guide for each rule.

Open a topic in the WordPress.org support forum. For anything else, contact us.

Yes. You can translate Checkout Guard into your language on translate.wordpress.org.