SazCOD – COD Order Confirmation for WooCommerce

Cash on Delivery (COD) is essential for e-commerce growth in many regions, but fraudulent orders, impulsive checkouts, and wrong delivery addresses cost merchants substantial fulfillment and return shipping fees.

SazCOD – COD Order Confirmation for WooCommerce is a lightweight, 100% self-hosted plugin that automatically intercepts COD orders containing physical goods and places them into a custom status: Awaiting Confirmation.

The buyer receives an actionable confirmation block in their order email. Clicking the link takes the customer to a secure verification screen where they explicitly confirm their order. Once confirmed, the order instantly transitions to Processing so your warehouse can safely begin packing.

Key Features

• Zero External Dependencies: 100% self-hosted. No external APIs, SMS gateways, or recurring subscriptions.
• WooCommerce HPOS Compatible: Fully compatible with High-Performance Order Storage (custom_order_tables).
• Block Checkout & Classic Checkout Support: Intercepts COD orders across both WooCommerce Checkout Block (Store API) and classic shortcode checkouts.
• Smart Physical Goods Detection: Only intercepts orders requiring physical shipping; virtual and digital orders pass through normally.
• Hardened Token Security Architecture:
  • Cryptographically random, SHA-256 hashed tokens bound to the unique order.
  • Encrypted at rest using AEAD AES-256-GCM with order-bound additional authenticated data (v1:{order_id}).
  • Strict anti-cache headers (Cache-Control: no-store, no-cache) to prevent intermediate caching of confirmation screens.
  • Synchronized 48-hour WordPress nonce lifetime matching the token TTL.
  • Pre-commit business guards verifying COD payment method, awaiting-confirm status, and token hash.
  • Sequential token revocation and native WooCommerce order state machine transitions to eliminate double-confirmation races.
  • Post/Redirect/Get (PRG) flow with single-use opaque result tokens to eliminate order status enumeration.
  • Strict Content Security Policy (default-src 'none'), Referrer-Policy, and anti-tampering checks.
• Responsive, Clean UI: Mobile-friendly confirmation screen rendered using native styles without heavy frontend libraries.

Privacy Policy

The plugin does not transmit customer order data to external services or third-party servers. It stores only confirmation-related metadata (_qcoc_confirmed_at) in the local WooCommerce order. Customer information displayed on the self-hosted confirmation screen is retrieved directly from the merchant’s local WordPress database.