=== Fraud and Scam Detection For WooCommerce === Contributors: linknacional Donate link: https://www.linknacional.com.br/wordpress/ Tags: woocommerce, antifraud, recaptcha, security, cloudflare Requires at least: 5.8 Tested up to: 7.0 Stable tag: 1.3.1 Requires PHP: 8.2 Requires Plugins: woocommerce License: GPL-2.0+ License URI: http://www.gnu.org/licenses/gpl-2.0.txt Add Google reCAPTCHA or Cloudflare Turnstile verification to WooCommerce checkout to prevent fraudulent transactions. == Description == The **Fraud and Scam Detection For WooCommerce** plugin helps protect your online store by adding a verification layer to the WooCommerce checkout. Using **Google reCAPTCHA** or **Cloudflare Turnstile**, the plugin automatically analyzes user interactions and blocks suspicious checkout attempts, reducing fraudulent transactions and ensuring safer payments. **Main Features:** - Integration with **Google reCAPTCHA v3**; - Integration with **Cloudflare Turnstile**; - Protects WooCommerce checkout against automated bots and fraudulent activity; - Configurable minimum score threshold for human-like behavior detection (reCAPTCHA); - **Configurable antifraud behavior** — choose whether to block the order, mark it as fraud, add an internal note, or any combination of these actions; - **Advanced IP banning** — ban IPs for a defined duration (hours, days, weeks, months, years) or permanently, with automatic expiration for temporary bans; - IP lookup and order filtering by IP directly from the order detail page; - **Data-based blocking** — block orders by email address, email domain, phone number, country, or device fingerprint; - Lightweight and optimized for performance. **Dependencies** This plugin requires [WooCommerce](https://woocommerce.com/) to be installed and active. For Google reCAPTCHA, you also need valid [Google reCAPTCHA API keys](https://www.google.com/recaptcha/admin/create). For Cloudflare Turnstile, you need valid [Cloudflare Turnstile site and secret keys](https://dash.cloudflare.com/?to=/:account/turnstile). **User instructions** 1. Go to WordPress admin panel > WooCommerce > Settings > Anti-Fraud; 2. Enable the antifraud option and choose between **Google reCAPTCHA** or **Cloudflare Turnstile**; 3. Enter the corresponding **Site Key** and **Secret Key** for the chosen service; 4. For reCAPTCHA: set the **minimum score threshold** (higher values = stricter validation); 5. Optionally enable **IP check** to ban specific IP addresses from checkout; 6. Optionally enable **debug mode** to log requests and responses; 7. Save the settings. From now on, the WooCommerce checkout will require security validation. == External services == This plugin integrates with Google reCAPTCHA v3 and Cloudflare Turnstile to provide fraud and bot protection for WooCommerce checkout processes. **Google reCAPTCHA v3** What the service is and what it is used for: Google reCAPTCHA v3 is a security service that analyzes user behavior to determine if a user is likely human or bot. It's used to protect the WooCommerce checkout process from automated fraud attempts and malicious activities. What data is sent and when: When a customer attempts to complete a checkout, the plugin sends the following data to Google reCAPTCHA servers: - User's IP address - Browser and device information - User interaction patterns during checkout - reCAPTCHA response token - Google reCAPTCHA Terms of Service: https://developers.google.com/recaptcha/docs/terms - Google Privacy Policy: https://policies.google.com/privacy **Cloudflare Turnstile** What the service is and what it is used for: Cloudflare Turnstile is a privacy-friendly CAPTCHA alternative that verifies users without tracking or invasive data collection. It's used to protect the WooCommerce checkout from bots and fraudulent activity. What data is sent and when: When a customer attempts to complete a checkout, the plugin sends the Turnstile response token to Cloudflare servers for validation: - Turnstile response token - User's IP address (handled by Cloudflare) - Cloudflare Turnstile Terms of Service: https://www.cloudflare.com/terms/ - Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/ == Installation == 1. Look in the sidebar for the WordPress plugins area; 2. In installed plugins look for the option 'add new'; 3. Click on the 'send plugin' option in the page title and upload the fraud-scam-detection-woocommerce.zip plugin; 4. Click on the 'install now' button and then activate the installed plugin; 5. Now go to WooCommerce settings > Anti-Fraud; 6. Enter your Google reCAPTCHA credentials, configure the minimum score, and save. == Frequently Asked Questions == = What is the plugin license? = * This plugin is released under a GPL license. = What is needed to use this plugin? = * WooCommerce installed and active; * Google reCAPTCHA API keys (if using reCAPTCHA); * Cloudflare Turnstile site and secret keys (if using Turnstile). = How does the minimum score work? = * Google reCAPTCHA v3 assigns a score between 0.0 (likely a bot) and 1.0 (likely human). You can configure the threshold in plugin settings to determine how strict the validation should be. = How does the antifraud behavior work? = * When fraud is detected, the plugin can perform one or more of the following actions — independently or combined: - **Block Order**: prevents the order from being placed and returns an error to the customer; - **Mark Order as Fraud**: changes the order status to the custom fraud status for manual review, without necessarily blocking the transaction; - **Add Note to Order Only**: adds an internal note with detection details without blocking or changing the order status. This lets store owners choose between a conservative approach (observe and log) or a strict one (block immediately). = How does the IP banning system work? = * When the **Ban IPs** option is active, a ban/unban panel appears on each order detail page. You can also manage the full list of banned IPs in **WooCommerce > Settings > Anti-Fraud > Banned IPs**. The improved ban system supports **temporary bans** with a configurable duration (hours, days, weeks, months, or years) that expire automatically, as well as **permanent bans** by selecting the “Forever” unit. Any customer attempting to checkout from a banned IP within the active ban period will be blocked and the configured antifraud behavior will be applied. == Changelog == = 1.3.1 = * New option to ban by phone number via order notes. = 1.3.0 = * New data-based blocking system. = 1.2.1 = * Fix default state of checkboxes on the settings page. = 1.2.0 = * New security verification system with Cloudflare Turnstile. * New IP banning system. = 1.1.9/1.1.10 = * New banners according to country. = 1.1.8 = * New layout for the plugin images. = 1.1.7 = * Fix the plugin URL. = 1.1.6 = * Change actions. = 1.1.5 = * Fix Wordpress issues. = 1.1.4 = * Fix Wordpress issues. = 1.1.3 = * Remove plugin updater. = 1.1.2 = * Change plugin title. = 1.1.1 = * Fix GitHub actions. = 1.1.0 = * Add compatibility with shortcode form. = 1.0.0 = * Plugin launch with Google reCAPTCHA integration for WooCommerce checkout. == Upgrade Notice == = 1.3.1 = * New option to ban by phone number via order notes. = 1.3.0 = * New antifraud behavior controls, configurable IP ban duration, and data-based blocking by email, phone, country, and device fingerprint. = 1.2.1 = * Fix default state of checkboxes on the settings page. = 1.2.0 = * New security verification system with Cloudflare Turnstile and IP banning feature. = 1.1.9/1.1.10 = * New banners according to country. = 1.1.8 = * New layout for the plugin images. = 1.1.7 = * Fix the plugin URL. = 1.1.6 = * Change actions. = 1.1.5 = * Fix Wordpress issues. = 1.1.4 = * Fix Wordpress issues. = 1.1.3 = * Remove plugin updater. = 1.1.2 = * Change plugin title. = 1.1.1 = * Fix GitHub actions. = 1.1.0 = * Add compatibility with shortcode form. = 1.0.0 = * Plugin launch.