Description

Branching Software Order Fraud Protection for WooCommerce gives store owners a powerful, flexible blacklist system to stop fraudulent orders before they happen — without needing a paid subscription or third-party service.

Key Features

Blacklisting

Block customers at checkout by any combination of:

Email address, email domain, or email wildcard (e.g. block all @frauddomain.com or any email containing spam)
Phone number
Customer name
IP address
Billing or shipping address (full or partial match, with wildcard support)

Admin Controls

Set a custom block message shown to blocked customers at checkout
Configure a fraud attempt threshold — automatically blacklist customers after N failed attempts
“Blacklist Order” and “Remove from Blacklist” order actions directly on the order edit screen
Bulk blacklist customers from the orders list page
CSV bulk import for blacklist entries
Whitelist trusted payment gateways (bypass checks for specific gateways)
Whitelist specific customer emails (always allow through)

Blocking Rules

Block by order status — choose which statuses trigger blacklist checks
Block by product type — configure which product types are included in checks

Test / Simulation Mode

Enable Test Mode to log blocked customers without actually blocking them — safe for testing on live sites

Dashboard Widget

At-a-glance Fraud Protection Summary widget on the WordPress admin dashboard
Shows blocks this week, fraud attempts this month, and top 5 blocked reasons
Quick links to the blocked logs and fraud attempts log pages
Natively moveable and dismissible via WordPress Screen Options

Logging & Monitoring

Admin fraud logs page showing all blocked customers with reason, date, IP, and address
Database logging of fraud attempts to track repeat offenders
Admin email alert when a blocked order is attempted (configurable address)
Debug log option for troubleshooting

Security

Log files protected with .htaccess (denies direct HTTP access on Apache and Nginx)
SQL injection prevention via prepared statements throughout
CSRF (nonce) protection on all admin form submissions
Capability checks (manage_woocommerce) on all admin actions
No sensitive data exposed via HTTP responses

Credits

This plugin is based on the original Woo Manage Fraud Orders plugin (GPLv2 or later) originally developed by Prasidhda Malla, sranzan, and BrianHenryIE. The original plugin is no longer maintained and has been closed on WordPress.org. This version has been significantly extended and improved by Branching Software.

Screenshots

Settings – Blacklist Rules tab: configure the notice message shown to blocked customers, fraud attempt threshold, and additional blocking rules.

Settings – Blacklisted Data tab: manage the list of blocked emails, phone numbers, customer names, IP addresses, and billing/shipping addresses. — Settings – Blacklist Rules tab: configure the notice message shown to blocked customers, fraud attempt threshold, and additional blocking rules.

Installation

Download and Upload the plugin folder ‘branching-software-order-fraud-protection’ to the /wp-content/plugins/ directory, or install the plugin through the WordPress plugins screen directly.
Activate the plugin through the ‘Plugins’ screen in WordPress.
Configure your rules under WooCommerce Settings Fraud Protection, or open any order and choose the “Blacklist order” order action to add that customer’s details to the blacklists.
Then, you are done. It will block all the blacklisted customers from checking out.

FAQ

What if a regular customer complains about being blocked?

Navigate to WooCommerce Settings Fraud Protection Blacklisted Data and remove the customer’s details from the blacklists.
Navigate to Fraud Protection Fraud Attempt Logs and remove the customer’s entries from the fraud attempt logs.
Or whitelist the customer under WooCommerce Settings Fraud Protection Whitelist so they bypass all checks.

Can I add zipcode or city Address in the blacklist?

Yes. This feature is available from version 2.1.0.

Can I use email wildcard for blacklisting?

Yes, absolutely. This feature is available from version 2.4.0. You can enter the wildcard entry without an asterisk (*). E.g. If you put “john”, It will block orders from every email containing the string “john”, john@gmail.com, john@yahoo.com, johndoe@anyhting.com, avfjohndev@anything.com and so on.

What is the basic rule for address blacklisting?

The full syntax for block by address is,
“Street address 1, Address 2, City, State, ZIPCODE, Country”

Also, the partial address can also be used. For example, “Springfield, US” will block every order in every city named Springfield in the US;
Likewise, “90210” will block all orders to that zip code.

Similarly, “Springfield, IL” will block all the orders from an address in a city named “Springfield” in the state “Illinois”.

“Springfield” will block every order from “Springfield”.
“IL” will block every order from the state “IL”.
“US” will block orders from country “United States” and so on.

So, the very simple rule is, you can create any combination of address fields “Street address 1, Address 2, City, State, ZIPCODE, Country” separated by a comma as needed.

How do we blacklist the customer’s detail?

There are three ways to blacklist a customer. First, open the order edit page, choose “Blacklist order” in the “Order actions” section and update the order — it will add the customer’s details to the blacklists. Second, navigate to WooCommerce Settings Fraud Protection Blacklisted Data, where you can manually edit the lists of blocked names, phones, emails, email domains, IP addresses, and addresses. Third, select multiple orders on the orders list page and use the bulk “Blacklist” action.

Is there wildcard rule for address blacklisting?

Yes, There is. Wildcard must be in the format of “%address%”; enclosed by “%”. For example; If you put the “%Springfield%” as a wildcard rule for address, It will block the order if there is any match of “Springfield” within any of the customer’s address(Street address, address line 2, city etc.)

Is there auto blacklisting system as well?

Yes, there is. But this auto system will be in action only for those payment gateways which authorizes the payment details and charge instantly (Electronic Check, Credit Card) etc.

What is the process for automatic blacklisting system?

Let us take an example of Electronic check payment gateway. When customer successfully validates the payment fields like “Route Number”, “Account Number” & “Check Number” fields, those values will be sent for authorizing. If Bank couldn’t authorize those customer details, the woo commerce will mark the order as “Failed”. Then, same customer may try to create the multiple number of “Failed” orders. This plugin will track that behavior and blacklist the customer from future checkout.

Can I remove the customer details from blacklist?

Yes, absolutely. You can either edit the lists under WooCommerce Settings Fraud Protection Blacklisted Data, or do it from the order edit page with the “Remove from Blacklist” order action.

Can I prevent the customer based on their previous order status?

Yes, absolutely. You can choose multiple order statuses in the settings, and this is completely compatible with WooCommerce Order Status Manager.

Can I whitelist customer details or anything?

Yes. From version 2.3.0, you can whitelist payment gateways and specific users. You can use either an email address or a WP user ID.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Branching Software Order Fraud Protection for WooCommerce” is open source software. The following people have contributed to this plugin.

Branching Software

Translate “Branching Software Order Fraud Protection for WooCommerce” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

3.0.0

security: Debug logs are now written as plain .log files with randomized names — the plugin never writes executable PHP files; legacy log files are migrated automatically
dev: All admin CSS and JS is now registered via wp_enqueue_style()/wp_enqueue_script() (no inline style/script tags)
dev: Consistent wmfo prefix applied to the main plugin class, global variables, and helper functions
feat: Added WooCommerce admin dashboard widget (Fraud Protection Summary) showing blocks this week, fraud attempts this month, and top 5 blocked reasons (issue #27)
tests: Added PHPUnit unit test suite for the dashboard widget (10 test cases)
tests: Added Playwright E2E test suite for the dashboard widget (10 test cases including screenshot capture)
rebranding: Renamed plugin to “Order Fraud Protection for WooCommerce” (Branching Software)
feat: Added complete E2E test suite (27 Playwright tests) and PHPUnit test suite (28 tests)
feat: Added uninstall.php to cleanly remove all plugin data on uninstall
feat: Added HPOS (High-Performance Order Storage) compatibility
feat: Added CSV bulk import for blacklist entries
feat: Added bulk blacklist action on orders list page
feat: Added Test/Simulation Mode — logs blocked customers without blocking them
feat: Added admin fraud logs page with full attempt history
feat: Added “Blacklist Order” and “Remove from Blacklist” order actions
feat: Added admin email alert on block with configurable recipient address
feat: Added opt-in “Trust Proxy Headers” setting for correct client IP detection behind reverse proxies / CDNs
security: Full security audit — randomized debug-log filenames, blacklist options no longer autoloaded, CSV formula-injection hardening
security: Hardened log file protection (.htaccess + index.php guard)
security: All DB queries use prepared statements
security: CSRF nonce verification on all admin forms and AJAX calls

2.7.0

feat: Added HPOS (High-Performance Order Storage) compatibility declaration and storage-agnostic order lookups.
ui: Refreshed Fraud Protection settings interface and switched accent colors to Branching Software blue (#0B3366).
feat: Added a “What’s New” sidebar card with recent improvements and visible plugin version in admin settings footer.
feat: Added CSV export actions for blocked logs and fraud attempt logs.
security: Added Nginx-compatible debug log hardening with active 403 index response and protected .php log format.

2.6.2

security: Fixed unauthenticated information exposure via log files (CVE)
security: Added .htaccess protection to prevent direct access to log files
security: Added index.php to prevent directory listing
security: Improved SQL injection prevention with proper data sanitization
security: Fixed nonce verification in bulk blacklist operations

2.6.1

fix: balckilisting by email
add: enable/disable option for email wildcard blocking

2.6.0

fix: possible server error in settings page section

2.5.6

fix: Optional checkout fields issue with blocking legitimate orders

2.5.5

Compatibility check WP 5.9.2
Compatibility check WC 6.3.1

2.5.4

fix: typecast removal from functions

2.5.3

fix: bulk blacklisting with other third party plugins compatibility

2.5.2

fix: empty billing email fix

2.5.1

fix: wildcard email block

2.5.0

add: wildcard address blocking
add: order cancelled metadata
remove: cookie based blocking removal

2.4.1

fix: fatal error on order status change to “failed”
fix: undefined checkout fields

2.4.0

feat: email blacklisting wildcard
feat: fraud attempt tracked from SERVER

2.3.2

feat: enable/disable option for blacklisted by address

2.3.1

fix: garbage clean: related to 2-3-bug-query-per-user-in-admin.

2.3.0

feat: whitelisting by payment gateways and the specific users.

2.2.1

fix: disabled checkout field with corresponding empty blacklisted options blocking the order placement

2.2.0

feature: Debug log and DB log of order placement restriction

2.1.1

fix: update on customer address
fix: multisite plugin on active error
Compatibility check WC 5.5.1

2.1.0

feat: block by customer billing address

2.0.2

fix: order get_type() on bool error check
Compatibility check WC 5.4.1

2.0.1

fix: fraud attempts
Compatibility check WC 5.4.0

2.0.0

feature: blacklisting by product types
feature: skip blacklisting for order payment page
Compatibility check WC 5.1.0

1.7.2

fix: order status cancelled on blacklisting from backend
Compatibility check WC 5.0.0

1.7.1

add: compatibility check with eWay
Compatibility check WC 4.9.2

1.7.0

Feat: blacklisting with “order-pay” action
Compatibility check WC 4.9.1

1.6.2

Fixes to “conflict with WooCommerce payment hook” issued on github repo.
“Removed from blacklist” order note added.
“Bulk blacklist” safe redirect fix.

1.6.1

Compatibility check with WP 5.6 & WC 4.8.0

1.6.0

Compatibility check with WC 4.6.1
Blocking by email domain

1.5.5

Compatibility check with WP 5.5 & WC 4.4.1

1.5.4

Compatibility check with WC 4.3.0

1.5.3

Compatibility check with WC 4.2.2

1.5.2

Order statuses multiselect setting UI change.
Blacklist by order status bug fixes.

1.5.1

Translation bug fixes.

1.5.0

Bocking by customer name feature added.
Compatibility check with WC 4.2.0.

1.4.9

Compatibility check with WC 4.1.0.

1.4.8

checkout blocking parameters fixes.

1.4.7

default allowed fraud attempts fixed.

1.4.6

bulk blacklisting notification fixes.

1.4.5

Compatibility with woocommerce 3.7.0

1.4.3

Compatibility with woocommerce 3.6.3.

1.4.1

“Order Statuses” setting label bug fixed.

1.4.0

Order placement prevention based on order status added.

1.3.0

Feature of removing customer details from blacklists added.
Format of saving the blacklist option changed from comma separated to new line values
DB update option added.

1.2.2

Translation text domain added.

1.2

Bulk Blacklisting options added in orders listing page.

1.0.3

Duplication of the blacklisted emails, phones and IPs removed.

1.0.2

Minor bug fixed.

1.0.1

Dependency check added.

1.0.0

First Version