Checkout Guard – Block Fake Orders, Spam & Fraud for WooCommerce

FAQ

Will this block real customers by mistake?

Set Protection Mode to Learning first. Every rule runs and records what it would have caught, but nothing is blocked and no customer is turned away. When the results look right, switch to Enforce.

Which disposable email domains are blocked?

Around 22,000, bundled with the plugin and based on the public disposable email domains list. The settings screen links to the source so you can check any domain. It is a copy taken when the plugin was released, so it will not match the source exactly.

Are forwarding services like Firefox Relay blocked?

No. Firefox Relay, Apple Hide My Email and Addy deliver to a real permanent inbox, so blocking them would reject a paying customer. They are excluded from the bundled list.

Will the junk-name rule block someone whose surname is Test?

No. Matching is exact and whole-field, never a substring, so test blocks a customer who types “Test” as their whole name but never affects Testa, Contestabile or Testani. The full list is shown on the settings screen so you can check it before switching the rule on.

How do I block an entire domain instead of just one email?

Enter *@bad-domain.com on its own line in the email blocklist. That blocks every billing email at that domain, and nothing else.

You can also enter the bare domain, bad-domain.com. The difference is precision: a bare domain matches anywhere in the address, so it will also catch someone@notbad-domain.com. The *@ form matches the domain exactly. Prefer the wildcard unless you specifically want the looser match.

What wildcard patterns can I use in the email blocklist?

The * wildcard stands for any run of characters, and the pattern must match the whole address:

• *@bad-domain.com blocks every address at that domain.
• spam*@bad-domain.com blocks spammer@bad-domain.com but leaves nice@bad-domain.com alone.
• *.edu blocks every address ending in that TLD.

Catch-all entries such as * or *@* would block every order on your store, so they are rejected and removed when you save.

Does the IP address block support wildcards?

Yes. Checkout Guard supports IPv4 wildcards, so 203.0.113.* covers that whole range. Wildcards are IPv4 only.

Does it work behind Cloudflare?

Yes. Checkout Guard reads forwarded proxy headers by default, so IP rules match the real visitor rather than the CDN edge. If your store is not behind a proxy you can switch that off in Store Setup.

Can I only allow certain countries instead of blocking?

Not currently. The country rule is a blocklist: you list the countries to turn away.

Does it work with the Checkout block?

Yes. The classic checkout, the WooCommerce Checkout block and express checkouts are all enforced, with one known exception noted below, and the plugin declares HPOS compatibility.

Are Apple Pay, Google Pay and PayPal buttons checked?

Apple Pay is, including on product and cart pages. The WooCommerce PayPal Payments gateway sends it through WooCommerce’s own checkout, so every rule runs and a blocked attempt is stopped before the order is created.

Express buttons in general are checked whenever the gateway creates its order through WooCommerce. WooPayments is covered in full: its Apple Pay, Google Pay, Link and WooPay buttons all place the order the same way the Checkout block does, so every rule runs wherever you put the button. A blocked attempt leaves nothing in your orders list.

There is one known exception. WooCommerce PayPal Payments has a setting called “Pay Now Experience”, which lets customers skip the Order Review page and is switched on for new merchants during its setup. With it on, the PayPal button on a product or cart page builds the order itself without going through WooCommerce’s checkout, and Checkout Guard does not see those orders. Support for them is planned. In the meantime, switching “Pay Now Experience” off in the PayPal settings sends those customers through the checkout page instead, where every rule runs. Apple Pay is unaffected either way.

Will this plugin slow down my store frontend?

No. Checks run during checkout validation, not on normal browsing, so browsing speed is unaffected. The bundled disposable-domain list is only loaded when you enable it, and the optional deliverability lookup is the only rule that touches the network.

Does it store customer data?

Only if you switch recording on, and it is off by default. When enabled, a blocked attempt stores the billing email, IP, cart total and which rules matched. Records are deleted automatically after the retention period you choose, 90 days by default.