HIFQA Fraud Detector for WooCommerce

开发者	dilrubaummer
更新时间	2026年10月13日 05:51
PHP版本:	8.0 及以上
WordPress版本:	7.1
版权:	GPLv2 or later
版权网址:	版权信息

下载

1.0.0

详情介绍:

HIFQA Fraud Detector scores every WooCommerce order against 17 weighted fraud signals (disposable emails, address mismatches, card testing patterns, and more) the moment it is placed. The local scoring engine is pure PHP, requires no setup, and sends no data anywhere — it works immediately after activation. Each order gets a score from 0 to 100 and one of three decisions:

Allow — the order continues normally.
Review — the order continues, a note is added and the store admin is emailed.
Block — the order is put on hold and the store admin is emailed. It stays on hold until you release it.

For stores that want deeper protection, two optional layers can be enabled separately — each stays off until you enter that service's API key in Settings:

Vector pattern memory — compares the order's pattern of signals with known fraud patterns stored in your own Pinecone index (requires a Pinecone account and an embedding provider).
AI reasoning layer — asks OpenAI, Anthropic, Google Gemini, or an Ollama server you run yourself for a second opinion and a plain-English explanation (requires an API key from your chosen provider, or an Ollama host).

How the AI layer is kept in check The local score is the baseline, and an AI reply is treated as untrusted input:

An order the local rules block stays blocked. The AI layer can add its explanation but cannot lower the decision or the score. Only you can release a blocked order.
The AI layer can raise a decision (for example Review to Block). It can also lower a local Review to Allow — if you never want that, leave the AI layer off.
A reply with a missing or unexpected decision, or a score that is not a number, counts as a failed call. Scores are limited to 0–100 and the decision is re-derived from the score using your thresholds.
A failed AI call never marks an order as passed. The order keeps its local result and the order note says the AI layer was unavailable.

What the optional layers cost you at checkout The optional layers contact the external service while the order is being placed, so checkout waits for the reply. A slow provider means a slower checkout, and the AI layer can make several requests for one order. If a service fails or times out, the order is scored by the local rules alone. After three failures in a row a layer pauses itself for ten minutes. With both layers off, no external request is made at all. Compatibility

WooCommerce High-Performance Order Storage (HPOS).
Both the classic checkout and the block-based checkout.

Source code The admin dashboard is built from the unminified source in the src/ folder of this plugin. The full development repository, including the build tooling, is at https://github.com/dilrubaummer/hifqa-fraud-detector

安装:

Upload and activate the plugin. WooCommerce must be active.
Local fraud scoring is active immediately — no setup required.
(Optional) Go to HIFQA → Settings to enable Vector Memory or AI Reasoning. Each activates only once you save its API key; leave the key field blank to keep the layer off.

屏幕截图:

升级注意事项:

1.0.0 Initial release.

常见问题:

Does this work without any API keys?

Yes. Local signal scoring runs on every order automatically with no external service required.

What happens if my AI provider is slow or stops working?

The optional layers are called while the order is being placed, so a slow provider makes checkout slower for that order. If the provider fails or times out, the order is scored by the local rules instead and the order note says so. After three failures in a row the layer is paused for ten minutes, and orders during that time are scored locally without waiting. A provider outage never causes an order to be marked as passed by the AI layer.

Can the AI layer approve an order that the local rules blocked?

No. A local block stays a block. Only you can release it, from the HIFQA dashboard.

Is customer data shared with anyone by default?

No. Out of the box, all scoring runs locally on your own server and no order data leaves your site. Data is sent to a third party only after you save that service's API key in Settings. See the External services section for exactly what is sent to each one.

Where are my API keys stored, and who can see them?

Keys are stored in your site's database as plugin options. Once saved, a key is never shown again in the Settings page — the field stays empty. Leave it empty to keep the saved key, type a new key to replace it, or tick "Remove the saved key" to delete it.

I use Anthropic. Why is vector memory not running?

Anthropic has no embedding model. Add a Voyage AI key in Settings to use vector memory with Anthropic. The plugin will not send your data to a different provider instead.

What is removed when I delete the plugin?

Deleting the plugin removes its settings, saved API keys, learned signal weights and counters. Your orders are not touched, and the fraud result saved on each order (score, decision, reason) stays with the order as part of its history. Patterns stored in your Pinecone index stay in your Pinecone account until you delete them there.

更新日志: