The Disposable Email rule now uses a continuously updated list instead of the small built-in one. Only the domain is checked - never the address itself. Also fixes flags being lost during a brief API outage, and a malformed domain briefly pausing IP screening.<\/p>","1.10.0":"
The Community Threat Network opt-in now appears in the setup wizard as an explicit, unticked checkbox \u2014 still off by default, and nothing is shared unless you tick it. Also fixes a shared-cache issue that could stop Predax Security's crawler policy applying to a checkout visitor.<\/p>","1.9.0":"
Fixes one shopper's screening result being reused for a different shopper on the same network, the Events Log reason filter returning nothing on the Flagged tab, and the Blocks checkout not contributing to the Community Threat Network. Also reduces how many checks each visitor costs.<\/p>","1.8.4":"
Fixes a daily check limit being reported as the monthly one - the notice claimed screening was paused until the 1st when it actually resumes the same day. Also reduces how much of your allowance each checkout consumes.<\/p>","1.8.3":"
Fixes the Monitor Only wizard preset leaving known-malicious IP blocking on, which could reject checkouts despite the preset promising to block nothing.<\/p>","1.8.2":"
Adds a one-click option to join the Community Threat Network, so fraudsters blocked at other stores are already known to yours. Entirely optional.<\/p>","1.8.1":"
Fixes VPN\/proxy shoppers set to Monitor still being blocked when datacenter blocking is enabled, and corrects the signals sent to the Community Threat Network.<\/p>","1.8.0":"
Fixes VPN\/proxy checkout blocks that happened with both toggles off, and stops verified search engines being caught by category rules.<\/p>","1.7.4":"
Fixes VPN\/proxy checkout blocks that happened even with both toggles switched off, and which were logged under the wrong reason. Recommended if legitimate orders were being blocked unexpectedly. Safe to upgrade.<\/p>","1.7.3":"
Fixes malicious-IP blocking so it actually works (a normalization bug in 1.7.2 silently prevented it from ever triggering), adds specific Events Log messaging, and masks the API key field. Safe to upgrade.<\/p>","1.7.2":"
Adds known-malicious IP blocking as its own off-by-default category and a reason filter for the Events Log. No settings are changed automatically. Safe to upgrade.<\/p>","1.7.1":"
Adds a live API usage meter, a quota-exhausted notice, and an API circuit-breaker so a slow API can never hang checkouts (timeout lowered 8s to 3.5s). Events Log emails are now stored masked. Screening decisions are unchanged. Safe to upgrade.<\/p>","1.7.0":"
IPSentry is now Predax \u2014 first WordPress.org release. Your settings, API key, and order data are preserved. Checkout screening is unchanged and still fully opt-in (no outbound requests until you add a key and enable a mode).<\/p>","1.6.2":"
WP.org compliance pass: removes self-updater, extracts inline script\/style tags, tightens sanitisation, and makes the community-feedback telemetry opt-in (off by default). Core checkout screening is unchanged. Upgrade is safe.<\/p>","1.6.1":"
OAuth connect popup now auto-closes reliably after authorization. Per-user OAuth transients prevent conflicts on multi-admin sites. Safe to upgrade \u2014 no behaviour changes.<\/p>","1.6.0":"
Adds a 3-step setup wizard with One-Click Connect (OAuth) shown on first activation. Existing installs unaffected \u2014 the wizard only triggers on fresh activation with no API key. Re-run anytime from Developer \u2192 Run Setup Wizard.<\/p>","1.5.0":"
Adds Events Log page and risk column on the orders list. Safe to upgrade \u2014 no behaviour changes, new DB table created automatically on first load.<\/p>","1.4.3":"
Adds a dedicated admin menu page (Predax \u2192 Fraud Guard). Safe to upgrade \u2014 all existing settings are preserved.<\/p>","1.4.2":"
Adds settings import\/export and a configurable support email address for block messages. Safe to upgrade \u2014 no behaviour changes on upgrade.<\/p>","1.4.0":"
Adds order hold, velocity rules, country mismatch detection, disposable email blocking, and chargeback feedback. All new features default to off.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3572045,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3572045,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3572045,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3572045,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.10.0","1.11.0","1.7.0","1.7.1","1.7.3","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.9.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3606422,"resolution":"1","location":"assets","locale":"","width":1280,"height":900},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3649320,"resolution":"2","location":"assets","locale":"","width":1440,"height":900},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3649320,"resolution":"3","location":"assets","locale":"","width":1440,"height":900},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3649320,"resolution":"4","location":"assets","locale":"","width":1440,"height":900},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3652584,"resolution":"5","location":"assets","locale":"","width":1440,"height":900},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3652584,"resolution":"6","location":"assets","locale":"","width":1440,"height":900},"screenshot-7.png":{"filename":"screenshot-7.png","revision":3649320,"resolution":"7","location":"assets","locale":"","width":1440,"height":900},"screenshot-8.png":{"filename":"screenshot-8.png","revision":3649320,"resolution":"8","location":"assets","locale":"","width":1440,"height":900},"screenshot-9.png":{"filename":"screenshot-9.png","revision":3638710,"resolution":"9","location":"assets","locale":"","width":1249,"height":709}},"screenshots":{"1":"A fraudulent order stopped at checkout: the customer sees a clear message and the order is never placed.","2":"The Fraud Rules settings tab: API key, risk thresholds, and per-signal VPN \/ proxy \/ Tor \/ datacenter rules.","3":"Order detail: the Predax risk score, flags, and country appear as an order note and order tags.","4":"Orders list: the Predax column shows each order's risk score and top threat flag.","5":"Advanced rules: order velocity, billing-country mismatch, disposable-email, and timezone checks.","6":"Geo blocking: allow, flag, or block checkout by country, region, or IP \/ CIDR list.","7":"Setup Wizard \u2014 pick a fraud protection level (Monitor Only, Recommended, or Strict) in one step","8":"Events Log filtered by reason \u2014 narrow blocked attempts down to a single category, like known-malicious IPs","9":"Events Log with one-click allow-listing \u2014 approve a genuine customer's IP straight from the log, without editing a settings field"}},"plugin_section":[],"plugin_tags":[262525,76320,132861,267121,286],"plugin_category":[45],"plugin_contributors":[264383],"plugin_business_model":[],"class_list":["post-323963","plugin","type-plugin","status-publish","hentry","plugin_tags-card-testing","plugin_tags-chargeback","plugin_tags-fraud-prevention","plugin_tags-vpn-detection","plugin_tags-woocommerce","plugin_category-ecommerce","plugin_contributors-ipsentry","plugin_committers-ipsentry"],"banners":{"banner":"https:\/\/ps.w.org\/predax-fraud-guard-for-woocommerce\/assets\/banner-772x250.png?rev=3572045","banner_2x":"https:\/\/ps.w.org\/predax-fraud-guard-for-woocommerce\/assets\/banner-1544x500.png?rev=3572045","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/predax-fraud-guard-for-woocommerce\/assets\/icon-128x128.png?rev=3572045","icon_2x":"https:\/\/ps.w.org\/predax-fraud-guard-for-woocommerce\/assets\/icon-256x256.png?rev=3572045","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/predax-fraud-guard-for-woocommerce\/assets\/screenshot-1.png?rev=3606422","caption":"A fraudulent order stopped at checkout: the customer sees a clear message and the order is never placed."},{"src":"https:\/\/ps.w.org\/predax-fraud-guard-for-woocommerce\/assets\/screenshot-2.png?rev=3649320","caption":"The Fraud Rules settings tab: API key, risk thresholds, and per-signal VPN \/ proxy \/ Tor \/ datacenter rules."},{"src":"https:\/\/ps.w.org\/predax-fraud-guard-for-woocommerce\/assets\/screenshot-3.png?rev=3649320","caption":"Order detail: the Predax risk score, flags, and country appear as an order note and order tags."},{"src":"https:\/\/ps.w.org\/predax-fraud-guard-for-woocommerce\/assets\/screenshot-4.png?rev=3649320","caption":"Orders list: the Predax column shows each order's risk score and top threat flag."},{"src":"https:\/\/ps.w.org\/predax-fraud-guard-for-woocommerce\/assets\/screenshot-5.png?rev=3652584","caption":"Advanced rules: order velocity, billing-country mismatch, disposable-email, and timezone checks."},{"src":"https:\/\/ps.w.org\/predax-fraud-guard-for-woocommerce\/assets\/screenshot-6.png?rev=3652584","caption":"Geo blocking: allow, flag, or block checkout by country, region, or IP \/ CIDR list."},{"src":"https:\/\/ps.w.org\/predax-fraud-guard-for-woocommerce\/assets\/screenshot-7.png?rev=3649320","caption":"Setup Wizard \u2014 pick a fraud protection level (Monitor Only, Recommended, or Strict) in one step"},{"src":"https:\/\/ps.w.org\/predax-fraud-guard-for-woocommerce\/assets\/screenshot-8.png?rev=3649320","caption":"Events Log filtered by reason \u2014 narrow blocked attempts down to a single category, like known-malicious IPs"},{"src":"https:\/\/ps.w.org\/predax-fraud-guard-for-woocommerce\/assets\/screenshot-9.png?rev=3638710","caption":"Events Log with one-click allow-listing \u2014 approve a genuine customer's IP straight from the log, without editing a settings field"}],"raw_content":"\n
Stop fraudulent WooCommerce orders before they're placed.<\/strong><\/p>\n\n Card testers, stolen-card fraudsters, and serial chargeback abusers almost always hide behind VPNs, proxies, Tor, or datacenter IPs. Predax Fraud Guard screens the customer's IP the moment they check out, scores its fraud risk from 0 to 100, and lets your store tag, hold, or block the order \u2014 before payment is taken and before a chargeback can happen.<\/p>\n\n Think of it as an order guard standing in front of your checkout. You stay in control of every decision: start in tag-only<\/strong> mode to see which orders would have been flagged, then turn on blocking for the risk levels you choose. Screening works with both the classic and block (Store API) checkout.<\/p>\n\n Fully opt-in:<\/strong> on a fresh install the plugin does nothing \u2014 no outbound requests are made until you<\/strong> connect a Predax API key (one-click via the setup wizard, or pasted in manually) and pick a protection mode. The default mode once configured is tag-only (no blocking), so you can review flagged orders in your dashboard before turning on anything that rejects a customer.<\/p>\n\n Screening runs during WooCommerce checkout validation \u2014 before the order is created and\nbefore any payment provider is contacted<\/strong>. A blocked attempt therefore never becomes a\ntransaction, a gateway fee, or a chargeback. It works with any gateway, because it does not\ndepend on which one you use, and it complements gateway-side tools such as Stripe Radar:\nyour gateway only ever sees the orders that already passed the IP screen.<\/p>\n\n You can revoke the API key or switch the mode back to \"Tag only\" at any time.<\/p>\n\n Orders that reach the tag threshold (default: risk score 40) are tagged based on band:<\/p>\n\n The real risk of a fraud rule isn't the fraudster it misses \u2014 it's the genuine customer it turns away without you ever finding out. A blocked shopper rarely tries again, and a store quietly dropped from search results never learns why. Fraud Guard is built to make both failure modes visible and reversible:<\/p>\n\n Combined with tag-only mode, this means you never have to guess what a rule would do: watch it tag first, turn on blocking when you're confident, and undo any bad block in one click.<\/p>\n\n All protection toggles default to off<\/strong> on a fresh install. The only thing the plugin writes to options on activation is a database version marker for the events-log table. You will need to explicitly enable any rule you want to apply.<\/p>\n\n Click \"Connect with Predax\" in the setup wizard to create your free account and link your API key automatically \u2014 no separate sign-up step, no key to copy or paste. The free plan includes 5,000 IP checks per month with full VPN\/proxy\/Tor\/datacenter detection and risk scoring \u2014 no credit card required.<\/p>\n\n The free tier covers a small store comfortably (checkouts are only checked when they happen, and results are cached). Busier stores use up the included checks faster \u2014 paid plans<\/a> raise the monthly limit from 5,000 up to 25 million IP checks, with higher request rates and bulk lookups. The Fraud Guard settings page shows your live usage each month, so you can see exactly when it's time to upgrade \u2014 same plugin, same settings, just a bigger allowance on your existing API key.<\/p>\n\n This plugin connects to external services operated by Predax (https:\/\/predax.io) only after you have saved an API key: checkout screening additionally requires a protection mode to be enabled, and the admin-side account-usage lookup (described below) sends no visitor data at all. By activating this plugin and entering an API key you agree to the Predax Terms of Service<\/a> and Privacy Policy<\/a>.<\/p>\n\n You are responsible for ensuring your use of customer IP data at checkout complies with applicable privacy laws (including but not limited to GDPR, CCPA) and your own store's privacy policy. This plugin does not assert PCI-DSS, GDPR, or CCPA compliance on your behalf.<\/p>\n\n Used to look up a risk score and classification signals for each checkout IP.<\/p>\n\n Used to check whether the billing email's provider is a disposable\/throwaway service, against a server-side list of thousands of domains (the plugin's built-in list covers only ~50).<\/p>\n\n Used to show the \"API usage this month\" meter on the Fraud Guard settings page, and only when an API key is saved.<\/p>\n\n The plugin can optionally<\/strong> send an anonymised telemetry signal \u2014 the IP address, its risk score and detection flags, its network (ASN) number and name, its country code, and the checkout outcome (allowed \/ monitored \/ blocked, or refund\/chargeback feedback) \u2014 to the Predax Community Threat Network so all participating stores benefit from a shared feed. The Refund \/ Chargeback Feedback \"Log\" action reports through this same channel, so it requires this opt-in; its \"Blacklist\" action updates your local deny list regardless.<\/p>\n\n This feature is off by default<\/strong>. It is controlled by the Only triggered when an administrator clicks the Connect with Predax<\/strong> button in the setup wizard. Your browser is redirected to predax.io to authorise the connection, which returns an API key to your site.<\/p>\n\n Shown only when an administrator deactivates the plugin from the Plugins screen and chooses to answer the \"why are you deactivating?\" prompt.<\/p>\n\n The plugin does not set any advertising, analytics, or tracking cookies.<\/p>\n\n\n Enable a blocking mode (the wizard's Recommended preset blocks risk 50 and above), turn on\nthe order velocity rule, and set VPN, proxy and datacenter to Block. Card-testing bots run\nfrom datacenter, proxy and VPN addresses, so these rules cut the attack off at the\nconnection. Every blocked attempt is listed in the Events Log, and because screening runs\nduring checkout validation \u2014 before the order reaches your payment gateway \u2014 a blocked\nattempt never becomes a transaction, a gateway fee, or a chargeback.<\/p><\/dd>\n Yes, with any gateway. Screening runs during WooCommerce's own checkout validation, before\nthe order is created and before any payment provider is contacted, so it does not depend on\nwhich gateway you use. It complements gateway-side screening such as Stripe Radar: your\ngateway only ever sees the orders that already passed the IP screen.<\/p><\/dd>\n Most anti-fraud plugins score orders using rules about the order itself \u2014 mismatched names, order size, email patterns. Predax Fraud Guard adds the signal those rules can't see: live IP intelligence<\/strong>. It knows whether the customer is connecting through a VPN, proxy, Tor, or a datacenter server right now<\/em>, backed by a continuously-updated commercial threat database \u2014 the same signal used to catch card testing and stolen-card fraud before payment is taken. It works well alongside rule-based fraud plugins and payment-processor screening such as Stripe Radar, and alongside security plugins like Wordfence (which protect your site, not your checkout).<\/p><\/dd>\n No. Before you enter an API key and save a protection mode, the plugin makes zero outbound requests to predax.io. Nothing happens silently on activation.<\/p><\/dd>\n Only if you enable a blocking mode. Until you complete setup, the mode is Tag only<\/strong> (no blocking \u2014 orders just get tags and notes). In the setup wizard, the pre-selected Recommended<\/strong> preset enables blocking of high-risk checkouts (risk score 50+); choose Monitor Only<\/strong> instead if you don't want any blocking yet \u2014 each preset card lists exactly what it switches on.<\/p><\/dd>\n A score from 0 to 100 representing how likely an IP is to be associated with fraud, anonymisation, or abuse. 0 = clean residential IP, 100 = the strongest combination of threat signals (for example a known-malicious IP arriving over an anonymised connection). The score combines VPN\/proxy\/Tor detection, datacenter identification, historical abuse signals, and geographic heuristics.<\/p><\/dd>\n Yes \u2014 enable Fraud Guard \u2192 Settings \u2192 Advanced \u2192 \"Behind a proxy \/ CDN\"<\/strong> (or the same toggle on the WooCommerce \u2192 Predax tab). With it on, the plugin reads the real customer IP from the Fraud Guard \u2192 Settings \u2192 Developer tab \u2192 enter a Test IP Override. Every checkout is then evaluated as if it came from that IP. A red admin banner reminds you test mode is active. Clear the override before going live.<\/p>\n\n Use On each tagged order the plugin stores:<\/p>\n\n Yes. The plugins are independent but complementary \u2014 Security protects logins and registrations, Fraud Guard protects WooCommerce checkout. Both can share the same API key.<\/p><\/dd>\n Search first: verified search engine crawlers \u2014 Googlebot, Bingbot and others confirmed by\nreverse DNS \u2014 are never caught by your category rules, on both the classic and the\nblock-based checkout, so screening does not affect how your store is crawled or indexed.<\/p>\n\n For customers, the plugin is built so you never have to guess. Start in tag-only mode and\nwatch what your rules would<\/em> have done in the Events Log before you enable any blocking.\nEvery screening decision is recorded with its reason, and a good customer caught by an\nover-strict rule can be allow-listed in one click straight from the log. If your store\nserves audiences where VPN use is common, prefer Monitor mode for the VPN rule.<\/p><\/dd>\n\n<\/dl>\n\n\nWhat it stops<\/h4>\n\n
\n
Why it saves you money<\/h4>\n\n
How It Works<\/h4>\n\n
\n
Risk Tagging<\/h4>\n\n
\n
Features<\/h4>\n\n
\n
Screening that doesn't cost you real customers or search traffic<\/h4>\n\n
\n
Defaults<\/h4>\n\n
Free Tier<\/h4>\n\n
More Power With Paid Plans<\/h4>\n\n
Third Party Services<\/h3>\n\n
Predax IP Intelligence API<\/h4>\n\n
\n
POST https:\/\/predax.io\/api\/v1\/check\/ip<\/code><\/li>\nEmail Domain Screening (only when the Disposable Email rule is enabled)<\/h4>\n\n
\n
gmail.com<\/code>. The email address itself is NEVER sent: the part before the @ does not leave your site, and the mailbox-level checks (role account, random-looking name) run locally in PHP on your own server.<\/li>\nPOST https:\/\/predax.io\/api\/v1\/validate\/email<\/code><\/li>\nAccount Usage Lookup (admin pages only)<\/h4>\n\n
\n
GET https:\/\/predax.io\/api\/v1\/auth\/usage<\/code><\/li>\nPredax Community Threat Network (opt-in, off by default)<\/h4>\n\n
ipsentry_woo_community_enabled<\/code> option, which defaults to 'no'<\/code>, with a checkbox on the Advanced settings tab. The plugin will not send community-feedback telemetry unless you enable it. Customers' personal data (names, emails, billing\/shipping addresses, order contents) is never included in the telemetry payload.<\/p>\n\n\n
POST https:\/\/predax.io\/api\/v1\/telemetry\/event<\/code><\/li>\nOAuth One-Click Connect (optional)<\/h4>\n\n
\n
POST https:\/\/predax.io\/api\/v1\/oauth\/token<\/code><\/li>\nDeactivation Feedback (optional, admin-initiated)<\/h4>\n\n
\n
POST https:\/\/predax.io\/api\/v1\/feedback\/deactivation<\/code><\/li>\nCookies set by this plugin<\/h4>\n\n
\n
ipsentry_tz<\/code><\/strong> \u2014 set on WooCommerce checkout pages (only while an API key is configured) via assets\/js\/ipsentry-woo-tz.js<\/code>. Stores the customer's browser-reported IANA timezone (string, max 64 chars). Used server-side for the optional timezone-mismatch fraud rule. Expires after 24 hours (max-age=86400<\/code>), path=\/<\/code>, SameSite=Lax<\/code>, and marked Secure<\/code> on HTTPS stores. The plugin reads this cookie only at checkout-validation time.<\/li>\n<\/ul>\n\nFrom your WordPress dashboard (recommended)<\/h4>\n\n
\n
Manual installation<\/h4>\n\n
\n
predax-fraud-guard-for-woocommerce<\/code> folder to \/wp-content\/plugins\/<\/code>).<\/li>\n\n
How do I stop a card testing attack that's happening right now?<\/h3><\/dt>\n
Does it work with Stripe, PayPal, or my payment gateway?<\/h3><\/dt>\n
How is this different from other WooCommerce anti-fraud plugins?<\/h3><\/dt>\n
Does the plugin phone home before I finish setup?<\/h3><\/dt>\n
Will it block legitimate customers?<\/h3><\/dt>\n
What is the risk score?<\/h3><\/dt>\n
Does it work with Cloudflare?<\/h3><\/dt>\n
CF-Connecting-IP<\/code> \/ X-Forwarded-For<\/code> headers instead of the Cloudflare edge IP. It is off by default<\/strong>: when your store connects directly to visitors, trusting those headers would let a customer spoof their IP to bypass fraud checks, so you only turn it on when a proxy\/CDN really is in front of your site.<\/p><\/dd>\nHow do I test it without affecting real customers?<\/h3><\/dt>\n
185.220.101.1<\/code> (risk 85, Tor-adjacent) to exercise blocking paths, or 1.1.1.1<\/code> to verify pass-through.<\/p><\/dd>\nWhat order metadata is stored?<\/h3><\/dt>\n
\n
_ipsentry_risk_score<\/code> \u2014 numeric risk score (0\u2013100)<\/li>\n_ipsentry_ip<\/code> \u2014 detected customer IP<\/li>\n_ipsentry_country_code<\/code> \u2014 detected IP country code<\/li>\n_ipsentry_flags<\/code> \u2014 comma-separated threat flag list<\/li>\n<\/ul><\/dd>\nDoes it work alongside the Predax Security plugin?<\/h3><\/dt>\n
Will this block real customers or hurt my store's SEO?<\/h3><\/dt>\n
1.11.0<\/h4>\n\n
\n