Branching Software Order Fraud Protection for WooCommerce

Branching Software Order Fraud Protection for WooCommerce gives store owners a powerful, flexible blacklist system to stop fraudulent orders before they happen — without needing a paid subscription or third-party service.

Key Features

Blacklisting

Block customers at checkout by any combination of:

• Email address, email domain, or email wildcard (e.g. block all @frauddomain.com or any email containing spam)
• Phone number
• Customer name
• IP address
• Billing or shipping address (full or partial match, with wildcard support)

Admin Controls

• Set a custom block message shown to blocked customers at checkout
• Configure a fraud attempt threshold — automatically blacklist customers after N failed attempts
• “Blacklist Order” and “Remove from Blacklist” order actions directly on the order edit screen
• Bulk blacklist customers from the orders list page
• CSV bulk import for blacklist entries
• Whitelist trusted payment gateways (bypass checks for specific gateways)
• Whitelist specific customer emails (always allow through)

Blocking Rules

• Block by order status — choose which statuses trigger blacklist checks
• Block by product type — configure which product types are included in checks

Test / Simulation Mode

• Enable Test Mode to log blocked customers without actually blocking them — safe for testing on live sites

Dashboard Widget

• At-a-glance Fraud Protection Summary widget on the WordPress admin dashboard
• Shows blocks this week, fraud attempts this month, and top 5 blocked reasons
• Quick links to the blocked logs and fraud attempts log pages
• Natively moveable and dismissible via WordPress Screen Options

Logging & Monitoring

• Admin fraud logs page showing all blocked customers with reason, date, IP, and address
• Database logging of fraud attempts to track repeat offenders
• Admin email alert when a blocked order is attempted (configurable address)
• Debug log option for troubleshooting

Security

• Log files protected with .htaccess (denies direct HTTP access on Apache and Nginx)
• SQL injection prevention via prepared statements throughout
• CSRF (nonce) protection on all admin form submissions
• Capability checks (manage_woocommerce) on all admin actions
• No sensitive data exposed via HTTP responses

Credits

This plugin is based on the original Woo Manage Fraud Orders plugin (GPLv2 or later) originally developed by Prasidhda Malla, sranzan, and BrianHenryIE. The original plugin is no longer maintained and has been closed on WordPress.org. This version has been significantly extended and improved by Branching Software.