OrderGuard

Stop risky uncollected orders and serial returners before you ship. OrderGuard relies on an external cloud service (api.orderguard.net) to work — the risk scores come from a network shared between merchants. Full details of what is sent and when are in the External services section below. Powered by a shared merchant network, OrderGuard shows collection and return risk before you ship. Built-in automations save time and protect your margins — without slowing down reliable customers. Cash on delivery loses money two ways: parcels that are never collected, and orders that come straight back as returns. OrderGuard scores both — so you can spot the no-shows and the serial returners before a parcel goes out. When an order arrives, OrderGuard shows two numbers right inside the WooCommerce order: a collection risk and a return risk. Every order with a usable phone number or email is checked, not only cash-on-delivery ones — except for customers on your exclusion list, who are never checked and never sent — the scores matter most for COD, but a serial returner is worth knowing about whatever they paid with. You decide what to do — ship as normal, confirm by phone, or offer prepayment instead. OrderGuard never cancels or holds an order by itself. Privacy-first by design Phone numbers and email addresses are converted into SHA-256 hashes inside your own website, before anything is transmitted — these contact fields leave your site only as hashes, and the raw values never reach OrderGuard's servers. The service also receives the order facts listed below, such as status, outcome, billing country and references; those facts may be sent even when no usable contact hash can be produced. Names, customer IP addresses, street addresses, cities or regions, postal codes, order amounts and payment-card or payment-credential details are never transmitted. Two things we would rather state plainly than gloss over. Those hashes are pseudonymous data, not anonymous data. And if you flag or block a customer, their name, email and phone are stored locally, on your own site, so that your blocked-clients list is readable by you — that data stays on your server and is not sent to OrderGuard. What you get When WordPress completes a customer erasure, OrderGuard deliberately keeps any matching entry in the store’s exclusion list. That minimal local suppression record is retained so the store continues to honour the person’s request and does not send their later data back to the network. An administrator may remove the exclusion separately after considering the store’s legal obligations.

• Collection risk and return risk on every COD order, from a shared merchant network.
• Serial-returner detection — a first-time buyer with a poor return record shows up before you ship.
• Report or block a customer at three levels: report (a private record on your own site — and a signal to the network too, but only if you switch Merchant Signals on, which is off by default), block cash on delivery only (they can still order, but prepaid), or block entirely.
• Automatic COD hiding (optional, off by default) — hide cash on delivery at checkout when a customer crosses the limits. On the free plan the limits are fixed defaults (5 not-collected parcels or 12 returns); setting your own limits is a Pro feature. Works on both the classic and the block-based checkout.
• Courier delivery sync — reads tracking data made available by courier integrations. Courier adapters are included for Econt, Speedy, BOX NOW and Pigeon Express. Live-store verification has covered Econt through mreja.net's WooCommerce Econt plugin, Speedy through Extensa's woocommerce-speedy plugin, and BOX NOW. Econt's official plugin, Econt and Speedy through Bulgarisation, and Pigeon Express have not yet been verified on a live store. API-based adapters query the courier directly; the mreja.net WooCommerce Econt adapter reads that plugin's local tracking tables. When the available data gives an unambiguous final result, OrderGuard records the shipment as kept, returned or not collected instead of inferring the outcome from order statuses alone. Anything unclear is left open and re-checked later.
• Order history import — checks your last 24 months of orders in the background, so the scoring is useful from day one.
• Insights — local activity counts showing what the plugin checked, flagged or blocked.

How the network decides Only resolved order records feed the risk scores: kept, returned or not collected. Their age, the fraction refunded and the amount of resolved history affect the numerical result. A courier-reported result can settle what an order's outcome was, but it feeds that same order record — it is not a separate scoring input. Merchant reports never change the risk score at all: they are shown alongside it as a separate advisory count, and in the order panel, reports from other stores are shown only after at least two independent stores agree — so a single mistaken report can never follow a shopper elsewhere. Cross-store sharing of flag/block marks ("Merchant Signals") is free, off by default, and requires the merchant's deliberate opt-in. Free and Pro The Free plan includes the core features above, including automatic COD hiding with fixed limits. OrderGuard Pro is a separate add-on (installed from orderguard.net) that adds live re-scoring on the order screen and custom risk thresholds. The free plugin contains no locked code.

0.3.2

• Changed: the Plan tab's Pro add-on button is now a plain link to the downloads page on orderguard.net, where Pro customers request a download link by e-mail and install the add-on manually. The plugin no longer requests a download link from OrderGuard's server.

0.3.1

• Fixed: on phones the settings tab bar ran off the screen, so Support, Legal and the language menu could not be reached. The tabs now wrap onto a second line at any width.
• Features cards now appear in the order Merchant Signals, Flag for review, Courier delivery sync, Order-card scoring.
• Fixed: the empty Blocked and Flagged lists now show a full sentence in both languages.
• Bulgarian legal-document links now use the site's /bg/ addresses.
• Fixed: Manage subscription, Cancel and Update payment method open Paddle's customer portal again; invoices now download as a PDF through OrderGuard's server instead of opening a provider link.
• The Plan tab shows changes made in the billing portal sooner, and an issued but unpaid invoice is labelled Issued instead of Paid.
• New: OrderGuard → Legal builds the text for your store's privacy notice from the features you have switched on, with a Copy text button. The same text appears in Settings → Privacy → Policy Guide. One dismissible reminder on OrderGuard screens stays until an admin marks the text as added. OrderGuard never edits your privacy page.
• Redesigned the Plan tab for Free stores: choose monthly (€8) or yearly (€46) billing, then continue to the secure checkout on orderguard.net, with a Free and Pro comparison. The exact amount, including any VAT, is shown at checkout.
• Redesigned the Support tab: the community forum and Pro priority support side by side, with what support covers. If support cannot be opened, the Support tab now shows a message instead of an error page.
• Fixed: the Download OrderGuard Pro button now keeps its white text on hover, and the Courier delivery sync switch is now grey when off.

0.3.0

• Moves OrderGuard personal-data erasure onto the reviewed owned-storage engine. Existing stores require a supervised cutover after their workers are stopped; fresh stores activate the new engine during plugin activation.
• Exclusion checks now fail closed, signal changes use a durable outbox, and uninstall refuses while protected privacy work is unfinished or its authority records are damaged.
• New Support tab for contacting OrderGuard support in Bulgarian or English, Monday to Friday. No system data is sent automatically. Pro includes priority support.
• Start an upgrade to Pro from the Plan tab.
• Guided recovery for eligible interrupted customer erasures, with owner approval handled by OrderGuard and an attention page under Tools.
• Clearer erasure screens and messages, with Bulgarian translations.

0.2.23

• WordPress.org resubmission hardening: stored-data, scheduled-work and configuration identifiers now use the full OrderGuard namespace throughout the public plugin.
• The public package contains no private migration code. Existing private pilot stores use a separately controlled compatibility build to copy and verify their earlier rows before that schema is retired.
• Clarified that customer contact hashes leave the store in pseudonymous, non-readable form rather than implying that no customer-derived data is transmitted.

0.2.22

• Admin scripts and styles are now loaded through WordPress's enqueue APIs instead of being printed inline.
• Existing Free-plugin settings are carried forward automatically to the renamed storage keys during the update.
• Renamed scheduled tasks are repaired during the update. If an older history import was left running without a pending batch, OrderGuard may restart it after a safety delay of at least five minutes, using its saved position when one exists or starting from the beginning otherwise.
• Courier identifiers are now normalized consistently. Stores that previously recorded courier health or resume state under a non-standard identifier may rebuild those local counters once after updating; recorded order outcomes and customer data are unaffected.

0.2.21

• The order panel now shows what your own records say about a customer — imported order history included — alongside the network view. Your own evidence no longer hides behind withheld network counts.
• When your own records show enough not-collected or returned orders, that now surfaces where you already look: as a badge in the orders list, in the Review queue, and — on a new cash-on-delivery order — as a private order note. These are your own numbers, read from your own records — nothing new is sent anywhere.
• The "detailed counts stay locked" note now says what actually lifts the lock, instead of promising that a customer's first order will unlock the counts when your imported history already holds their completed orders.

0.2.20

• The order panel no longer says a customer is "new to the network" when OrderGuard has actually seen their orders but none of them reached a result it can score. It now tells you which of the two it is looking at.

0.2.19

• Bulgarian stores: the "no history yet" note in the order panel was showing in English. It is now translated like the rest of the panel.

0.2.18

• A customer OrderGuard has no history for no longer shows as a green 0. The score cards now show a dash, because a zero and "nothing to go on" are not the same thing. Customers with a real record are unaffected.
• If you have flagged or blocked a customer yourself, the order panel now says so at the top instead of only further down.

0.2.17

• The privacy disclosure you can copy from the Legal tab now includes a link to OrderGuard's own privacy policy, so your customers can read it directly.

0.2.16

• Order-history import now skips orders that ended without a usable outcome (failed, abandoned, or cancelled without a refund). Previously such orders created records that could never resolve and were re-checked every hour forever.

0.2.15

• Debug logging no longer records a full billing URL. No change to how the plugin behaves.

0.2.14

• Documentation corrections and clearer diagnostics. No change to how the plugin behaves.

0.2.13

• Hardening: the billing links on the Plan tab are now checked against an allowlist before your browser follows them.

0.2.12

• Upgrading to Pro now opens orderguard.net rather than a checkout inside your dashboard. No payment script loads in your admin.

0.2.11

• OrderGuard no longer writes diagnostic lines to your server's error log unless WP_DEBUG is switched on.

0.2.10

• Code quality pass for the WordPress.org review. No change to how the plugin behaves.

0.2.9

• Housekeeping only. No change to how the plugin behaves.

0.2.8

• If you subscribe to OrderGuard Pro, the Plan tab now has a Download button for the add-on, so you no longer have to ask us for the file.

0.2.7

• New Data removal card on the Account tab. Choose whether the data OrderGuard keeps on your site is kept or deleted if you ever delete the plugin. Off by default, so deleting the plugin keeps everything unless you deliberately switch it on. Deactivating never deletes anything.
• If you have subscribed to Pro but have not installed the add-on yet, OrderGuard now tells you and points you to the download.

0.2.6

• Cash-on-delivery hiding now works on the block-based (Gutenberg) checkout for manually blocked customers, with the same explanation the classic checkout shows.

0.2.5

• New Merchant Signals card: cross-store sharing of flag/block marks is free, off by default and opt-in.
• Flag retractions are no longer swallowed when cross-store sharing is switched off.
• Legal documents updated and language-aware links added.

0.2.4

• Fixed: a blocked customer could still see cash on delivery in a fresh browser session.
• Phone matching now recognises the same number written in different formats.

0.2.0

• Free / Pro split. The free plugin is complete on its own; Pro is a separate add-on.