Title: Checkout Guard – Block Fake Orders, Spam & Fraud for WooCommerce Author: Giannis Kipouros Published: 23 Janaayo, 2024 Last modified: 7 Sebteembar, 2026 --- Raadi kaabayaal ![](https://ps.w.org/checkout-guard/assets/banner-772x250.jpg?rev=3686091) ![](https://ps.w.org/checkout-guard/assets/icon-256x256.png?rev=3025572) # Checkout Guard – Block Fake Orders, Spam & Fraud for WooCommerce Qore [Giannis Kipouros](https://profiles.wordpress.org/giannis4/) [Soo Rog](https://downloads.wordpress.org/plugin/checkout-guard.1.2.0.zip) * [Faahfaahin](https://so.wordpress.org/plugins/checkout-guard/#description) * [Dibu-eegisyo](https://so.wordpress.org/plugins/checkout-guard/#reviews) * [Rakibaad](https://so.wordpress.org/plugins/checkout-guard/#installation) * [Horumarinta](https://so.wordpress.org/plugins/checkout-guard/#developers) [Taageero](https://wordpress.org/support/plugin/checkout-guard/) ## Sharraxaad Stop fake and unwanted WooCommerce orders before they happen. Checkout Guard blocks suspicious checkouts using simple rules you control, with no external fraud service, no scoring engine, and no monthly fee. Often you already know what you want to block: a throwaway email domain, a repeat offender’s IP, a country you don’t ship to. Checkout Guard puts those controls directly in your WooCommerce checkout. ### 🛡️ Block throwaway email services Switch on one setting and Checkout Guard rejects checkouts from around **22,000 known disposable-email domains**: Mailinator, Guerrilla Mail, YOPmail, Temp-Mail and thousands more. The list ships with the plugin, so it works the moment you enable it, with no signup and no API key. ### 🛡️ Block by email address, domain or pattern Block individual addresses or whole domains, with wildcard support: * `*@bad-domain.com` blocks every address at that domain * `spam*@bad-domain.com` blocks `spammer@bad-domain.com` but leaves `nice@bad-domain. com` alone * `*.edu` blocks every address ending in that TLD Catch-all entries such as `*` or `*@*` would block every order on your store, so they are rejected when you save. ### 🛡️ Reject junk names Catches checkouts where the name is obviously not a name: `test`, `asdf`, `qwerty`,` John Doe` and similar. Matching is exact and whole-field, so a customer called ** Testa** or **Contestabile** is never affected by the entry `test`. You can read the full list on the settings screen before switching the rule on. ### 🛡️ Check that the email can actually receive mail Optionally look up the address’s domain during checkout and turn the order away if it cannot receive mail at all. If the lookup itself fails, the order goes through, so a DNS problem never costs you a sale. ### 🛡️ Block by IP address Block individual IPv4 addresses, or use wildcards to cover a range: ``` 203.0.113.* ``` Useful when you identify a recurring source of unwanted checkout attempts. If your store sits behind Cloudflare or another proxy, Checkout Guard reads the forwarded visitor IP rather than the edge server’s. ### 🛡️ Restrict billing countries Block checkout for billing countries you don’t serve. This is a blocklist: you name the countries to turn away, not the ones to allow. ### 🛡️ Restrict order totals Set a minimum, a maximum, or both, and stop checkouts falling outside the range. Useful against waves of suspicious low-value orders, or unusually large ones worth reviewing by hand. ### ⭐ Try it before it blocks anyone Set Protection Mode to **Learning** and Checkout Guard records what each rule would have caught without turning a single customer away. Check the results, adjust your rules, then switch to Enforce when you are happy. Nothing is blocked until you say so. ### 📋 See what was blocked Turn on recording, and the Blocked attempts tab lists every checkout a rule matched: when, which rules, which checkout, the email, the IP, and the cart total. A summary shows how many were stopped in the last 7 and 30 days and which rule fires most often. Records are pruned automatically so the table never grows without limit. ### 🛒 Works with every checkout Checkout Guard enforces on the **classic WooCommerce checkout**, the **WooCommerce Checkout block**, and **express checkouts**. Wallet buttons placed on a product or cart page skip the checkout form entirely, so they are an easy route for a blocked customer to slip through. Checkout Guard checks the ones that create their order through WooCommerce, Apple Pay included. One known exception is described in the FAQ. It also declares compatibility with High-Performance Order Storage (HPOS). ### ⚡ Designed to stay out of the way Checks run during checkout validation, not on normal browsing, so regular customers shop at normal speed. The bundled domain list is only loaded into memory when you actually enable it. **Important:** This plugin is an extension of the [WooCommerce](https://wordpress.org/plugins/woocommerce/) plugin, and it cannot function independently. ### 💻 Filters and Actions Multiple hooks let you customize the plugin further. Rules live in a filterable registry, so a developer can add their own rules, change the bundled lists, or adjust matching. If you need any extra hooks, please don’t hesitate to ask. ## Sawir-shaashado [⌊Protection Mode and the email rule: block single addresses, whole domains, or wildcard patterns.⌉⌊Protection Mode and the email rule: block single addresses, whole domains, or wildcard patterns.⌉[ Protection Mode and the email rule: block single addresses, whole domains, or wildcard patterns. [⌊The bundled lists, readable before you switch a rule on: throwaway email domains, mail deliverability, and the 71 junk names.⌉⌊The bundled lists, readable before you switch a rule on: throwaway email domains, mail deliverability, and the 71 junk names.⌉[ The bundled lists, readable before you switch a rule on: throwaway email domains, mail deliverability, and the 71 junk names. [⌊Country and IP rules. Blocked countries are chips you can see at a glance, with search to add more.⌉⌊Country and IP rules. Blocked countries are chips you can see at a glance, with search to add more.⌉[ Country and IP rules. Blocked countries are chips you can see at a glance, with search to add more. [⌊Order total limits, proxy handling, and how long blocked attempts are kept.⌉⌊Order total limits, proxy handling, and how long blocked attempts are kept.⌉[ Order total limits, proxy handling, and how long blocked attempts are kept. [⌊Blocked attempts, with a summary of what each rule has caught.⌉⌊Blocked attempts, with a summary of what each rule has caught.⌉[ Blocked attempts, with a summary of what each rule has caught. ## Rakibaad 1. Upload “Checkout Guard – Block Fake Orders, Spam & Fraud for WooCommerce” plugin into the directory `wp-content/plugins/`. 2. Enable “Checkout Guard – Block Fake Orders, Spam & Fraud for WooCommerce” plugin. ## SBI ### Will this block real customers by mistake? Set Protection Mode to Learning first. Every rule runs and records what it would have caught, but nothing is blocked and no customer is turned away. When the results look right, switch to Enforce. ### Which disposable email domains are blocked? Around 22,000, bundled with the plugin and based on the public [disposable email domains list](https://github.com/disposable/disposable-email-domains). The settings screen links to the source so you can check any domain. It is a copy taken when the plugin was released, so it will not match the source exactly. ### Are forwarding services like Firefox Relay blocked? No. Firefox Relay, Apple Hide My Email and Addy deliver to a real permanent inbox, so blocking them would reject a paying customer. They are excluded from the bundled list. ### Will the junk-name rule block someone whose surname is Test? No. Matching is exact and whole-field, never a substring, so `test` blocks a customer who types “Test” as their whole name but never affects Testa, Contestabile or Testani. The full list is shown on the settings screen so you can check it before switching the rule on. ### How do I block an entire domain instead of just one email? Enter `*@bad-domain.com` on its own line in the email blocklist. That blocks every billing email at that domain, and nothing else. You can also enter the bare domain, `bad-domain.com`. The difference is precision: a bare domain matches anywhere in the address, so it will also catch `someone@notbad- domain.com`. The `*@` form matches the domain exactly. Prefer the wildcard unless you specifically want the looser match. ### What wildcard patterns can I use in the email blocklist? The `*` wildcard stands for any run of characters, and the pattern must match the whole address: * `*@bad-domain.com` blocks every address at that domain. * `spam*@bad-domain.com` blocks `spammer@bad-domain.com` but leaves `nice@bad-domain. com` alone. * `*.edu` blocks every address ending in that TLD. Catch-all entries such as `*` or `*@*` would block every order on your store, so they are rejected and removed when you save. ### Does the IP address block support wildcards? Yes. Checkout Guard supports IPv4 wildcards, so `203.0.113.*` covers that whole range. Wildcards are IPv4 only. ### Does it work behind Cloudflare? Yes. Checkout Guard reads forwarded proxy headers by default, so IP rules match the real visitor rather than the CDN edge. If your store is not behind a proxy you can switch that off in Store Setup. ### Can I only allow certain countries instead of blocking? Not currently. The country rule is a blocklist: you list the countries to turn away. ### Does it work with the Checkout block? Yes. The classic checkout, the WooCommerce Checkout block and express checkouts are all enforced, with one known exception noted below, and the plugin declares HPOS compatibility. ### Are Apple Pay, Google Pay and PayPal buttons checked? Apple Pay is, including on product and cart pages. The WooCommerce PayPal Payments gateway sends it through WooCommerce’s own checkout, so every rule runs and a blocked attempt is stopped before the order is created. Express buttons in general are checked whenever the gateway creates its order through WooCommerce. WooPayments is covered in full: its Apple Pay, Google Pay, Link and WooPay buttons all place the order the same way the Checkout block does, so every rule runs wherever you put the button. A blocked attempt leaves nothing in your orders list. There is one known exception. WooCommerce PayPal Payments has a setting called “ Pay Now Experience”, which lets customers skip the Order Review page and is switched on for new merchants during its setup. With it on, the PayPal button on a product or cart page builds the order itself without going through WooCommerce’s checkout, and Checkout Guard does not see those orders. Support for them is planned. In the meantime, switching “Pay Now Experience” off in the PayPal settings sends those customers through the checkout page instead, where every rule runs. Apple Pay is unaffected either way. ### Will this plugin slow down my store frontend? No. Checks run during checkout validation, not on normal browsing, so browsing speed is unaffected. The bundled disposable-domain list is only loaded when you enable it, and the optional deliverability lookup is the only rule that touches the network. ### Does it store customer data? Only if you switch recording on, and it is off by default. When enabled, a blocked attempt stores the billing email, IP, cart total and which rules matched. Records are deleted automatically after the retention period you choose, 90 days by default. ## Dibu-eegisyo ![](https://secure.gravatar.com/avatar/4b04f3868d5d00557a0e117f43262a23de2b023b16cf33e18bf233ecce7e4515? s=60&d=retro&r=g) ### 󠀁[Fantastic initiative, great concept.](https://wordpress.org/support/topic/fantastic-initiative-great-concept/)󠁿 [Hudson Atwell](https://profiles.wordpress.org/hudson-atwell/) 30 Janaayo, 2024 1 reply Amazing plugin, Giannis, and a fantastic initiative. Thanks for publishing your hard work. ![](https://secure.gravatar.com/avatar/a277c6073013d37677389b2bd72284f5c4a68309cb27bf286ba2f5c5fb4350e1? s=60&d=retro&r=g) ### 󠀁[Great plugin and great support!](https://wordpress.org/support/topic/great-plugin-and-great-support-852/)󠁿 [mikesterminal](https://profiles.wordpress.org/mikesterminal/) 23 Janaayo, 2024 Very easy to use and does the job! Thank you so much! [ Akhri dhammaan 1 dibu-eegis ](https://wordpress.org/support/plugin/checkout-guard/reviews/) ## Ka-qaybgalayaasha & Horumariyayaasha “Checkout Guard – Block Fake Orders, Spam & Fraud for WooCommerce” waa softiweer il furan. Dadka soo socda ayaa wax ku biiriyay kaabahan. Ka-qaybgalayaasha * [ Giannis Kipouros ](https://profiles.wordpress.org/giannis4/) [Ku tarjun “Checkout Guard – Block Fake Orders, Spam & Fraud for WooCommerce” luqaddaada.](https://translate.wordpress.org/projects/wp-plugins/checkout-guard) ### Ma xiisaynaysaa horumarinta? [Baadh koodka](https://plugins.trac.wordpress.org/browser/checkout-guard/), fiiri [bakhaarka SVN](https://plugins.svn.wordpress.org/checkout-guard/), ama iska qor [diiwaanka horumarinta](https://plugins.trac.wordpress.org/log/checkout-guard/) adigoo adeegsanaya [RSS](https://plugins.trac.wordpress.org/log/checkout-guard/?limit=100&mode=stop_on_copy&format=rss). ## Isbeddellada #### 1.2.0 * Feature: Block around 22,000 known disposable-email domains from a bundled list, with forwarding services such as Firefox Relay and Apple Hide My Email deliberately excluded * Feature: Reject junk names such as `test`, `asdf` and `John Doe`, matched exact and whole-field so real surnames are unaffected. The full list is readable on the settings screen * Feature: Optional mail deliverability check that turns away addresses whose domain cannot receive mail. Fails open, so a DNS problem never costs a sale * Feature: Protection Mode – Learning records what would have been blocked without turning anyone away; Off runs no checks * Feature: Blocked attempts screen listing every checkout a rule matched, with 7 and 30 day summaries * Feature: Enforcement on the WooCommerce Checkout block via the Store API. Earlier versions checked the classic checkout only * Feature: Enforcement on express checkouts. Wallet buttons placed on product and cart pages can build the order without ever reaching checkout validation, so no rule used to run on them at all. Express checkouts that create their order through WooCommerce are now checked like any other checkout, and a blocked one leaves no order behind. See the FAQ for one known exception * Feature: Setting for stores behind a CDN or proxy, so IP rules match the real visitor * Feature: Blocked-attempt recording now works and is off by default. Records are kept 90 days unless you choose otherwise * Change: Settings screen reorganised into grouped cards, with rule explanations shown inline * Change: Blocked countries are now listed as removable tags, with a search box to add more. Type “kingdom” or “GB” to find United Kingdom. The old control was a 250-row scrolling list that hid your own selection inside it and cleared it if you clicked without holding Ctrl * Change: The junk-name rule is a top-level rule. In an earlier build it only ran when the email rule was also on * Change: Settings and Logs links on the plugin row of the Plugins screen * Dev: Rules moved into a filterable registry (`cgbs_rules`), with a surface-agnostic engine and thin adapters per checkout * Compat: Declares High-Performance Order Storage (HPOS) compatibility #### 1.1.0 * Feature: Wildcard support in the email blocklist (e.g. `*@bad-domain.com`, `spam*@ bad-domain.com`, `*.edu`) * Fix: Fatal error at checkout when the “blocked by IP” message was left empty * Fix: Wrong fallback message shown for IP blocks * Fix: Blocklist entries with trailing whitespace are trimmed instead of discarded * Docs: Corrected the domain blocking FAQ and documented wildcard syntax #### 1.0.4 * Optimize: Asset Loading * Update: WordPress Version 7.0.2 #### 1.0.3 * Fix: Issue applying limits for some visitors * Admin: Changed menu position to WooCommerce submenu * Update: WordPress Version 6.8.2 #### 1.0.2 * Feature: Add IPv4 wildcards * Update: WordPress Version 6.8.1 * Fix: Warnings #### 1.0.1 * Fix: Undefined variable issue * Styling customizations * Move to main admin menu #### 1.0.0 * First Edition release ## Meta * Version **1.2.0** * Last updated **2 maalmood kahor** * Active installations **60+** * WordPress version ** 5.3 ama ka sareeya ** * Tested up to **7.1** * PHP version ** 7.4 ama ka sareeya ** * Language * [English (US)](https://wordpress.org/plugins/checkout-guard/) * Tags * [checkout](https://so.wordpress.org/plugins/tags/checkout/)[disposable email](https://so.wordpress.org/plugins/tags/disposable-email/) [fake orders](https://so.wordpress.org/plugins/tags/fake-orders/)[fraud](https://so.wordpress.org/plugins/tags/fraud/) * [Aragti Sare](https://so.wordpress.org/plugins/checkout-guard/advanced/) ## Qiimeynta 5 out of 5 stars. * [ 2 5-star reviews ](https://wordpress.org/support/plugin/checkout-guard/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/checkout-guard/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/checkout-guard/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/checkout-guard/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/checkout-guard/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/checkout-guard/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/checkout-guard/reviews/) ## Ka-qaybgalayaasha * [ Giannis Kipouros ](https://profiles.wordpress.org/giannis4/) ## Taageero Ma heysaa waxaad dhahdo? Caawimaad ma u baahan tahay? [Eeg madasha taageerada](https://wordpress.org/support/plugin/checkout-guard/)