About this plugin
Bikram COD Order Verification for WooCommerce adds a simple, no-cost verification step to your store’s Cash on Delivery (COD) checkout flow. Before a customer can place a COD order, they must confirm a one-time password (OTP) sent to their email or phone number. This helps reduce fake orders, prank orders, and Return to Origin (RTO) losses that are especially common with COD in emerging markets.
Key Features
- Works with both the Classic (shortcode) checkout and the modern WooCommerce Blocks checkout.
- Verification by Email (via the site’s own wp_mail() ) or SMS (via Twilio or your own custom HTTP API).
- Customizable OTP length (4-6 digits) and expiry time.
- Customizable email subject/message templates.
- Server-side enforcement – verification cannot be bypassed by disabling JavaScript or editing hidden form fields.
- Brute-force protection: OTP guesses are capped, and codes are single-use.
- Lightweight dashboard widget showing OTPs sent, verified, and orders blocked.
- Full HPOS (High-Performance Order Storage) compatibility.
- No bloat: verification only appears when Cash on Delivery is the selected payment method.
How it works
- The customer fills in their details and selects Cash on Delivery at checkout.
- A small verification box appears, asking for their email or phone number.
- The customer requests a code and enters it to confirm their identity.
- Only once verified can they successfully place the order – this is enforced on the server, not just in the browser.
External services
This plugin can, depending on how you configure it, send data to external services in order to deliver the OTP code to your customers:
-
Email delivery uses your WordPress installation’s own wp_mail() function to send the OTP. g. an SMTP plugin, if you use one).
-
SMS delivery (optional, only if you choose SMS as the verification method):
- Twilio – if you select Twilio as your SMS gateway and enter your Twilio credentials, the OTP code and the customer’s phone number are sent to Twilio’s API ( https://api.twilio.com ) in order to deliver the SMS. This is only used when you have explicitly configured Twilio credentials in the plugin’s settings. See Twilio’s Terms of Service and Privacy Policy.
- Custom API – if you select “Custom API” and provide your own SMS provider’s endpoint URL, the OTP code and the customer’s phone number are sent to the URL you configure. No default third-party endpoint is used – this only happens if you actively configure it.
No data is sent to any external service unless you actively choose and configure SMS as your verification method. If you use Email verification (the default), no third-party service is contacted by this plugin.