Checkout Firewall protects Classic, Blocks, and supported Store API checkout with signed flow proof, local evidence, velocity controls, recoverable challenges, temporary blocks, and Emergency Mode. WooCommerce is required. New installations begin in Observe Mode; enforcement starts only after an administrator enables Standard Mode.<\/p>\n\n
Free includes narrow exact-IP, CIDR, and authenticated-user exemptions plus a local incident notice and optional rate-limited WordPress email. Exemptions never bypass manual blocks or invalid\/replayed proof; incident signals are not fraud determinations.<\/p>\n\n
Free works locally without a Codeprint or Freemius account, and anonymous use creates no licensing traffic. WordPress.org distributes and updates this complete Free plugin. An optional, explicit Freemius connection supports account and purchase surfaces for the separately distributed Premium replacement plugin. Checkout security, shopper, order, gateway, and payment data is not sent to Codeprint or Freemius.<\/p>\n\n
Checkout Firewall never reads or stores card data and never automatically disables a payment gateway. It cannot stop all fraud or guarantee against chargebacks.<\/p>\n\n
Cloudflare is optional. Direct and verified Cloudflare traffic is recognized automatically; another reverse proxy requires explicit trusted ranges.<\/p>\n\n
Checkout Firewall is an independent Codeprint product, not endorsed by WooCommerce, Automattic, Cloudflare, Google, or Freemius.<\/p>\n\n
Checkout Firewall processes abuse signals locally using HMAC-derived identifiers and masked hints, not card data, gateway payloads, or request bodies. Activity and terminal blocks are retained for at most seven days; masked block hints for at most 90 days. A temporary keyed order snapshot is removed after a recorded payment outcome and otherwise follows Activity retention. WordPress email erasure removes directly attributable records. Full uninstall deletion requires explicit administrator opt-in.<\/p>\n\n
Observe Mode stores bounded aggregate would-intervene records while allowing checkout. Exact IPs are keyed; authenticated-user exemptions store local user ID; narrow CIDRs remain readable only for range matching.<\/p>\n\n
The randomized honeypot, signed timing evidence, and default account-free browser proof are evaluated locally. They are supporting automation friction, not proof of humanity.<\/p>\n\n
Selected Turnstile or reCAPTCHA loads only after a challenge and may process browser\/network signals. Server verification omits the optional shopper IP and sends no payment details.<\/p>\n\n
Optional Freemius connection may share administrator name\/email, site URL, versions, license\/installation identifiers, and activation state for account, purchase, Premium licensing, and Premium updates. Site-profile, diagnostic, extension-inventory, and newsletter permissions are disabled; anonymous activation and Skip send nothing. Free updates come from WordPress.org.<\/p>\n\n
The support snapshot is generated locally and is not uploaded. It excludes site\/customer identity, orders, gateways, credentials, requests, logs, and raw errors.<\/p>\n\n
These services are conditional; local protection needs no Codeprint account:<\/p>\n\n
Freemius.<\/strong> Contacted only after explicit connection, or by the separately installed Premium plugin for connected licensing\/update functions; never per checkout. Anonymous activation and Skip send nothing. Free updates come from WordPress.org. Service<\/a>, Terms<\/a>, Privacy<\/a>.<\/p>\n\n Cloudflare Turnstile.<\/strong> Contacted only when selected\/configured and local signals require a challenge. Browser\/network signals, response token, and merchant secret may be processed; optional shopper IP and payment details are not sent by Checkout Firewall. Service<\/a>, Terms<\/a>, Privacy<\/a>.<\/p>\n\n Google reCAPTCHA.<\/strong> Contacted only when selected\/configured and local signals require a challenge. Browser\/network signals, response token, and merchant secret may be processed; optional shopper IP and payment details are not sent by Checkout Firewall. Service<\/a>, API Terms<\/a>, Terms<\/a>, Privacy<\/a>.<\/p>\n\n