WooCommerce Anti-Fraud
Antivirus scan
Powered by ClamAV
✅ Verified clean
This product file has passed our security filters.
Want to run a fresh ClamAV scan right now? Takes a few seconds and shows scanner version, signature DB and live result.
This can take 5 to 30 seconds.
Clean file Threat detected
No threats detected in this file.
- File
- Size
- Scanned
- ClamAV
- Signature database
⚡ Powered by ClamAV
Scan could not be completed
Report product
If you detected an issue (broken file, malware, inappropriate content, etc.) let us know and we'll review it ASAP.
Sign in to report
About WooCommerce Anti-Fraud
For the store already hit by fake orders or card testing, not for the one expecting total armor
Opening your orders screen to find twenty failed attempts in a row, with different emails and the same card being tried, is the kind of problem this plugin solves. If your store sells little and has never seen anything odd, you may not need it yet. If you have already had a scare, or your gateway has warned you about strange activity, it makes sense.
Know the limit from the start: no anti-fraud system detects every fraudulent transaction. WooCommerce Anti-Fraud does not replace your payment gateway's security controls, does not handle chargeback disputes for you, and is not a general WordPress security plugin. It focuses on checkout, fraud risk and suspicious orders.
Card testing: the attack that doesn't look like theft
Someone testing stolen cards does not want your products: they want to know whether the card works. For you the result is a queue of failed payments, junk orders and a checkout that must stay open for real customers. The plugin tackles this with several pieces:
- Limits on repeated order attempts.
- Limits on failed payments against the same order.
- CAPTCHA at checkout, with Cloudflare Turnstile or Google reCAPTCHA v2 Checkbox.
- An Advanced counting mode that combines customer identifiers with failed payments, checkout sessions and cart patterns.
That last one matters because attackers change email or IP between attempts. Looking at a single IP or email falls short. In Advanced counting, overall store volume is not used on its own as a reason to block a customer.
WooCommerce Anti-Fraud scores risk with the signals you choose
Each order gets a risk score based on the checks you enable, and you decide the weight of each rule according to how useful it is for your business. Available signals include:
- New buyers, with no previous completed orders.
- Unusually large orders, by fixed amount or compared with your history.
- Differences between billing and shipping addresses.
- Inconsistencies between the phone's country and the billing country.
- Comparing available geolocation with billing details.
- Proxy and VPN signals, through supported checks and integrations.
- Several orders from the same IP with different delivery details.
The built-in rules work without MaxMind. MaxMind minFraud is optional, in case you want to add an external source of analysis.
What happens when an order crosses your threshold
You set the score from which an order deserves a look. You can leave statuses untouched while your team reviews, put suspicious orders on hold, cancel those above a higher threshold, get an administrator alert, or stop certain high-risk checkouts before payment. You can also automatically add high-risk emails and IPs to the block list, if you enable it.
The allow and block lists cover several customer details, so you can wave trusted buyers through and shut the door on known threats. An analytics dashboard summarizes low, medium and high-risk orders, those held or canceled, the value of higher-risk orders against revenue, and blocked email activity.
Start cautious: the classic mistake is enabling everything
There are preset settings as a starting point and a search box inside the settings. The sensible approach is to start with a few rules, see which ones weigh on good and suspicious orders, and fine-tune those instead of making broad changes that affect all your customers. After each change, test your normal checkout with your payment methods. Performance depends on your hosting, order volume, enabled checks and connected services.
There is also PayPal-specific protection, with attempt limits and optional PayPal email verification.
Frequently asked questions
Does it block orders automatically?
Only if you configure it that way. You can limit yourself to manual review, hold, cancel or block before payment.
Does it replace my payment gateway's security?
No. The recommendation is to combine it with your gateway's anti-fraud controls.
Does it work against card testing attacks?
It helps reduce them with attempt limits, CAPTCHA and Advanced counting, but it does not guarantee stopping every case.
Topics
Version history
-
v
8.0.7 Current 7 Oct 2026
-
v
8.0.6 22 Sep 2026
-
v
8.0.4 5 Sep 2026
-
v
8.0.2 5 Aug 2026
-
v
7.2.5 29 Apr 2026
Customer reviews
Sign in to leave a review. Only people who have the product can review it.
No reviews for this product yet.
Frequently asked questions
-
GPL (General Public License) is the license under which WordPress and most premium plugins/themes are distributed. It grants you the right to use, modify and redistribute the software in as many projects as you want, with no domain restrictions.
-
Yes. With membership you get automatic updates via our GPLClub Updater plugin (installed on your WP, detects new versions and applies them). With individual purchase, you get one year of manual updates from your account.
-
Depends on the plan. Monthly: 3 domains. Semi-annual: 7. Annual and Lifetime: 15. Individual purchase: 1 domain.
-
GPLClub offers its own support for installation, configuration and compatibility. For direct support from the original author (feature requests, product-specific bugs), a license purchased from the author is required.
