Botveil Checkout Protection for WooCommerce

FAQ

Do I need an account or API key?

No. Botveil runs entirely on your own site. There is no sign-up and no API key, and no outside service is used unless you pick a Google Font for the popup. Verification emails are sent by your store like any other WooCommerce email.

Can I try it without affecting customers?

Yes. Set Mode to Monitor only under WooCommerce → Settings → Botveil. Every checkout is checked and logged, but nobody is challenged or blocked. Review what would have happened under WooCommerce → Botveil, then switch to Enforce.

Will it block real customers?

Normal checkouts go straight through. Risky ones are asked for a code sent to their email rather than blocked. Blocking only happens for clear abuse, such as many checkout attempts from one connection or many wrong codes, and you can switch both off. You can also allowlist your own IPs and trusted customers.

Does it work with the Checkout block and my theme?

Yes. It works with both the Checkout block and the classic checkout page. The code popup copies your checkout’s fonts, colours and buttons, and you can restyle it under Settings → Botveil → Popup design.

Will it slow down checkout?

Checks run only when an order is placed, not while shoppers fill in the form, and add about four quick database lookups. Sites with a persistent object cache use it instead.

Real customers are asked for a code too often. What should I change?

Open WooCommerce → Botveil and check the “Why” column to see what triggered the code. Then raise Medium risk from score under Settings → Botveil → General, or lower the weight of that signal (usually Guest checkout) under Settings → Botveil → Signals.

Everyone is suddenly blocked. Why?

Your site is probably behind Cloudflare, another CDN or a load balancer, so every visitor appears to come from the same address. Under Settings → Botveil → Allowlist and network, add its IP ranges to Trusted proxies and set Client IP header (CF-Connecting-IP for Cloudflare). Then unblock the address under WooCommerce → Botveil.

How do I lift a ban?

Go to WooCommerce → Botveil → Blocked now and click Unblock, or use Find to look up an IP address or email.

What happens to orders held for review?

They are placed with status On hold and get an order note saying Botveil flagged them. The reasons are in the WooCommerce → Botveil event log. Process or cancel the order as usual.

Shoppers don’t receive the code email.

Codes are sent through your site’s normal mailer, so check that your store’s emails are delivered reliably (an SMTP plugin helps). You can edit the email under WooCommerce → Settings → Emails → Checkout verification code.

How do I preview the popup?

Click Preview popup on checkout under Settings → Botveil → Popup design. No code is checked in preview.

What customer data does it store?

Emails and IP addresses are stored only as scrambled fingerprints, not as readable values. A ban keeps the banned email or IP encrypted so you can see who is blocked, and it is deleted along with the ban record. Events are deleted after 30 days by default, and WordPress’s personal data export and erase tools are supported.

Something went wrong. How do I turn it off quickly?

Set Mode to Off under WooCommerce → Settings → Botveil. If you can’t reach the admin, add define( 'CSHIELD_EMERGENCY_DISABLE', true ); to wp-config.php.