<ul class="wccom-tick-list-primary">
<li><strong>Set custom risk scoring rules based on order behavior, IP location, and customer details</strong></li>
<li><strong>Assign individual weights (0–10) to each rule to calculate a dynamic risk percentage per order</strong></li>
<li><strong>Enable or disable specific risk conditions like first-time buyer, high-risk countries, or billing/shipping mismatch</strong></li>
<li><strong>Blacklist fraudulent orders by email, domain, IP address, phone number, country, state, or zip code</strong></li>
<li><strong>Restrict orders from specific user roles, proxy users, or previously flagged addresses</strong></li>
<li><strong>Customize the error message shown to blocked customers during checkout</strong></li>
<li><strong>Whitelist trusted customers by email, domain, IP address, payment method, or shipping region</strong></li>
<li><strong>Whitelist overrides blacklist to ensure smooth ordering for safe users</strong></li>
<li><strong>View calculated risk score directly inside the WooCommerce order detail page for transparency</strong></li>
<li><strong>Detect and block bulk bot orders or repeated transactions from the same customer</strong></li>
<li><strong>Supports all WooCommerce payment gateways and shipping methods out of the box</strong></li>
<li><strong>Lightweight, fast, and designed to run fraud checks without affecting checkout performance</strong></li>
</ul>
<hr class="wccom-product-single__section-hr" />
<h2>Why Anti-Fraud Protection Is Essential for WooCommerce Stores</h2>
<p>Running an online store today means more than just selling products—it also means defending your business against the growing threat of digital fraud. With online transactions increasing, fraudsters have become smarter, targeting vulnerable WooCommerce stores with fake orders, stolen credit cards, and automated attacks. What may seem like a single suspicious order could actually be part of a larger fraud pattern designed to exploit your store’s checkout process.</p>
<p>Every unauthorized transaction not only chips away at your revenue but also burdens you with refund requests, chargeback penalties, and customer trust issues. If left unchecked, these risks can snowball into serious operational damage.</p>
<p><strong>Anti-Fraud Protection for WooCommerce</strong> offers a powerful, easy-to-use solution to detect and stop fraudulent behavior before it affects your bottom line. Whether it’s blocking high-risk IPs, preventing bulk bot checkouts, or detecting mismatches between customer details and locations, this plugin gives you complete control to define what’s risky—and what’s not.</p>
<p>From solo entrepreneurs to high-volume stores, this tool is especially useful during:</p>
<ul>
<li>Product launches or holiday sales—when fraud attempts spike</li>
<li>Accepting international orders or unfamiliar payment methods</li>
<li>Detecting rapid order frequency from the same user or region</li>
<li>Blocking suspicious email domains or repeat offenders</li>
</ul>
<h2>Benefits</h2>
<h3>Risk Score Rules – Dynamic Fraud Risk Evaluation</h3>
<p>These features in <strong>Anti Fraud Protection plugin</strong> allow you to intelligently analyze and score orders based on custom-defined conditions. Each rule can be toggled on/off and assigned a weight from 0–10, contributing to a final risk percentage per order.</p>
<figure id="attachment_18734005209130" aria-describedby="caption-attachment-18734005209130" style="width: 495px" class="wp-caption alignnone"><img class="wp-image-18734005209130 size-medium" title="Risk analysis of fraud detection score" src="https://woocommerce.com/wp-content/uploads/2025/04/risk-analysis.png?w=495" alt="Fraud real time Risk Analysis" width="495" height="590" /><figcaption id="caption-attachment-18734005209130" class="wp-caption-text">Fraud protection risk analysis</figcaption></figure>
<h4>Detailed Features:</h4>
<ul class="">
<li><strong>First-Time Order Detection:</strong> Flag orders placed by new customers with no previous order history.</li>
<li><strong>Billing and Shipping Address Mismatch:</strong> Detect when billing and shipping details don’t align—a common fraud signal.</li>
<li><strong>IP Country vs Billing Country Mismatch:</strong> Compare geolocation from IP with billing country for suspicious differences.</li>
<li><strong>IP Country vs Shipping Country Mismatch:</strong> Flag orders where the shipping country doesn’t match IP location.</li>
<li><strong>International Order Flag:</strong> Automatically tag cross-border orders that may carry a higher fraud risk.</li>
<li><strong>High-Risk Email Domain Detection:</strong> Block orders using throwaway or temporary email domains.</li>
<li><strong>High-Risk Countries Filter:</strong> Mark specific countries as high risk and evaluate accordingly.</li>
<li><strong>Order Amount Threshold Check:</strong> Add risk weight to high-value purchases exceeding a set amount.</li>
<li><strong>Custom Risk Scoring:</strong> Assign weights to rules (0–10) to build a dynamic total risk percentage.</li>
<li><strong>Order Risk Score Display:</strong> See risk scores in real-time on the WooCommerce order detail page.</li>
</ul>
<figure id="attachment_18734005209093" aria-describedby="caption-attachment-18734005209093" style="width: 896px" class="wp-caption alignnone"><img class="wp-image-18734005209093 size-medium" title="Configure rules to prevent card testing attacks and velocity attacks and prevent block fake orders" src="https://woocommerce.com/wp-content/uploads/2025/04/WooCommerce-settings_ca83fd.png?w=896" alt="Fraud protection rules" width="896" height="1293" /><figcaption id="caption-attachment-18734005209093" class="wp-caption-text">Configure rules to detect block fake orders.</figcaption></figure>
<h3>Blacklist System – Block Suspicious Customers Automatically</h3>
<p>With <strong>Anti Fraud Protection Plugin</strong> stop fraudulent transactions before they happen by blacklisting emails, IPs, and shipping regions. This feature provides instant order blocking for high-risk criteria.</p>
<ul class="">
<li><strong>Block Specific Email Addresses:</strong> Manually block known fraudulent email accounts.</li>
<li><strong>Block Email Domains:</strong> Prevent entire domains like <code>tempmail.com</code> from placing orders.</li>
<li><strong>Phone Number Blocking:</strong> Restrict transactions from suspicious or spam phone numbers.</li>
<li><strong>IP Address Blocking:</strong> Add single or multiple IPs to the blacklist to prevent future orders.</li>
<li><strong>IP Country Blocking:</strong> Restrict orders from high-risk countries based on geolocation.</li>
<li><strong>User Role Restrictions:</strong> Block roles like Guest, Subscriber, or custom roles from ordering.</li>
<li><strong>Shipping Address Blocking:</strong> Identify and stop orders going to fraudulent addresses.</li>
<li><strong>Block Shipping Country, State, or Zip Code:</strong> Deny orders from flagged locations to prevent repeat fraud.</li>
<li><strong>Customizable Error Messages:</strong> Show a tailored checkout message when an order is blocked.</li>
</ul>
<figure id="attachment_18734005209091" aria-describedby="caption-attachment-18734005209091" style="width: 896px" class="wp-caption alignnone"><img class="wp-image-18734005209091 size-medium" title="Rule to configure blacklisting settings to protect site from fraud orders" src="https://woocommerce.com/wp-content/uploads/2025/04/blacklist-order-settings_caa1c0.png?w=896" alt="Black list orders and users" width="896" height="775" /><figcaption id="caption-attachment-18734005209091" class="wp-caption-text">Black list specific orders to prevent fake orders and minimize card testing attacks.</figcaption></figure>
<h3>Whitelist System – Allow Trusted Users to Bypass Anti Fraud Checks</h3>
<p>Ensure seamless transactions for VIPs, employees, or trusted clients. Whitelisted users always bypass <strong>Anti Fraud</strong> filters, even if other conditions are met.</p>
<ul class="">
<li><strong>Whitelist Specific Email Addresses:</strong> Allow select users to order even if domain is blocked.</li>
<li><strong>Whitelist Email Domains:</strong> Trust domains like <code>@yourcompany.com</code> to ensure easy ordering.</li>
<li><strong>Whitelist IP Addresses:</strong> Permit known IPs from your office, team, or partners to always succeed.</li>
<li><strong>Whitelist User Roles:</strong> Automatically allow orders from Admins, Shop Managers, or other trusted roles.</li>
<li><strong>Whitelist Payment Methods:</strong> Trust secure gateways like Stripe or verified bank transfers.</li>
<li><strong>Whitelist Shipping Locations:</strong> Allow safe zip codes, countries, and states without triggering blocks.</li>
</ul>
<figure id="attachment_18734005209089" aria-describedby="caption-attachment-18734005209089" style="width: 896px" class="wp-caption alignnone"><img class="wp-image-18734005209089 size-medium" src="https://woocommerce.com/wp-content/uploads/2025/04/whitelist-settings_3a7b6e.png?w=896" alt="whitelist specific orders from being marked as fake orders." width="896" height="532" /><figcaption id="caption-attachment-18734005209089" class="wp-caption-text">Configure whitelisting settings to prevent order marked as fake order</figcaption></figure>

Anti Fraud Protection

<p>Anti-Fraud Protection automatically detects and blocks fraudulent orders using customizable rules, ensuring secure transactions and reducing chargebacks</p>

<h2>Security for WooCommerce:</h2>
<p>Fraudsters often use VPNs and proxies to hide their identities, putting eCommerce businesses at risk. <strong data-start="102" data-end="130">Security for WooCommerce</strong> helps you detect and block high-risk transactions by identifying masked locations and restricting purchases from countries you don’t sell to. While it strengthens your store’s security, it does not protect against velocity attacks. For advanced fraud prevention, check out <a href="//woocommerce.com/products/woocommerce-anti-fraud/" rel="noopener" data-start="404" data-end="431"> Anti-Fraud for Woocommerce</a>.</p>
<h2><strong>Key Features</strong></h2>
<div class="two-columns">
<p></p>
<div class="twocol-one">
<h3><strong>Restrict Sales to a Single Country</strong></h3>
<p>If your business operates domestically, you can limit sales to a single country to focus on your target market and block unwanted traffic from other regions.</p>
<p><img class="alignnone wp-image-18734004756467" src="https://woocommerce.com/wp-content/uploads/2022/11/AllowOnlyTrafficFromCountry.webp?w=896" alt="Allow Only Traffic From one Country" width="693" height="390" /></p>
</div>
<div class="twocol-one">
<h3><strong>Manually Allow or Block Individual IP Addresses</strong></h3>
<p>With<strong> Security for WooCommerce,</strong> you can manually manage IP access by blocking suspicious users or allowing trusted ones. Add problematic IPs to the Blacklist to prevent fraud, or Whitelist trusted users like admins or virtual assistants for seamless access. This ensures secure, controlled access while protecting your store.<img class="alignnone wp-image-18734004756439" src="https://woocommerce.com/wp-content/uploads/2022/11/RandomIps.webp?w=896" alt="restrict access to cart at checkout" width="693" height="390" /><br />
<strong style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);font-size: 16px;letter-spacing: -0.011em">Restrict Access to Cart and Checkout</strong></p>
<p>Enhances security by allowing you to restrict access to the cart and checkout pages based on a visitor’s country.</p>
<p><img class="alignnone wp-image-18734004756362" src="https://woocommerce.com/wp-content/uploads/2022/11/RestrictAccess.webp?w=896" alt="" width="693" height="390" /></p>
<h3><strong style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);font-size: 16px;letter-spacing: -0.011em">Restrict Access at the Product Level</strong></h3>
<p>Strengthens security by allowing you to restrict access to a product based on a visitor’s country.</p>
<p><img class="alignnone wp-image-18734004756380" src="https://woocommerce.com/wp-content/uploads/2022/11/AccessAtProductLevel.webp?w=896" alt="" width="693" height="390" /></p>
<h3><strong style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);font-size: 16px;letter-spacing: -0.011em">Category-Based Product Restrictions</strong></h3>
<p><span style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);letter-spacing: -0.011em">Allows precise control over product visibility by region. The </span><strong style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);letter-spacing: -0.011em">Category<br />
Restrictions On/Off </strong><span style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);letter-spacing: -0.011em">setting enables or disables category-based blocking, while </span><strong style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);letter-spacing: -0.011em">Block Products by Category </strong><span style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);letter-spacing: -0.011em">lets you restrict specific WooCommerce product categories for visitors from blocked countries, ensuring compliance and a tailored shopping experience.</span></p>
<p><img class="alignnone wp-image-18734004756400" src="https://woocommerce.com/wp-content/uploads/2022/11/CategoryOnOff.webp?w=896" alt="" width="693" height="390" /></p>
<h3><strong style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);font-size: 16px;letter-spacing: -0.011em">For Publicly Accessible Download Product Links</strong></h3>
<p><span style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);letter-spacing: -0.011em">Secure your downloadable products with IP-based access control. Choose <strong>Whitelist Mode</strong> to block specific IPs or <strong>Blacklist Mode</strong> to allow only approved IPs. Custom error messages ensure unauthorized downloads are prevented, providing extra protection and control for your WooCommerce store.</span></p>
<p><img class="alignnone wp-image-18734004756395" src="https://woocommerce.com/wp-content/uploads/2022/11/PublicAccessibleDownloadlinks.webp?w=896" alt="whitelisting and blacklisting toggles" width="693" height="390" /></p>
<div class="flex max-w-full flex-col flex-grow">
<div class="min-h-8 text-message flex w-full flex-col items-end gap-2 whitespace-normal break-words text-start [.text-message+&]:mt-5" dir="auto" data-message-author-role="assistant" data-message-id="ae4271fb-4acd-4aa0-bca9-25faed52bb26" data-message-model-slug="gpt-4o">
<div class="flex w-full flex-col gap-1 empty:hidden first:pt-[3px]">
<div class="markdown prose w-full break-words dark:prose-invert light">
<p><strong style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);font-size: 16px;letter-spacing: -0.011em">Block Visitors Access between Timeframe</strong></p>
</div>
</div>
</div>
</div>
<p><span style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);letter-spacing: -0.011em">Enables you to restrict order placement to specific timeframes, ideal for stores serving a particular country or region and aiming to prevent orders from unintended time zones or areas.</span></p>
<p><img class="alignnone wp-image-18734004756413" src="https://woocommerce.com/wp-content/uploads/2022/11/RestrictTimeFrame.webp?w=896" alt="block visitors access between timeframe toggle and time range" width="693" height="390" /></p>
<h3><strong style="font-family: var(--wccom-font-family-header);font-size: var(--wp--preset--font-size--paragraph-medium,18px);letter-spacing: -0.02em">Enhanced Site Protection</strong></h3>
<p><span style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);letter-spacing: -0.011em;font-size: 16px">The comprehensive WooCommerce Security plugin includes features to enhance site protection. It can hide the WordPress version number to prevent attackers from identifying version-specific vulnerabilities. Two-Factor Authentication (2FA) adds an extra layer of security by requiring a second verification step. Additionally, a passcode protection feature allows restricted access using a configured username and password. All features are disabled by default.</span></p>
</div>
<div class="twocol-one">
<div class="flex max-w-full flex-col flex-grow">
<p><img class="alignnone wp-image-18734004756423" src="https://woocommerce.com/wp-content/uploads/2022/11/EnhancedSiteProteciton.webp?w=896" alt="enhanced site protection toggles" width="693" height="390" /></p>
<div class="flex max-w-full flex-col flex-grow">
<div class="min-h-8 text-message flex w-full flex-col items-end gap-2 whitespace-normal break-words text-start [.text-message+&]:mt-5" dir="auto" data-message-author-role="assistant" data-message-id="ae4271fb-4acd-4aa0-bca9-25faed52bb26" data-message-model-slug="gpt-4o">
<div class="flex w-full flex-col gap-1 empty:hidden first:pt-[3px]">
<div class="markdown prose w-full break-words dark:prose-invert light">
<p><strong style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);font-size: 16px;letter-spacing: -0.011em">Scan Malware Manually</strong></p>
<p><span style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);letter-spacing: -0.011em">Enables on-demand malware scans for your WordPress site, detecting security threats, suspicious code, and compromised files. Users can initiate a detailed scan with one click, receiving results that include the last scan date, infected files with suspected line numbers, and total threats found. The scanner checks PHP files, detects malicious patterns, and compares files against malware signatures, with results stored in the WordPress database and displayed in a table.</span></p>
</div>
</div>
</div>
</div>
<p><img class="alignnone wp-image-18734004756432" src="https://woocommerce.com/wp-content/uploads/2022/11/ScanMalware.webp?w=896" alt="scan malware manually button" width="693" height="390" /></p>
<div class="flex max-w-full flex-col flex-grow">
<div class="min-h-8 text-message flex w-full flex-col items-end gap-2 whitespace-normal break-words text-start [.text-message+&]:mt-5" dir="auto" data-message-author-role="assistant" data-message-id="ae4271fb-4acd-4aa0-bca9-25faed52bb26" data-message-model-slug="gpt-4o">
<div class="flex w-full flex-col gap-1 empty:hidden first:pt-[3px]">
<div class="markdown prose w-full break-words dark:prose-invert light"><strong style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);font-size: 16px;letter-spacing: -0.011em">Directory and File Protection Settings</strong></div>
<div>These features help keep your site’s folders and files private and secure.<strong> Directory Listing Protection</strong> blocks people from browsing your folders, while <strong>File Indexing Protection</strong> prevents search engines from displaying sensitive files. Together, they keep your file structure hidden and your content safe. Both are off by default but can be easily turned on for extra security.</div>
<div><img class="alignnone wp-image-18734004756429" src="https://woocommerce.com/wp-content/uploads/2022/11/PreventDirectory.webp?w=896" alt="Prevent direct access directory on/off toggle" width="693" height="390" /></div>
</div>
</div>
</div>
<div class="group/conversation-turn relative flex w-full min-w-0 flex-col agent-turn">
<div class="flex-col gap-1 md:gap-3">
<div class="flex max-w-full flex-col flex-grow">
<div class="min-h-8 text-message flex w-full flex-col items-end gap-2 whitespace-normal break-words text-start [.text-message+&]:mt-5" dir="auto" data-message-author-role="assistant" data-message-id="7ba194b5-e21f-46a2-9ae8-e3f0af69f4c8" data-message-model-slug="gpt-4o">
<div class="flex w-full flex-col gap-1 empty:hidden first:pt-[3px]">
<div class="markdown prose w-full break-words dark:prose-invert light">
<p>The comprehensive <strong>Security for WooCommerce</strong> plugin ensures your website remains discoverable by allowing trusted search engine bots to index your site, even if they originate from blocked countries. You’ll receive <strong>email alerts</strong> whenever a blocked visitor attempts to log in via WP-Admin. Designed to help WooCommerce businesses block unwanted traffic, this plugin allows you to focus on serving genuine customers.</p>
<p><strong style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);font-size: 16px;letter-spacing: -0.011em">Block Visitors Access between Timeframe</strong></p>
<p><span style="color: var(--wp--preset--color--woo-text-gray,#101517);font-family: var(--wccom-font-family-default);letter-spacing: -0.011em">Empowers you to restrict order placement to specific timeframes, ideal for stores serving a particular country or region and aiming to prevent orders from unintended time zones or areas.</span></p>
<p><img class="alignnone wp-image-18734004756413" src="https://woocommerce.com/wp-content/uploads/2022/11/RestrictTimeFrame.webp?w=896" alt="Block visitors access between timeframe toggle" width="693" height="390" /></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div class="twocol-one last"></div>
</div>

Security

<h3>Stop Location Spoofing & Block VPN/Proxy Fraudsters</h3>

Anti Fraud Protection vs Security