FAIR

Federated and Independent Repositories

Botveil Checkout Protection for WooCommerce

Plugin Banner

Botveil Checkout Protection for WooCommerce

by berasubhajit16

Download
Description

Botveil scores every checkout attempt, on the classic shortcode checkout and the Checkout block, and decides what to do:

  • Allow – normal orders go straight through.
  • Require email code – risky orders must enter a 6-digit code sent to the billing email.
  • Hold for review – the order is placed but put on hold.
  • Block – the checkout is refused with a generic message.

How the score works

Signals add points: guest checkout, many checkout attempts from one IP, failed payments (card testing), wrong or excessive verification codes, high order value. Trusted returning customers subtract points. You choose the thresholds and the action for low, medium and high risk.

Limits and bans

  • Rate limits per IP and per email, with an inline “N attempts per X seconds / minutes / hours” setting.
  • Too many checkout attempts from an IP, or too many wrong codes for an email, blocks and bans that IP or email for a while. Repeat offences get longer bans (15 min 1 h 4 h for IPs by default). Email bans never affect a customer logged in with that email.
  • The dashboard lists active and recent bans with the IP or email, the matching customer, a link to their events, and Unblock.

Verification popup

The code popup copies your checkout’s fonts, colours, inputs and Place order button, so it looks like part of your theme. Every element can be restyled (typography, colours, spacing, borders, hover states, separate mobile values), with theme, system or Google Fonts. The code email uses your WooCommerce email design and is editable under WooCommerce Settings Emails.

Privacy by design

Emails and IP addresses are stored only as keyed hashes (HMAC-SHA256) for scoring and the event log. Only an active ban keeps the banned IP or email, encrypted, so staff can identify and lift it; it is deleted with the ban. Personal data export and erasure are supported, and the plugin suggests privacy policy text.

Monitor mode

Start in monitor mode to see what would be challenged or blocked without affecting customers, then switch to enforce.

External services

This plugin connects to Google Fonts only if an administrator picks a Google Font in Settings Botveil Popup design.

  • What and when: when the popup design is saved, the site downloads the stylesheet for the chosen families from https://fonts.googleapis.com and the font files from https://fonts.gstatic.com, and stores them in wp-content/uploads/cshield-fonts/. Shoppers’ browsers then load the fonts from your own site and never contact Google.
  • Data sent: the font family names and weights, plus the request metadata any HTTP request carries (your server’s IP address and a user agent). No visitor, customer or order data is sent.
  • Provider: Google LLC — Terms of Service, Privacy Policy, Google Fonts FAQ.

No other external service is used. Verification emails are sent through your site’s own mailer (WooCommerce / wp_mail).

  1. Install and activate WooCommerce.
  2. Upload the plugin and activate it, or install it from Plugins Add New.
  3. Go to WooCommerce Settings Botveil. New installs start in Enforce mode with safe defaults. To trial first, switch to Monitor, review WooCommerce Botveil for a few days, then switch back to Enforce.
  4. Behind Cloudflare, a CDN or a load balancer: add its IP ranges under Settings Botveil Allowlist and network Trusted proxies, and set Client IP header (e.g. CF-Connecting-IP).
  5. Optional: style the code popup under Settings Botveil Popup design, and edit the code email under WooCommerce Settings Emails Checkout verification code.
  6. Optional, for developers: define CSHIELD_SECRET in wp-config.php to keep the hashing and encryption key out of the database. Set it before going live; changing it later makes existing fingerprints and stored bans unreadable.

Settings overview

All settings are under WooCommerce Settings Botveil:

  • General – mode (Enforce, Monitor only, Off), score thresholds (medium from 30, high from 60) and the action for each risk level.
  • Signals – the weight of each signal, plus the high order value amount and the number of paid orders that make a customer trusted.
  • Rate limits – checkout attempts per IP (20 per 10 min), failed checkouts (3 per hour), wrong codes (5 per 15 min), code requests (8 per 10 min); whether the IP and wrong-code limits block; ban lengths, strike look-back and the “try again in …” message.
  • Email verification – code lifetime (5 min), attempts per code (5), wait between codes (60 s), new codes per verification (3), and how much the total may rise after verifying (10%).
  • Popup design – text, colours, fonts, spacing, borders and hover states for every popup element, with separate mobile values.
  • Allowlist and network – allowlisted IPs and emails, trusted proxies, client IP header, event retention (30 days) and delete-on-uninstall.
  1. A risky checkout asks the shopper for a 6-digit code sent to their email. The popup copies the checkout's fonts, colours and buttons.

    A risky checkout asks the shopper for a 6-digit code sent to their email. The popup copies the checkout's fonts, colours and buttons.

  2. Settings → Botveil → General: choose the mode, the risk thresholds and the action for each risk level.

    Settings → Botveil → General: choose the mode, the risk thresholds and the action for each risk level.

  3. Rate limits per IP and per email, and what happens when a limit is exceeded.

    Rate limits per IP and per email, and what happens when a limit is exceeded.

  4. Timed bans that get longer for repeat offenders.

    Timed bans that get longer for repeat offenders.

  5. Popup design: restyle every part of the verification popup, with separate mobile values.

    Popup design: restyle every part of the verification popup, with separate mobile values.

  6. The Botveil dashboard: today's activity, current bans and the event log with the reason for every decision.

    The Botveil dashboard: today's activity, current bans and the event log with the reason for every decision.

  7. Event detail: the signals that fired and their points.

    Event detail: the signals that fired and their points.

Does it work with the Checkout block?

Yes. Both the Checkout block (Store API) and the classic [woocommerce_checkout] shortcode are supported.

Will it block real customers?

Normal checkouts are allowed. Risky ones are asked for an email code rather than blocked. Blocks only happen for clear abuse (too many attempts from one IP, too many wrong codes), and both can be switched off. Allowlists exist for trusted IPs and emails.

Something went wrong. How do I turn it off quickly?

Set the mode to Off, or add define( 'CSHIELD_EMERGENCY_DISABLE', true ); to wp-config.php.

Real customers are asked for a code too often. What should I change?

Open WooCommerce Botveil and check the “Why” column to see which signals fired. Then raise Medium risk from score or lower the weight of the signal that fires most often (usually Guest checkout) under Settings Botveil.

Everyone is suddenly blocked. Why?

Your site is probably behind a proxy or CDN, so every visitor shares the proxy’s IP. Add the proxy’s IP ranges to Trusted proxies, set Client IP header, then unblock the IP under WooCommerce Botveil.

What happens to orders held for review?

They are placed with status On hold and get an order note saying Botveil flagged them. The reasons are in the WooCommerce Botveil event log. Process or cancel the order as usual.

How do I lift a ban?

Go to WooCommerce Botveil Blocked now and click Unblock, or use Find to look up an IP address or email.

How do I preview the popup?

Click Preview popup on checkout under Settings Botveil Popup design, or as an admin open your checkout page with ?cshield_preview=1 added to the URL. No code is checked in preview.

Shoppers don’t receive the code email.

Codes are sent through your site’s normal mailer, so check that your site sends email reliably (an SMTP plugin helps). The “Checkout verification code” email under WooCommerce Settings Emails is always on and can’t be disabled.

Why is the verification endpoint public?

POST /wp-json/cshield/v1/verify is where guest shoppers submit their code, so it cannot require a login. It is rate limited per IP, limited per code, and only works with an unguessable verification id.

Where is the source code?

Everything shipped is readable source: plain PHP, CSS and JavaScript with no build step. composer.json is included; vendor/ holds only Composer’s autoloader.

0.6.0

  • Renamed to “Botveil Checkout Protection for WooCommerce” (slug botveil-checkout-protection-for-woocommerce).
  • Settings and Botveil links on the Plugins screen.

0.5.2

  • Fix: the verification popup did not open on the Checkout block with WooCommerce 11+.

0.5.1

  • Removed one-time upgrade code used during development.

0.5.0

  • Renamed to “Botveil Checkout Protection for WooCommerce” (slug botveil-checkout-protection-for-woocommerce); settings, tables and hooks now use the cshield_ prefix.
  • Added readme.txt with external services documentation.
  • Monitor/off notice can be dismissed per admin and reappears if the mode changes.
  • Settings script moved to an enqueued file; database queries simplified.

0.4.4

  • Dashboard: “Blocked attempts today” and a “Recently banned” list.

0.4.3

  • Ban list shows the IP or email (encrypted at rest), customer link and events link.

0.4.0

  • Timed bans with escalation for repeat offenders.

0.3.0

  • Full popup style controls, self-hosted Google Fonts, separate mobile values.

0.2.0

  • Popup matches the theme; verification code email is a WooCommerce email.

0.1.0

  • First release.
Back to top