Botveil scores every checkout attempt, on the classic shortcode checkout and the Checkout block, and decides what to do:<\/p>\n\n
Signals add points: guest checkout, many checkout attempts from one IP, failed payments (card testing), wrong or excessive verification codes, high order value. Trusted returning customers subtract points. You choose the thresholds and the action for low, medium and high risk.<\/p>\n\n
The code popup copies your checkout's fonts, colours, inputs and Place order button, so it looks like part of your theme. Every element can be restyled (typography, colours, spacing, borders, hover states, separate mobile values), with theme, system or Google Fonts. The code email uses your WooCommerce email design and is editable under WooCommerce \u2192 Settings \u2192 Emails.<\/p>\n\n
Emails and IP addresses are stored only as keyed hashes (HMAC-SHA256) for scoring and the event log. Only an active ban keeps the banned IP or email, encrypted, so staff can identify and lift it; it is deleted with the ban. Personal data export and erasure are supported, and the plugin suggests privacy policy text.<\/p>\n\n
Start in monitor mode to see what would be challenged or blocked without affecting customers, then switch to enforce.<\/p>\n\n
This plugin connects to Google Fonts<\/strong> only if an administrator picks a Google Font in Settings \u2192 Botveil \u2192 Popup design.<\/p>\n\n No other external service is used. Verification emails are sent through your site's own mailer (WooCommerce \/ All settings are under WooCommerce \u2192 Settings \u2192 Botveil:<\/p>\n\n No. Botveil runs entirely on your own site. There is no sign-up and no API key, and no outside service is used unless you pick a Google Font for the popup. Verification emails are sent by your store like any other WooCommerce email.<\/p><\/dd>\n Yes. Set Mode<\/strong> to Monitor only<\/strong> under WooCommerce \u2192 Settings \u2192 Botveil. Every checkout is checked and logged, but nobody is challenged or blocked. Review what would have happened under WooCommerce \u2192 Botveil, then switch to Enforce<\/strong>.<\/p><\/dd>\n Normal checkouts go straight through. Risky ones are asked for a code sent to their email rather than blocked. Blocking only happens for clear abuse, such as many checkout attempts from one connection or many wrong codes, and you can switch both off. You can also allowlist your own IPs and trusted customers.<\/p><\/dd>\n Yes. It works with both the Checkout block and the classic checkout page. The code popup copies your checkout's fonts, colours and buttons, and you can restyle it under Settings \u2192 Botveil \u2192 Popup design.<\/p><\/dd>\n Checks run only when an order is placed, not while shoppers fill in the form, and add about four quick database lookups. Sites with a persistent object cache use it instead.<\/p><\/dd>\n Open WooCommerce \u2192 Botveil and check the \"Why\" column to see what triggered the code. Then raise Medium risk from score<\/strong> under Settings \u2192 Botveil \u2192 General, or lower the weight of that signal (usually Guest checkout) under Settings \u2192 Botveil \u2192 Signals.<\/p><\/dd>\n Your site is probably behind Cloudflare, another CDN or a load balancer, so every visitor appears to come from the same address. Under Settings \u2192 Botveil \u2192 Allowlist and network, add its IP ranges to Trusted proxies<\/strong> and set Client IP header<\/strong> ( Go to WooCommerce \u2192 Botveil \u2192 Blocked now and click Unblock<\/strong>, or use Find<\/strong> to look up an IP address or email.<\/p><\/dd>\n They are placed with status On hold and get an order note saying Botveil flagged them. The reasons are in the WooCommerce \u2192 Botveil event log. Process or cancel the order as usual.<\/p><\/dd>\n Codes are sent through your site's normal mailer, so check that your store's emails are delivered reliably (an SMTP plugin helps). You can edit the email under WooCommerce \u2192 Settings \u2192 Emails \u2192 Checkout verification code.<\/p><\/dd>\n Click Preview popup on checkout<\/strong> under Settings \u2192 Botveil \u2192 Popup design. No code is checked in preview.<\/p><\/dd>\n Emails and IP addresses are stored only as scrambled fingerprints, not as readable values. A ban keeps the banned email or IP encrypted so you can see who is blocked, and it is deleted along with the ban record. Events are deleted after 30 days by default, and WordPress's personal data export and erase tools are supported.<\/p><\/dd>\n Set Mode<\/strong> to Off<\/strong> under WooCommerce \u2192 Settings \u2192 Botveil. If you can't reach the admin, add \n
https:\/\/fonts.googleapis.com<\/code> and the font files from https:\/\/fonts.gstatic.com<\/code>, and stores them in wp-content\/uploads\/cshield-fonts\/<\/code>. Shoppers' browsers then load the fonts from your own site and never contact Google.<\/li>\nwp_mail<\/code>).<\/p>\n\n\n\n
CF-Connecting-IP<\/code>).<\/li>\nCSHIELD_SECRET<\/code> in wp-config.php<\/code> to keep the hashing and encryption key out of the database. Set it before going live; changing it later makes existing fingerprints and stored bans unreadable.<\/li>\n<\/ol>\n\nSettings overview<\/h4>\n\n
\n
\n
Do I need an account or API key?<\/h3><\/dt>\n
Can I try it without affecting customers?<\/h3><\/dt>\n
Will it block real customers?<\/h3><\/dt>\n
Does it work with the Checkout block and my theme?<\/h3><\/dt>\n
Will it slow down checkout?<\/h3><\/dt>\n
Real customers are asked for a code too often. What should I change?<\/h3><\/dt>\n
Everyone is suddenly blocked. Why?<\/h3><\/dt>\n
CF-Connecting-IP<\/code> for Cloudflare). Then unblock the address under WooCommerce \u2192 Botveil.<\/p><\/dd>\nHow do I lift a ban?<\/h3><\/dt>\n
What happens to orders held for review?<\/h3><\/dt>\n
Shoppers don't receive the code email.<\/h3><\/dt>\n
How do I preview the popup?<\/h3><\/dt>\n
What customer data does it store?<\/h3><\/dt>\n
Something went wrong. How do I turn it off quickly?<\/h3><\/dt>\n
define( 'CSHIELD_EMERGENCY_DISABLE', true );<\/code> to wp-config.php<\/code>.<\/p><\/dd>\n\n<\/dl>\n\n\n0.6.0<\/h4>\n\n
\n
0.5.2<\/h4>\n\n
\n
0.5.1<\/h4>\n\n
\n
0.5.0<\/h4>\n\n
\n
checkout-sentinel-for-woocommerce<\/code>); settings, tables and hooks now use the cshield_<\/code> prefix.<\/li>\nreadme.txt<\/code> with external services documentation.<\/li>\n0.4.4<\/h4>\n\n
\n
0.4.3<\/h4>\n\n
\n
0.4.0<\/h4>\n\n
\n
0.3.0<\/h4>\n\n
\n
0.2.0<\/h4>\n\n
\n
0.1.0<\/h4>\n\n
\n