Title: Checkout Origin Guard Author: POTAR Published: October 9, 2025 Last modified: October 7, 2026 --- Search plugins ![](https://ps.w.org/checkout-origin-guard/assets/banner-772x250.png?rev=3376477) ![](https://ps.w.org/checkout-origin-guard/assets/icon-256x256.png?rev=3375840) # Checkout Origin Guard By [POTAR](https://profiles.wordpress.org/potar/) [Download](https://downloads.wordpress.org/plugin/checkout-origin-guard.1.8.0.zip) * [Details](https://srd.wordpress.org/plugins/checkout-origin-guard/#description) * [Reviews](https://srd.wordpress.org/plugins/checkout-origin-guard/#reviews) * [Installation](https://srd.wordpress.org/plugins/checkout-origin-guard/#installation) * [Development](https://srd.wordpress.org/plugins/checkout-origin-guard/#developers) [Support](https://wordpress.org/support/plugin/checkout-origin-guard/) ## Description **Checkout Origin Guard** protects your WooCommerce store from fake, fraudulent, or automated checkout attempts by identifying and blocking abusive origins before they clutter your order table or your logs. The plugin runs **client-origin heuristics**, **IP controls**, and **sequence analysis** to detect non-human traffic and suspicious behavior at checkout. It adds **Company Shield** for business and email sanity checks and an optional **AVS “U” signal handler** for gateways that report “Address not checked / unavailable”. All controls live on a **single admin screen**; you can adjust sensitivity, manage allowlists and blocklists, and review traffic logs in one place. ### Three layers of protection 1. **Bot Block (traffic level)** Detects and throttles abusive requests before they become orders: 2. * Analyzes user agents, referrers, and known bot signatures * Counts final checkout submissions in fixed one-minute windows for classic AJAX and Checkout Blocks * Supports monitor, soft, and hard blocking modes * Built-in allowlist for search engines, uptime monitors, and core WordPress services 3. **Company Shield (checkout level)** Validates business identity and email quality at checkout: 4. * Flags suspicious or synthetic business names * Detects repeated syllables, odd vowel ratios, and gibberish patterns * Identifies disposable email domains and role-based accounts (admin, info, sales, etc.) * Can run in: - **Monitor**; log and annotate orders - **Soft**; create the order and automatically place it on hold or pending - **Hard**; block checkout with a user-facing error message 5. **Payment AVS signals (post-payment; optional)** For gateways that expose AVS results in order meta, Checkout Origin Guard can treat “AVS: U; unavailable / not checked” as a **risk signal**: 6. * Does not change how your gateway authorizes or captures payments * Can be configured to: - Ignore the signal - Add an order note only - Add an order note and bump a risk-score meta field - Put the order on hold for manual review * Uses flexible pattern matching; can scan specific gateway meta keys or fall back to scanning all order meta for common “AVS: U” messages such as the PayPal string * Off by default; you opt in and choose the behavior ### Key Features * 🛡️ **Bot Block**; Detects and blocks automated bots by analyzing user agents, referrers, and checkout behavior patterns. * ⚡ **Checkout Attempt Limits**; Scores more than ten final order submissions from one IP within a fixed minute, without counting cart refreshes, coupon changes, or payment callbacks. * 🧠 **Company Shield**; Reviews configured deny fragments, disposable email domains, and corroborating company-name patterns at checkout. * 🌎 **Allowlist Controls**; Preserve access for search engines, uptime monitors, and essential WordPress and WooCommerce services. * 🔒 **Hard / Soft / Monitor Modes**; Choose between logging only, soft blocking, or full hard blocking. * 🧾 **AVS “U” Risk Signals (optional)**; Treat “Address not checked / unavailable” as a post-payment risk signal; add notes, increase risk score, or hold the order. * 🗂️ **Log Viewer**; See activity including timestamps, IPs, user agents, paths, and detection outcomes. * 🧩 **One-Page Dashboard**; Configure settings, review logs, and manage allow/ deny lists from a single screen. * 🚫 **Manual Block / Unblock**; Instantly remove or restore access for specific IPs with one click. * 💾 **CSV Export**; Download checkout-origin activity logs for security review or record keeping. ### Why Online Shops Need it WooCommerce checkouts are frequent targets for: * Card testing and BIN probing * Fake business registrations and spam accounts * Automated scripts hammering your checkout endpoints Checkout Origin Guard focuses on **checkout behavior and identity quality**, not just generic firewall rules. It helps you: * Reduce chargeback and fraud risk * Keep your order list clean and reviewable * Shorten the time spent cleaning up junk orders and bogus signups The plugin works alongside any existing firewall, CDN, or WAF; it does not rely on external APIs or subscriptions. All data stays on your server. ### Use Cases * Prevent card testing or order spam * Review orders with suspicious company names and email addresses * Detect rapid repeat checkout attempts from the same IP * Block suspicious POST requests that hit checkout endpoints * Add an extra layer of review for orders where the gateway reports “AVS unavailable/ not checked” * Maintain cleaner order history and logs for real customers #### Traffic protection and checkout compatibility Monitor records traffic without enforcing score-based limits. Soft block returns HTTP 429 for scores of 60 or higher. Hard block returns HTTP 429 for scores of 60– 79 and HTTP 403 for scores of 80 or higher. The separate Block Common Exploits setting is enabled by default and returns 403 for recognized sensitive-file, ALFA, and PHP- CGI probes in every mode, before allowlists. This protection applies only to requests that reach WordPress. Classic checkout submissions and POST requests to the Store API checkout route are counted separately from ordinary browsing. More than ten submissions from the same IP within a fixed minute receive a high-risk score. GET/PATCH draft updates, cart refreshes, coupon requests, and gateway callbacks are excluded from this checkout- attempt limit. WooCommerce retains responsibility for nonce/cart-token validation and payment processing. Company Shield supports classic checkout and Checkout Blocks. A lowercase name, missing referrer, role-based email address, or non-Latin company name alone does not reject or hold an order. Configured deny fragments, disposable domains, or multiple corroborating company-pattern signals can trigger the selected mode. Soft mode requests manual review; when payment advances a flagged order to processing/completed, it is placed on hold once. Staff can subsequently release it. This does not reverse or prevent an authorized payment. Traffic logs include rule matches, crawler classification, request body type, and observed HTTP status in the dashboard and CSV export. The homepage is shown as /, and checkout routing is retained without recording arbitrary query strings, request bodies, or payment details. Logs are automatically retained for 30 days by default, configurable from 7 to 90 days. Older entries have blank values for the new details. If your store is behind a CDN or reverse proxy, configure its actual connecting IP addresses or IPv4 CIDRs in Trusted proxies before enabling traffic blocking. Forwarded client-IP headers are ignored for untrusted peers. With no trusted proxies configured, the connecting address is used. Use Monitor to verify client addresses and legitimate checkout behavior before enabling enforcement. ### Credits Developed by **Michael Winchester** For documentation and updates, visit https:// michaelwinchester.com ## Screenshots [⌊Main dashboard with unified settings and live log viewer⌉⌊Main dashboard with unified settings and live log viewer⌉[ Main dashboard with unified settings and live log viewer [⌊Company Shield filters with business name and email heuristics⌉⌊Company Shield filters with business name and email heuristics⌉[ Company Shield filters with business name and email heuristics [⌊Bot Block options and traffic allowlists⌉⌊Bot Block options and traffic allowlists⌉[ Bot Block options and traffic allowlists ## Installation 1. Upload the plugin folder to `/wp-content/plugins/checkout-origin-guard/` 2. Activate the plugin through the **Plugins** menu in WordPress. 3. Go to **WooCommerce Checkout Origin Guard** in the admin sidebar (or **Tools Checkout Origin Guard** if WooCommerce is not present). 4. Configure your preferred mode: 5. * **Monitor**; log only, no blocking (recommended starting point) * **Soft Block**; log and slow or defer traffic * **Hard Block**; log and deny abusive access entirely 6. Review logs, then fine-tune detection thresholds and allowlists before enabling Soft or Hard modes in production. 7. Optional; enable AVS “U” handling under **Payment AVS Signals**, starting with “ Add order note only” before switching to “Hold for review” on higher-risk stores. ## FAQ ### Does this plugin affect SEO bots or uptime monitors? Google, Bing, and Apple search crawlers are allowed after cached reverse and forward DNS verification. Configured AI and uptime User-Agent allowances apply to GET and HEAD traffic. Known exploit probes are checked before allowances. Other crawler identities remain subject to scoring. ### Will it block my own IP? Your logged-in administrator sessions are never blocked by Bot Block. If you manually block your own address, you can unblock it from the plugin dashboard with one click. ### Does it replace a firewall or security plugin? No. Checkout Origin Guard complements existing firewall or security plugins. It focuses specifically on **WooCommerce checkout behavior** and identity quality, rather than broad HTTP filtering. ### Does this change how my gateway processes payments? No. Checkout Origin Guard does not interfere with your payment gateway’s authorization or capture logic. The optional AVS “U” feature runs **after** the gateway has responded and only: * Adds order notes * Adjusts a risk-score meta field * Optionally changes the WooCommerce order status to “on-hold” for manual review Your gateway interaction and funds flow remain unchanged. ### What is AVS “U” and why should I care? AVS (Address Verification Service) compares billing address details against card- issuer records. The code **“U”** usually means: * Address not checked, or * Service unavailable, or * Acquirer had no response On its own, AVS U does not prove fraud, but combined with other signals (suspicious company name, disposable email, rapid sequence from one IP) it can be a useful reason to slow down and review the order. ### I do not know my gateway meta keys. Can I still use AVS detection? Yes. The AVS settings include an optional **Gateway Meta Keys** list. If you know the exact meta keys your gateway uses to store AVS results, you can enter them for more precise scanning. If you leave the field blank, Checkout Origin Guard will scan all order meta values for common AVS U patterns, including PayPal-style messages such as: > AVS: U: Unavailable / Address not checked, or acquirer had no response. Service > not available. ### Can I export my logs? Yes. All log data can be exported to CSV from the plugin dashboard for review, forensics, or integration with external tools. ### Where is log data stored? Logs are stored in a dedicated database table inside your existing WordPress database. They contain timestamps, IP addresses, user agents, paths, HTTP methods, and a decision flag. No external services are used; all data remains on your server. You can clear or truncate this table using your preferred database tools if you want to reset history. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Checkout Origin Guard” is open source software. The following people have contributed to this plugin. Contributors * [ POTAR ](https://profiles.wordpress.org/potar/) [Translate “Checkout Origin Guard” into your language.](https://translate.wordpress.org/projects/wp-plugins/checkout-origin-guard) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/checkout-origin-guard/), check out the [SVN repository](https://plugins.svn.wordpress.org/checkout-origin-guard/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/checkout-origin-guard/) by [RSS](https://plugins.trac.wordpress.org/log/checkout-origin-guard/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.8.0 * Added final-checkout attempt limits for classic AJAX and Checkout Blocks with fixed one-minute windows. * Added verified search crawler handling and exploit detection before allowlisting. * Removed hard rejections based solely on missing origin data or lowercase names; preserved email checks when company names are allowed. * Added trusted proxy controls, richer traffic logs and CSV exports, privacy information, and scheduled log retention. * Preserved admin bypass, payment callback handling, AVS options, and user-profile IP controls. #### 1.7.3 * Prevented Bot Block from interrupting WooCommerce checkout and payment AJAX transport requests that can surface as generic payment-source errors. #### 1.7.2 * Hardened admin input handling for allowlists, blocklists, disposable-domain patterns, and emergency bypass activation. * Reduced repeated runtime work by caching normalized settings and precompiled path allow rules during each request. * Expanded settings-page guidance so advanced Company Shield thresholds are easier for non-technical store owners to tune safely. #### 1.7.1 * Added two high-signal checker heuristics: all-lowercase billing first+last name; and unknown checkout origin (no referrer and no UTM). * When triggered, these flags can bump the order risk score meta for faster review and safer automation. #### 1.7 * Added optional AVS “U” handling as a post-payment risk signal; can add notes, bump a risk-score meta field, or hold orders for review. * Refined Company Shield heuristics and help text for business and email validation. * Minor performance and logging improvements in the checkout validation flow. #### 1.6 * Confirmed compatibility with WordPress 6.9. * Updated code to align with upcoming WordPress coding and security guidelines. #### 1.5.3 * Improved IP hard block stability and unblock handling. * Added real-time log refresh option. * Enhanced Company Shield heuristics for email and business name detection. * Unified all settings on one page with persistent values. * Performance improvements and code cleanup. #### 1.5.2 * Added CSV export for logs. * Added referrer and nonce validation checks. * Expanded allowlist for common search engine bots. #### 1.5.1 * Fixed settings persistence and default value population. * Added Populate Defaults button. * UI refinements and improved table layout. #### 1.5.0 * Merged “Bad User Patterns” module into core. * Added company/email heuristics and rate-limit detection. * New single-page admin interface. ## Meta * Version **1.8.0** * Last updated **3 days ago** * Active installations **10+** * WordPress version ** 6.0 or higher ** * Tested up to **6.9.10** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/checkout-origin-guard/) * Tags * [bot protection](https://srd.wordpress.org/plugins/tags/bot-protection/)[fraud prevention](https://srd.wordpress.org/plugins/tags/fraud-prevention/) [ip blocker](https://srd.wordpress.org/plugins/tags/ip-blocker/)[spam](https://srd.wordpress.org/plugins/tags/spam/) * [Advanced View](https://srd.wordpress.org/plugins/checkout-origin-guard/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/checkout-origin-guard/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/checkout-origin-guard/reviews/) ## Contributors * [ POTAR ](https://profiles.wordpress.org/potar/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/checkout-origin-guard/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://www.paypal.com/ncp/payment/4RV65EGN96SLS)