Noventum Fake Order Protection

Noventum Fake Order Protection adds defensive checks for WooCommerce checkout requests made through the Store API and classic WooCommerce AJAX checkout.

The plugin can detect suspicious checkout behavior, rate-limit repeated attempts, add a hidden honeypot field, temporarily block abusive IP fingerprints, and optionally verify Google reCAPTCHA v3 tokens before allowing high-risk checkout attempts.

This plugin does not create fake orders. It is intended to reduce fake or abusive order attempts in WooCommerce stores.

Third-Party Services

This plugin can use Google reCAPTCHA v3 when reCAPTCHA is enabled and site keys are configured in the plugin settings.

When enabled, the plugin loads Google’s reCAPTCHA JavaScript from https://www.google.com/recaptcha/ on WooCommerce cart, checkout, and product pages. During protected checkout attempts, the plugin sends the reCAPTCHA token, the configured secret key, and the visitor IP address to Google’s verification endpoint at https://www.google.com/recaptcha/api/siteverify.

Google reCAPTCHA is provided by Google. Review Google’s terms and privacy information before enabling it:

• Google Privacy Policy: https://policies.google.com/privacy
• Google Terms: https://policies.google.com/terms
• reCAPTCHA information: https://www.google.com/recaptcha/about/

Privacy

The plugin processes technical request data such as IP address, user agent, checkout source headers, WooCommerce session state, checkout email fingerprint, order status, payment method, and order total to detect abusive checkout behavior.

By default, plugin log entries anonymize personal data before writing to disk. The plugin stores temporary risk counters in WordPress transients and stores temporary blocked IP rows in a custom database table.

Administrators can view blocked IP rows and plugin logs from the plugin settings page. Log files are stored under the WordPress uploads directory in noventum-oap/ and rotated automatically.

If Google reCAPTCHA is enabled, checkout verification data is sent to Google as described in the Third-Party Services section.