Checkout Origin Guard

Checkout Origin Guard protects your WooCommerce store from fake, fraudulent, or automated checkout attempts by identifying and blocking abusive origins before they clutter your order table or your logs. The plugin runs client-origin heuristics, IP controls, and sequence analysis to detect non-human traffic and suspicious behavior at checkout. It adds Company Shield for business and email sanity checks and an optional AVS “U” signal handler for gateways that report “Address not checked / unavailable”. All controls live on a single admin screen; you can adjust sensitivity, manage allowlists and blocklists, and review traffic logs in one place. Three layers of protection

1. Bot Block (traffic level)\ Detects and throttles abusive requests before they become orders:
2. Analyzes user agents, referrers, and known bot signatures
3. Counts final checkout submissions in fixed one-minute windows for classic AJAX and Checkout Blocks
4. Supports monitor, soft, and hard blocking modes
5. Built-in allowlist for search engines, uptime monitors, and core WordPress services
6. Company Shield (checkout level)\ Validates business identity and email quality at checkout:
7. Flags suspicious or synthetic business names
8. Detects repeated syllables, odd vowel ratios, and gibberish patterns
9. Identifies disposable email domains and role-based accounts (admin, info, sales, etc.)
10. Can run in:
11. Monitor; log and annotate orders
12. Soft; create the order and automatically place it on hold or pending
13. Hard; block checkout with a user-facing error message
14. Payment AVS signals (post-payment; optional)\ For gateways that expose AVS results in order meta, Checkout Origin Guard can treat “AVS: U; unavailable / not checked” as a risk signal:
15. Does not change how your gateway authorizes or captures payments
16. Can be configured to:
17. Ignore the signal
18. Add an order note only
19. Add an order note and bump a risk-score meta field
20. Put the order on hold for manual review
21. Uses flexible pattern matching; can scan specific gateway meta keys or fall back to scanning all order meta for common “AVS: U” messages such as the PayPal string
22. Off by default; you opt in and choose the behavior

Key Features

• 🛡️ Bot Block; Detects and blocks automated bots by analyzing user agents, referrers, and checkout behavior patterns.
• ⚡ Checkout Attempt Limits; Scores more than ten final order submissions from one IP within a fixed minute, without counting cart refreshes, coupon changes, or payment callbacks.
• 🧠 Company Shield; Reviews configured deny fragments, disposable email domains, and corroborating company-name patterns at checkout.
• 🌎 Allowlist Controls; Preserve access for search engines, uptime monitors, and essential WordPress and WooCommerce services.
• 🔒 Hard / Soft / Monitor Modes; Choose between logging only, soft blocking, or full hard blocking.
• 🧾 AVS “U” Risk Signals (optional); Treat “Address not checked / unavailable” as a post-payment risk signal; add notes, increase risk score, or hold the order.
• 🗂️ Log Viewer; See activity including timestamps, IPs, user agents, paths, and detection outcomes.
• 🧩 One-Page Dashboard; Configure settings, review logs, and manage allow/deny lists from a single screen.
• 🚫 Manual Block / Unblock; Instantly remove or restore access for specific IPs with one click.
• 💾 CSV Export; Download checkout-origin activity logs for security review or record keeping.

Why Online Shops Need it WooCommerce checkouts are frequent targets for:

• Card testing and BIN probing
• Fake business registrations and spam accounts
• Automated scripts hammering your checkout endpoints

Checkout Origin Guard focuses on checkout behavior and identity quality, not just generic firewall rules. It helps you:

• Reduce chargeback and fraud risk
• Keep your order list clean and reviewable
• Shorten the time spent cleaning up junk orders and bogus signups

The plugin works alongside any existing firewall, CDN, or WAF; it does not rely on external APIs or subscriptions. All data stays on your server. Use Cases

• Prevent card testing or order spam
• Review orders with suspicious company names and email addresses
• Detect rapid repeat checkout attempts from the same IP
• Block suspicious POST requests that hit checkout endpoints
• Add an extra layer of review for orders where the gateway reports “AVS unavailable / not checked”
• Maintain cleaner order history and logs for real customers

Traffic protection and checkout compatibility Monitor records traffic without enforcing score-based limits. Soft block returns HTTP 429 for scores of 60 or higher. Hard block returns HTTP 429 for scores of 60–79 and HTTP 403 for scores of 80 or higher. The separate Block Common Exploits setting is enabled by default and returns 403 for recognized sensitive-file, ALFA, and PHP-CGI probes in every mode, before allowlists. This protection applies only to requests that reach WordPress. Classic checkout submissions and POST requests to the Store API checkout route are counted separately from ordinary browsing. More than ten submissions from the same IP within a fixed minute receive a high-risk score. GET/PATCH draft updates, cart refreshes, coupon requests, and gateway callbacks are excluded from this checkout-attempt limit. WooCommerce retains responsibility for nonce/cart-token validation and payment processing. Company Shield supports classic checkout and Checkout Blocks. A lowercase name, missing referrer, role-based email address, or non-Latin company name alone does not reject or hold an order. Configured deny fragments, disposable domains, or multiple corroborating company-pattern signals can trigger the selected mode. Soft mode requests manual review; when payment advances a flagged order to processing/completed, it is placed on hold once. Staff can subsequently release it. This does not reverse or prevent an authorized payment. Traffic logs include rule matches, crawler classification, request body type, and observed HTTP status in the dashboard and CSV export. The homepage is shown as /, and checkout routing is retained without recording arbitrary query strings, request bodies, or payment details. Logs are automatically retained for 30 days by default, configurable from 7 to 90 days. Older entries have blank values for the new details. If your store is behind a CDN or reverse proxy, configure its actual connecting IP addresses or IPv4 CIDRs in Trusted proxies before enabling traffic blocking. Forwarded client-IP headers are ignored for untrusted peers. With no trusted proxies configured, the connecting address is used. Use Monitor to verify client addresses and legitimate checkout behavior before enabling enforcement.

1.8.0

• Added final-checkout attempt limits for classic AJAX and Checkout Blocks with fixed one-minute windows.
• Added verified search crawler handling and exploit detection before allowlisting.
• Removed hard rejections based solely on missing origin data or lowercase names; preserved email checks when company names are allowed.
• Added trusted proxy controls, richer traffic logs and CSV exports, privacy information, and scheduled log retention.
• Preserved admin bypass, payment callback handling, AVS options, and user-profile IP controls.

1.7.3

• Prevented Bot Block from interrupting WooCommerce checkout and payment AJAX transport requests that can surface as generic payment-source errors.

1.7.2

• Hardened admin input handling for allowlists, blocklists, disposable-domain patterns, and emergency bypass activation.
• Reduced repeated runtime work by caching normalized settings and precompiled path allow rules during each request.
• Expanded settings-page guidance so advanced Company Shield thresholds are easier for non-technical store owners to tune safely.

1.7.1

• Added two high-signal checker heuristics: all-lowercase billing first+last name; and unknown checkout origin (no referrer and no UTM).
• When triggered, these flags can bump the order risk score meta for faster review and safer automation.

1.7

• Added optional AVS “U” handling as a post-payment risk signal; can add notes, bump a risk-score meta field, or hold orders for review.
• Refined Company Shield heuristics and help text for business and email validation.
• Minor performance and logging improvements in the checkout validation flow.

1.6

• Confirmed compatibility with WordPress 6.9.
• Updated code to align with upcoming WordPress coding and security guidelines.

1.5.3

• Improved IP hard block stability and unblock handling.
• Added real-time log refresh option.
• Enhanced Company Shield heuristics for email and business name detection.
• Unified all settings on one page with persistent values.
• Performance improvements and code cleanup.

1.5.2

• Added CSV export for logs.
• Added referrer and nonce validation checks.
• Expanded allowlist for common search engine bots.

1.5.1

• Fixed settings persistence and default value population.
• Added Populate Defaults button.
• UI refinements and improved table layout.

1.5.0

• Merged “Bad User Patterns” module into core.
• Added company/email heuristics and rate-limit detection.
• New single-page admin interface.