Description
Cash on Delivery (COD) is essential for e-commerce growth in many regions, but fraudulent orders, impulsive checkouts, and wrong delivery addresses cost merchants substantial fulfillment and return shipping fees.
SazCOD – COD Order Confirmation for WooCommerce is a lightweight, 100% self-hosted plugin that automatically intercepts COD orders containing physical goods and places them into a custom status: Awaiting Confirmation.
The buyer receives an actionable confirmation block in their order email. Clicking the link takes the customer to a secure verification screen where they explicitly confirm their order. Once confirmed, the order instantly transitions to Processing so your warehouse can safely begin packing.
Key Features
- Zero External Dependencies: 100% self-hosted. No external APIs, SMS gateways, or recurring subscriptions.
- WooCommerce HPOS Compatible: Fully compatible with High-Performance Order Storage (
custom_order_tables). - Block Checkout & Classic Checkout Support: Intercepts COD orders across both WooCommerce Checkout Block (Store API) and classic shortcode checkouts.
- Smart Physical Goods Detection: Only intercepts orders requiring physical shipping; virtual and digital orders pass through normally.
- Hardened Token Security Architecture:
- Cryptographically random, SHA-256 hashed tokens bound to the unique order.
- Encrypted at rest using AEAD AES-256-GCM with order-bound additional authenticated data (
v1:{order_id}). - Strict anti-cache headers (
Cache-Control: no-store, no-cache) to prevent intermediate caching of confirmation screens. - Synchronized 48-hour WordPress nonce lifetime matching the token TTL.
- Pre-commit business guards verifying COD payment method, awaiting-confirm status, and token hash.
- Sequential token revocation and native WooCommerce order state machine transitions to eliminate double-confirmation races.
- Post/Redirect/Get (PRG) flow with single-use opaque result tokens to eliminate order status enumeration.
- Strict Content Security Policy (
default-src 'none'), Referrer-Policy, and anti-tampering checks.
- Responsive, Clean UI: Mobile-friendly confirmation screen rendered using native styles without heavy frontend libraries.
Privacy Policy
The plugin does not transmit customer order data to external services or third-party servers. It stores only confirmation-related metadata (_qcoc_confirmed_at) in the local WooCommerce order. Customer information displayed on the self-hosted confirmation screen is retrieved directly from the merchant’s local WordPress database.
Screenshots
Installation
- Upload the plugin files to the
/wp-content/plugins/sazcod-order-confirmation-for-woocommercedirectory, or install the plugin directly through the WordPress plugins screen. - Activate the plugin through the ‘Plugins’ screen in WordPress.
- Ensure Cash on Delivery (COD) is enabled in WooCommerce > Settings > Payments.
- Test with a physical product checkout using Cash on Delivery.
FAQ
-
Does this plugin require an external service or API key?
-
No. The plugin is 100% self-hosted on your WordPress server. No third-party accounts, APIs, or ongoing fees are required.
-
What happens to virtual or downloadable orders?
-
Orders containing only virtual or downloadable items bypass the confirmation flow automatically and proceed to standard processing.
-
How long is a confirmation link valid?
-
By default, confirmation tokens remain valid for 48 hours.
-
Does it support WooCommerce High-Performance Order Storage (HPOS)?
-
Yes, HPOS compatibility is declared and fully supported.
-
What happens if I rotate the WordPress security keys (AUTH_KEY / AUTH_SALT)?
-
Since unconfirmed order tokens are encrypted at rest using keys derived from your WordPress secret salts, rotating AUTH_KEY or AUTH_SALT in wp-config.php will invalidate existing pending confirmation links. Newly placed orders after key rotation will work normally.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“SazCOD – COD Order Confirmation for WooCommerce” is open source software. The following people have contributed to this plugin.
Contributors
Translate “SazCOD – COD Order Confirmation for WooCommerce” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.2
- Added strict anti-cache headers (
Cache-Control: no-store, no-cache, must-revalidate) on confirmation preview and result screens. - Registered custom order status as non-public (
public => false,exclude_from_search => true). - Implemented immediate pre-commit business guards verifying COD payment method, status, and active token hash.
- Synchronized WordPress nonce lifetime to 48 hours for confirmation actions to prevent premature session expiry.
- Scoped plain-text email confirmation links with the customer email ID whitelist.
- Added explicit operator order note when token generation fails.
- Bundled official WordPress.org screenshot assets into release archive.
- Documented dual-layer cryptographic threat model in source code.
1.0.1
- Hardened token encryption using AEAD AES-256-GCM with order-bound additional authenticated data.
- Implemented database-backed lock with owner tokens and pre-commit fencing.
- Added single-use opaque result tokens to PRG flow to prevent result status enumeration.
- Added Store API checkout interception hook for WooCommerce Checkout Block compatibility.
- Corrected physical product shipping check for mixed carts.
- Scoped customer email notifications with dedicated ID whitelist and rel=”noopener noreferrer”.
- Standardized clean POT localization template without fuzzy flags.
1.0.0
- Initial release.