Beschrijving
Every high-demand sale carries the same risk: automated scripts claim your inventory in seconds, real customers miss out, and your support team spends days handling frustrated buyers. RealNode eliminates that scenario at the source.
Instead of analyzing traffic patterns and making guesses, RealNode asks a simple question that bots cannot answer: prove you are a human being, with a real device, right now. Automated scripts fail instantly. Real customers answer in a single tap.
The result is a checkout experience that feels identical to your customers — and completely closed to bots.
Three protection tiers
RN Insight — Passive audit
Runs entirely in the background. It analyzes traffic and surfaces behavioral intelligence in your operator dashboard. No user is ever challenged or interrupted. Ideal for understanding the volume of your automated traffic before active enforcement.
RN Sentinel — Adaptive protection
Adds a trigger layer on top of passive analysis. When a session is flagged as suspicious, a verification step is requested before the order proceeds. Genuine customers complete the challenge in a single gesture — the same one they use to unlock their phone — and continue normally. Clean sessions flow through without interruption, keeping overall friction low.
RN Vault — Zero-tolerance enforcement
Designed for flash sales, exclusive drops, and high-demand events. Hardware verification is required once per event — after that first gesture, all subsequent purchases for the same event are authenticated silently in the background. The system enforces per-user purchase quotas that are physically unbypassable. Your customers see their remaining quota in real time on the checkout page.
Device management in My Account
On the Vault plan, the plugin adds a security management panel directly inside the WooCommerce “My Account” area. Customers can view all their hardware-attested devices, block a device that has been stolen or compromised, free a device before reselling it, and restore access using an emergency recovery code.
Built to keep your sales running
RealNode is an additive security layer. If our infrastructure becomes unreachable for any reason, the plugin steps aside automatically and your checkout continues without interruption. Your revenue path has no dependency on our uptime.
Privacy and GDPR
Er worden nooit biometrische gegevens naar RealNode verzonden. De biometrische handeling (vingerafdruk, gezichtsscan) ontgrendelt de beveiligde hardwarechip van het apparaat lokaal en verlaat het apparaat nooit. Gebruikers worden uitsluitend geïdentificeerd via geanonimiseerde cryptografische hashes zonder dat er persoonlijke gegevens bij betrokken zijn.
Requirements
- An active RealNode account at app.realnode.emkaylabs.tech/signup
- WooCommerce 6.0 or later
- Modern browsers with WebAuthn support (Chrome 67+, Firefox 60+, Safari 14+)
Voor klanten op apparaten zonder ingebouwde biometrie kunnen ze de verificatie voltooien door een QR-code te scannen met hun smartphone. RN Insight en niet-gemarkeerde Sentinel sessies vereisen deze stap nooit.
For Developers & Security Teams
Deze sectie bevat technische details voor engineering- en beveiligingsteams.
- Behavioral Analysis (8–12Hz jitter): RN Sentinel evaluates client-side kinetic micro-interaction signals locally at the edge, classifying device environments including headless browser frameworks such as Puppeteer or Playwright.
- Cryptographic Hardware Signatures: The biometric gesture unlocks the device’s secure hardware chip (TouchID, FaceID, Windows Hello, Yubikey). RealNode receives a cryptographic signature, which is mathematically impossible to replicate in software.
- Hardware Identifiers (IDH): Cryptographic hashes derived from device characteristics. Spoofing an IDH requires acquiring real physical hardware. Even then, the FIDO2 biometric attestation requires physical access to the device’s secure hardware chip.
- Atomic Quotas: On Vault plans, atomic purchase quotas are enforced per event per IDH using a distributed in-memory cache (≤2ms response time), backed by a Supabase persistence layer with row-level security.
- Asynchronous SDK: The RealNode SDK (
api.emkaylabs.tech) loads asynchronously on checkout and cart pages. Backend validation (rn-v3-elite.onrender.com) runs with a 5-second timeout; if RealNode does not respond in time, checkout completes normally.
Service page and legal information: realnode.emkaylabs.tech
Schermafbeeldingen
Installatie
Prerequisites: Your site must be served over HTTPS. WebAuthn (the browser standard that powers biometric verification) is a secure-context-only feature — it will not work on plain HTTP, by browser design. Most production hosting providers include a free SSL certificate (Let’s Encrypt). Enable it before configuring RealNode.
- Create your RealNode account at app.realnode.emkaylabs.tech/signup and copy your Public API key (
pk_live_...) and Secret key (sk_live_...) from your dashboard - Upload the
realnode-antiscalperfolder to/wp-content/plugins/, or install directly through the WordPress plugin directory - Activate the plugin through the Plugins menu in WordPress
- Go to Settings > RealNode Anti-Scalper
- Paste your
pk_live_...Public API key and yoursk_live_...Secret key - Select your service tier (Insight, Sentinel, or Vault) — if you are unsure, your active plan is shown directly in your RealNode dashboard
- Click Save Settings — protection is active immediately
No code changes are required. The plugin automatically injects the SDK on checkout and cart pages and intercepts the WooCommerce “Place Order” button.
Note on the Secret Key: Your sk_live_... key is stored in your WordPress database and used exclusively in server-side PHP requests. It is never output in HTML or JavaScript and is never visible to your site visitors.
FAQ
-
Do I need to modify my theme or write any code?
-
No. The plugin handles everything: SDK injection, button interception, backend validation, and the device management panel in My Account. You paste your API keys, select your tier, and save. That is the entire integration.
-
What happens if a customer’s device does not support biometrics?
-
Voor RN Insight: niets. Er wordt nooit om verificatie gevraagd.
Voor RN Sentinel: de verificatiestap wordt alleen geactiveerd wanneer een sessie als verdacht wordt gemarkeerd. Een klant met een schone sessie krijgt er nooit mee te maken.
Voor RN Vault: als een desktop of laptop geen ingebouwde sensor heeft, kan de klant zijn smartphone als universele beveiligingssleutel gebruiken door een QR-code te scannen en de handeling binnen enkele seconden op zijn telefoon voltooien. -
Does this slow down my site?
-
No. The SDK loads asynchronously and only on cart, checkout, and account pages. It has zero effect on the rest of your site. Backend validation runs with a 5-second timeout; if RealNode does not respond in time, checkout completes normally.
-
Is biometric data sent to RealNode?
-
Nee. De biometrische handeling vindt volledig plaats op de beveiligde hardwarechip van het apparaat. RealNode ontvangt, verwerkt of slaat nooit enige vorm van biometrische gegevens op. Wat de server ziet, is een anonieme cryptografische hash.
-
Can a customer buy multiple tickets with different devices?
-
On RN Vault, each physical device is a separate identity. The quota is enforced per device per event. If the same person attempts to buy additional tickets using a second phone, that device is treated as a separate entity and has its own quota. The system does not link hardware identities to each other.
-
What is the Event ID field?
-
The Event ID is an internal label you define to scope purchase quotas. For example:
CONCERT-PARIS-2026. All purchases are tracked against that label. If you run multiple events on the same store, changing the Event ID before each one resets the quota tracking for that event without affecting others. -
Is the Secret Key safe?
-
Yes. The Secret Key (
sk_live_...) is stored as a WordPress option and is used only in server-side PHP calls. It is never included in any JavaScript output or exposed to the browser. -
Will my legitimate customers ever be incorrectly blocked?
-
Het aantal valse positieven is van nature extreem laag. Bij RN Insight worden gebruikers nooit geblokkeerd. Bij RN Sentinel wordt in minder dan 0,1% van de legitieme sessies een verificatiestap geactiveerd. Bij RN Vault is de registratie een eenmalige handeling — alle daaropvolgende aankopen verlopen onmiddellijk.
-
Can I switch plans without changing my code?
-
Yes. You can upgrade, downgrade, or cancel your subscription from your RealNode dashboard. The WordPress plugin reads your active tier automatically at each page load.
-
What is a billing unit exactly? How is usage counted?
-
Een factuureenheid is één uniek apparaat dat is geanalyseerd op één specifiek beveiligd evenement of pagina, binnen een bepaalde facturatiecyclus. Als dezelfde klant 3 verschillende beveiligde evenementen bezoekt, telt dat als 3 eenheden. Als diezelfde klant binnen de maand 100 keer terugkeert naar hetzelfde evenement, telt het nog steeds als 1 eenheid.
-
For RN Insight and Sentinel, RealNode stores an anonymous hardware-derived token in the browser’s localStorage. For RN Vault, a temporary first-party session cookie is used on your domain to secure the active session. No advertising, profiling, or cross-site tracking cookies are used. This functional usage is fully exempt from cookie consent banners under ePrivacy regulations.
-
How do I prepare for a flash sale or high-demand event?
-
Before a major sale, we recommend: (1) Upgrade your plan to the appropriate tier. (2) Set a specific Event ID matching the sale, so purchase quotas are tracked and reset per event. (3) Optionally enable Fail-Closed mode from your dashboard if zero-tolerance is required. For events expecting more than 100,000 concurrent sessions, contact us in advance.
-
Is there an audit log I can consult for fraud investigations?
-
Yes. Every security event is written to an immutable log in your RealNode administration console. You can filter by date range, device hash, trust level, or event type, and export in JSON or CSV. On RN Vault, forensic logs include the full attestation chain.
-
Looking for headless or custom platforms?
-
RealNode is platformonafhankelijk. We bieden een native client-side SDK via npm (
@emkaylabs/realnode-sdk) en ruwe JavaScript-integraties voor aangepaste stacks, Shopify of headless architecturen. Bezoek ons pakket op NPM of onze GitHub repository voor meer informatie.
Beoordelingen
Er zijn geen beoordelingen voor deze plugin.
Bijdragers & ontwikkelaars
“Anti-Bot, Anti-Spam & Fraud Protection for WooCommerce – RealNode” is open source software. De volgende personen hebben bijgedragen aan deze plugin.
Bijdragers
Vertaal “Anti-Bot, Anti-Spam & Fraud Protection for WooCommerce – RealNode” in je eigen taal.
Interesse in ontwikkeling?
Bekijk de code, haal de SVN repository op, of abonneer je op het ontwikkellog via RSS.
Changelog
1.1.4
- Improved SDK resilience with automatic retry on server errors (HTTP 5xx, 429).
- Fixed registration links to point directly to the signup page.
1.1.1
- Added automatic plan detection: the plugin now contacts the RealNode API when you save your Public Key and sets your service tier automatically. No manual selection required.
- Added daily WP-Cron sync to keep your plan up to date when you upgrade or downgrade your subscription — zero WordPress config changes needed.
- Added direct “Access Dashboard” button on the settings page for one-click access to your RealNode console.
- Added auto-generated Event ID based on WooCommerce product IDs when no manual Event ID is defined (Vault plan).
- Added real-time quota badge on individual product pages for Vault plans.
- Added HTTPS environment check: a warning is now shown in the WordPress admin if the site is not served over HTTPS.
- Added account creation as the first step of the installation guide.
1.1.0
- Added multi-tier support: RN Insight, RN Sentinel, RN Vault.
- Added Secret Key (sk_live_) field for secure backend validation.
- Added device_token to the backend /consume validation payload.
- SDK injection restricted to cart, checkout, and account pages only.
- Added fail-open logic with 5-second timeout on backend API calls.
- Added 30-second modal timeout with automatic fail-open fallback.
- Added real-time quota display on Vault checkout page.
- Added device management panel (list, revoke, transfer, recover) in WooCommerce My Account.
1.0.0
- Initial release.
- SDK injection with async loading.
- WooCommerce “Place Order” button protection.
- Settings page with API key and endpoint configuration.
- Graceful fail-open on unsupported devices.