ldebrouwer

<p>An up-to-date WordPress installation is as safe as it can be, plugins however can often pose a security risk because they’re not maintained by hundreds of contributors. A plugin is as secure as the security knowledge of the developer allows it to be. In some cases this creates loopholes for exploits. WP Plugin Security Check checks plugins for bad practices and possible security holes limiting the risk of a compromised WordPress installation to a ‘hate to say I told you so’.</p>


WP Plugin Security Check

WP Plugin Security Check checks if your WordPress plugins are 'safe'.

otto.radics

<h3>Installation</h3>
<p><a href="https://utanvet-ellenor.hu/register" rel="nofollow ugc">Register</a> to obtain API keys, then set them in the plugin’s settings. The reputation threshold parameter is there to let you customize how strict should the filtering be. This is a number between -1 and +1.</p>
<h3>What is Utánvét Ellenőr?</h3>
<p>It is a SaaS provided by Utánvét Ellenőr Kft. from Hungary: a service which will let shop owners filter orders with Cash on Delivery coming from known fraudulent e-mail addresses.</p>
<h3>How does it work?</h3>
<p>The idea behind the service is the following:<br />
* Someone orders with Cash on Delivery payment method, but later refuses to accept the package from the courier.<br />
* The shop owner flags this order with the custom order status <code>Rendelést nem vette át</code>.<br />
* The plugin listens for orders entering this status.<br />
* Once an order ends up in this status, the plugin will hash the e-mail address of the user on the shop server with SHA256 and sends the hash to our service, accompanied by a <code>-1</code>.<br />
* If the courier could hand over the package successfully, the shop owner flags the order with the stock order status <code>completed</code>. In this case the plugin hashes the e-mail with the same SHA256 and sends the hash to our service, accompanied by a <code>+1</code>.<br />
* When someone with the same e-mail address would like to order (from the same or from another shop), this plugin can disable Cash on Delivery from available payment methods:<br />
  * The user enters his e-mail address and leaves the <code>billing_email</code> input field.<br />
  * This value gets hashed with the same SHA256 algorithm and the plugin asks our service about this hash.<br />
  * The service will return a JSON array and if the e-mail reputation provided in this payload does not meet the minimum value set by the shop owner in the plugin settings (<code>Reputation threshold</code>), the plugin will disable the Cash on Delivery payment method.</p>
<h3>Privacy implications</h3>
<p>All inputs are hashed with SHA-256 by the plugin on your server. This means:<br />
* The entered e-mail address  will NEVER leave your system.<br />
* SHA-256 is considered to be safe for hashing.<br />
* On “check requests” we don’t receive the e-mail address, just a hash, and we provide only a couple of “numbers” about that hash. There is no way for us to know what was the original string before hashing.<br />
* In order to use our services, you MUST notify your users that “Automated individual decision-making” might be applied during checkout. For more information, please see GDPR Art. 22.</p>
<blockquote>
<p>Note: this is not a legal advice. Consult your attourney before using this service in production.</p>
</blockquote>


Utánvét Ellenőr

Connect your WooCommerce site to our SaaS available at https://utanvet-ellenor.hu Register to obtain API keys.

WP Plugin Security Check vs Utánvét Ellenőr