About this plugin
Stop fraudulent WooCommerce orders before they’re placed. Card testers, stolen-card fraudsters, and serial chargeback abusers almost always hide behind VPNs, proxies, Tor, or datacenter IPs. Predax Fraud Guard screens the customer’s IP the moment they check out, scores its fraud risk from 0 to 100, and lets your store tag, hold, or block the order — before payment is taken and before a chargeback can happen. Think of it as an order guard standing in front of your checkout. You stay in control of every decision: start in tag-only mode to see which orders would have been flagged, then turn on blocking for the risk levels you choose. Screening works with both the classic and block (Store API) checkout. See it on your own connection first. Check what Predax sees about your IP right now — the same risk score, VPN and proxy status and network owner your checkout is screened against. Free, no signup, nothing to install. Fully opt-in: on a fresh install the plugin does nothing — no outbound requests are made until you connect a Predax API key (one-click via the setup wizard, or pasted in manually) and pick a protection mode. The default mode once configured is tag-only (no blocking), so you can review flagged orders in your dashboard before turning on anything that rejects a customer. What it stops Card testing — bots running stolen card numbers through your checkout in bulk. Orders from hidden connections — VPN, proxy, Tor and datacenter addresses at checkout. Too many orders, too fast — velocity rules catch rapid repeat attempts. Details that do not match — flag orders where the billing country differs from where the customer actually is. Throwaway emails — reject checkouts using disposable email providers. Why it saves you money Screening runs during WooCommerce checkout validation — before the order is created and before any payment provider is contacted . A blocked attempt therefore never becomes a transaction, a gateway fee, or a chargeback. It works with any gateway, because it does not depend on which one you use, and it complements gateway-side tools such as Stripe Radar: your gateway only ever sees the orders that already passed the IP screen. How It Works You install and activate the plugin. Nothing happens — the plugin stays dormant until you finish setup. You connect your site. Click “Connect with Predax” in the 3-step setup wizard — this creates your free Predax account (or logs you into an existing one) and links your API key automatically, with no key to copy or paste. Prefer to do it manually? You can still paste in an existing API key instead. You pick a protection mode in Fraud Guard → Settings (or in the setup wizard). Choices: Tag + note, Block high risk, or Block critical only. On each WooCommerce checkout after that point , the plugin sends the customer’s IP address to the Predax API, receives back a risk score and signal flags (is_vpn / is_proxy / is_tor / is_datacenter), and tags / holds / blocks the order according to your configuration. Results are cached for between 5 minutes and 1 hour per IP, following the lifetime the API recommends. You can revoke the API key or switch the mode back to “Tag only” at any time. Risk Tagging Orders that reach the tag threshold (default: risk score 40) are tagged based on band: Risk 40–69 — tagged “Predax: Medium Risk” with an order note Risk 70–89 — tagged “Predax: High Risk” with an order note Risk 90–100 — tagged “Predax: Critical Risk” with an order note Features Checkout screening (after you enable a protection mode) — every order is checked against Predax IP threat intelligence VPN / Proxy / Tor / Datacenter flags — detect anonymised connections at checkout Risk score threshold blocking — optionally block checkouts above a configurable risk score Automatic order hold (opt-in) — move high-risk orders to On Hold for manual review instead of processing them Order velocity rules (opt-in) — flag or block customers placing too many orders in a short window Billing country vs IP mismatch (opt-in) — flag or block orders where billing country differs from detected IP country Disposable email detection (opt-in) — reject checkouts using throwaway email providers (30+ supported) Refund / chargeback feedback (opt-in) — when a tagged order is refunded or cancelled, add its IP to your local deny list, and/or report the outcome to the Community Threat Network (when that opt-in is enabled) Order meta logging — stores risk score, threat flags, and detected country on every order for WooCommerce reporting Events Log — a dashboard page showing blocked attempts and flagged orders One-click allow-listing — approve any IP directly from the Events Log, no settings field to edit Search-engine safe — verified crawlers (Googlebot, Bingbot) are exempt from category rules, so screening doesn’t affect how your store is crawled and indexed Screening that doesn’t cost you real customers or search traffic The real risk of a fraud rule isn’t the fraudster it misses — it’s the genuine customer it turns away without you ever finding out. A blocked shopper rarely tries again, and a store quietly dropped from search results never learns why. Fraud Guard is built to make both failure modes visible and reversible: Verified search engines are exempt from category rules. Googlebot, Bingbot, and other crawlers confirmed by reverse DNS are never caught by your VPN, proxy, datacenter, country, or risk-score rules — on both the classic and block-based checkout. Search engines crawl from datacenter IP ranges, so a datacenter rule would otherwise turn them away and erode your store’s search visibility. Threat rules and your own deny list still apply to everyone regardless. Every screening decision is on the record. The Events Log shows exactly which orders your rules flagged, held, or blocked, and why — so if a rule is too strict, you see it in the log rather than in falling sales. One-click allow-listing. Spot a good customer caught by an over-strict rule? Approve their IP straight from the Events Log — no copying it into the allow-list field — and they can check out again immediately. Combined with tag-only mode, this means you never have to guess what a rule would do: watch it tag first, turn on blocking when you’re confident, and undo any bad block in one click. Defaults All protection toggles default to off on a fresh install. The only thing the plugin writes to options on activation is a database version marker for the events-log table. You will need to explicitly enable any rule you want to apply. Free Tier Click “Connect with Predax” in the setup wizard to create your free account and link your API key automatically — no separate sign-up step, no key to copy or paste. The free plan includes 5,000 IP checks per month with full VPN/proxy/Tor/datacenter detection and risk scoring — no credit card required. More Power With Paid Plans The free tier covers a small store comfortably (checkouts are only checked when they happen, and results are cached). Busier stores use up the included checks faster — paid plans raise the monthly limit from 5,000 up to 25 million IP checks, with higher request rates and bulk lookups. The Fraud Guard settings page shows your live usage each month, so you can see exactly when it’s time to upgrade — same plugin, same settings, just a bigger allowance on your existing API key. Third Party Services This plugin connects to external services operated by Predax (https://predax.io) only after you have saved an API key: checkout screening additionally requires a protection mode to be enabled, and the admin-side account-usage lookup (described below) sends no visitor data at all. By activating this plugin and entering an API key you agree to the Predax Terms of Service and Privacy Policy . You are responsible for ensuring your use of customer IP data at checkout complies with applicable privacy laws (including but not limited to GDPR, CCPA) and your own store’s privacy policy. This plugin does not assert PCI-DSS, GDPR, or CCPA compliance on your behalf. Predax IP Intelligence API Used to look up a risk score and classification signals for each checkout IP. Data sent: the customer’s IP address at checkout; the browser-reported IANA timezone string (when available on the classic checkout form — used for the timezone-mismatch signal); your custom scoring weights (only if Custom Scoring is enabled). What is NOT sent: no billing/shipping names, street addresses, phone numbers, email addresses (only the email’s domain part, and only under the separate Email Domain Screening below), product details, prices, or payment data. The billing-country-mismatch rule compares your order’s billing country against the API’s IP-country result locally — billing details never leave your site. When: during WooCommerce checkout validation, and only while a protection mode is saved in settings. Caching: classification results are cached in the site’s transients for between 5 minutes and 1 hour per IP (the lifetime the API recommends), so repeat checkouts from the same IP do not generate duplicate API calls. Endpoint: POST https://predax.io/api/v1/check/ip Service URL: https://predax.io Terms of Service: https://predax.io/terms Privacy Policy: https://predax.io/privacy Email Domain Screening (only when the Disposable Email rule is enabled) Used to check whether the billing email’s provider is a disposable/throwaway service, against a server-side list of thousands of domains (the plugin’s built-in list covers only ~50). Data sent: the domain part of the billing email address only — for example gmail.com . The email address itself is NEVER sent: the part before the @ does not leave your site, and the mailbox-level checks (role account, random-looking name) run locally in PHP on your own server. When: during checkout validation, and only while the Disposable Email rule is set to Flag or Block. If the API is unreachable, the plugin falls back to its built-in local list and the checkout proceeds normally. Caching: email-domain results are cached in the site’s transients for up to 6 hours per domain, so repeat checkouts with the same email provider do not generate duplicate API calls. Endpoint: POST https://predax.io/api/v1/validate/email Plan usage: email-domain lookups count against your Predax plan allowance, the same as checkout IP checks. Results are cached per domain for 6 hours and the built-in list is checked first, so in practice this is roughly one lookup per new email provider your customers use. Service URL: https://predax.io Terms of Service: https://predax.io/terms Privacy Policy: https://predax.io/privacy Account Usage Lookup (admin pages only) Used to show the “API usage this month” meter on the Fraud Guard settings page, and only when an API key is saved. Data sent: your Predax API key (as the authentication header). No customer or visitor data is sent. When: when an administrator views the Fraud Guard settings page. The result is cached for 1 hour, so at most one lookup per hour regardless of admin page views. Endpoint: GET https://predax.io/api/v1/auth/usage Service URL: https://predax.io Privacy Policy: https://predax.io/privacy Predax Community Threat Network (opt-in, off by default) The plugin can optionally send an anonymised telemetry signal — the IP address, its risk score and detection flags, its network (ASN) number and name, its country code, and the checkout outcome (allowed / monitored / blocked, or refund/chargeback feedback) — to the Predax Community Threat Network so all participating stores benefit from a shared feed. The Refund / Chargeback Feedback “Log” action reports through this same channel, so it requires this opt-in; its “Blacklist” action updates your local deny list regardless. This feature is off by default . It is controlled by the ipsentry_woo_community_enabled option, which defaults to 'no' , with a checkbox on the Advanced settings tab. The plugin will not send community-feedback telemetry unless you enable it. Customers’ personal data (names, emails, billing/shipping addresses, order contents) is never included in the telemetry payload. Endpoint: POST https://predax.io/api/v1/telemetry/event Service URL: https://predax.io Privacy Policy: https://predax.io/privacy OAuth One-Click Connect (optional) Only triggered when an administrator clicks the Connect with Predax button in the setup wizard. Your browser is redirected to predax.io to authorise the connection, which returns an API key to your site. Data sent: your WordPress site URL, site name, and a PKCE state/code-challenge pair. No customer data is involved. When: only during the click-to-connect OAuth flow. Endpoint: POST https://predax.io/api/v1/oauth/token Service URL: https://predax.io Privacy Policy: https://predax.io/privacy Deactivation Feedback (optional, admin-initiated) Shown only when an administrator deactivates the plugin from the Plugins screen and chooses to answer the “why are you deactivating?” prompt. Data sent: the plugin slug, the plugin version, and a single pre-defined reason code you select (e.g. “it blocked real customers”). No site URL, no email address, no visitor data, and no IP address are sent. When: only when you select a reason and click “Send & deactivate”. Clicking “Skip & deactivate” sends nothing at all. Endpoint: POST https://predax.io/api/v1/feedback/deactivation Service URL: https://predax.io Privacy Policy: https://predax.io/privacy Cookies set by this plugin ipsentry_tz — set on WooCommerce checkout pages (only while an API key is configured) via assets/js/ipsentry-woo-tz.js . Stores the customer’s browser-reported IANA timezone (string, max 64 chars). Used server-side for the optional timezone-mismatch fraud rule. Expires after 24 hours ( max-age=86400 ), path=/ , SameSite=Lax , and marked Secure on HTTPS stores. The plugin reads this cookie only at checkout-validation time. The plugin does not set any advertising, analytics, or tracking cookies.