Title: Predax Fraud Guard for WooCommerce – Anti-Fraud, Fake Order & Card Testing Protection
Author: Predax
Published: 14 de junio de 2026
Last modified: 23 de septiembre de 2026
---
Buscar plugins
# Predax Fraud Guard for WooCommerce – Anti-Fraud, Fake Order & Card Testing Protection
Por [Predax](https://profiles.wordpress.org/ipsentry/)
[Descargar](https://downloads.wordpress.org/plugin/predax-fraud-guard-for-woocommerce.1.12.4.zip)
* [Detalles](https://es-ar.wordpress.org/plugins/predax-fraud-guard-for-woocommerce/#description)
* [Valoraciones](https://es-ar.wordpress.org/plugins/predax-fraud-guard-for-woocommerce/#reviews)
* [Instalación](https://es-ar.wordpress.org/plugins/predax-fraud-guard-for-woocommerce/#installation)
* [Desarrollo](https://es-ar.wordpress.org/plugins/predax-fraud-guard-for-woocommerce/#developers)
[Soporte](https://wordpress.org/support/plugin/predax-fraud-guard-for-woocommerce/)
## Descripción
Predax Fraud Guard is anti-fraud for WooCommerce: it stops fake orders, card testing
and chargebacks before the order exists. Card testers and stolen-card fraudsters
typically check out from behind a VPN, proxy, Tor or datacenter IP. Fraud Guard
screens the customer’s IP at checkout and scores its fraud risk from 0 to 100, and
for each rule you choose what happens. **Block** refuses the checkout before payment
is taken, so a blocked attempt never becomes a gateway fee or a chargeback. **Hold**
lets the payment go through and keeps the order on hold for your review, so nothing
ships until you decide. Or simply tag the order. Works with any payment gateway
and with both the classic and block checkout.
[See what Predax knows about your own IP](https://predax.io/tools/what-is-my-ip)—
free, no signup.
**Off by default.** A fresh install sends nothing anywhere. Connect your Predax
key and choose a protection mode; until then the plugin does nothing.
#### What it stops
* **Card testing** — bots running stolen card numbers through your checkout in
bulk
* **Orders from VPNs, proxies, Tor and datacenter IPs**
* **Too many orders, too fast** — velocity rules catch rapid repeat attempts
* **Billing country that doesn’t match the customer’s real location**
* **Disposable email addresses** at checkout
#### Start in tag-only mode
The default once configured is **Tag + note**: flagged orders get a “Predax: Medium/
High / Critical Risk” tag and an order note, and nothing is blocked. Watch what
the rules would have done, then turn on **Block high risk** or **Block critical
only** when you’re confident. Optionally send high-risk orders to **On Hold** for
review instead of rejecting them: the payment is taken and the order waits for you
before anything ships, so you can refund a fraudulent one instead of sending the
goods.
#### Safe for real customers and search traffic
* **Verified search engines are never blocked** by your VPN, datacenter, country
or risk rules.
* **Every decision is on the record.** The Events Log shows which orders were tagged,
held or blocked, and why — so a too-strict rule shows up in the log, not in falling
sales.
* **One-click allow-listing** from the Events Log lets a good customer check out
again immediately.
#### Also included
Risk score, threat flags and country saved on every order for reporting · Refund/
chargeback feedback that adds the IP to your deny list · IP and CIDR allow/deny
lists · Optional Community Threat Network sharing
#### Free plan
Click **Connect with Predax** in the setup wizard and your free account and API
key are created for you — nothing to copy or paste. The free plan includes **5,000
IP checks a month** with full VPN, proxy, Tor and datacenter detection and risk
scoring. No credit card. Checkouts are only checked when they happen and results
are cached, so it covers a small store comfortably; busier stores can move to a
[paid plan](https://predax.io/pricing) — same plugin, same settings, same key.
### Third Party Services
This plugin connects to external services operated by Predax (https://predax.io)
only after you have saved an API key: checkout screening additionally requires a
protection mode to be enabled, and the admin-side account-usage lookup (described
below) sends no visitor data at all. By activating this plugin and entering an API
key you agree to the [Predax Terms of Service](https://predax.io/terms) and [Privacy Policy](https://predax.io/privacy).
You are responsible for ensuring your use of customer IP data at checkout complies
with applicable privacy laws (including but not limited to GDPR, CCPA) and your
own store’s privacy policy. This plugin does not assert PCI-DSS, GDPR, or CCPA compliance
on your behalf.
#### Predax IP Intelligence API
Used to look up a risk score and classification signals for each checkout IP.
* **Data sent:** the customer’s IP address at checkout; the browser-reported IANA
timezone string (when available on the classic checkout form — used for the timezone-
mismatch signal); your custom scoring weights (only if Custom Scoring is enabled).
* **What is NOT sent:** no billing/shipping names, street addresses, phone numbers,
email addresses (only the email’s domain part, and only under the separate Email
Domain Screening below), product details, prices, or payment data. The billing-
country-mismatch rule compares your order’s billing country against the API’s
IP-country result locally — billing details never leave your site.
* **When:** during WooCommerce checkout validation, and only while a protection
mode is saved in settings.
* **Caching:** classification results are cached in the site’s transients for between
5 minutes and 1 hour per IP (the lifetime the API recommends), so repeat checkouts
from the same IP do not generate duplicate API calls.
* **Endpoint:** `POST https://predax.io/api/v1/check/ip`
* **Service URL:** https://predax.io
* **Terms of Service:** https://predax.io/terms
* **Privacy Policy:** https://predax.io/privacy
#### Email Domain Screening (only when the Disposable Email rule is enabled)
Used to check whether the billing email’s provider is a disposable/throwaway service,
against a server-side list of thousands of domains (the plugin’s built-in list covers
only ~50).
* **Data sent:** the domain part of the billing email address only — for example`
gmail.com`. The email address itself is NEVER sent: the part before the @ does
not leave your site, and the mailbox-level checks (role account, random-looking
name) run locally in PHP on your own server.
* **When:** during checkout validation, and only while the Disposable Email rule
is set to Flag or Block. If the API is unreachable, the plugin falls back to
its built-in local list and the checkout proceeds normally.
* **Caching:** email-domain results are cached in the site’s transients for up
to 6 hours per domain, so repeat checkouts with the same email provider do not
generate duplicate API calls.
* **Endpoint:** `POST https://predax.io/api/v1/validate/email`
* **Plan usage:** email-domain lookups count against your Predax plan allowance,
the same as checkout IP checks. Results are cached per domain for 6 hours and
the built-in list is checked first, so in practice this is roughly one lookup
per new email provider your customers use.
* **Service URL:** https://predax.io
* **Terms of Service:** https://predax.io/terms
* **Privacy Policy:** https://predax.io/privacy
#### Account Usage Lookup (admin pages only)
Used to show the “API usage this month” meter on the Fraud Guard settings page,
and only when an API key is saved.
* **Data sent:** your Predax API key (as the authentication header). No customer
or visitor data is sent.
* **When:** when an administrator views the Fraud Guard settings page. The result
is cached for 1 hour, so at most one lookup per hour regardless of admin page
views.
* **Endpoint:** `GET https://predax.io/api/v1/auth/usage`
* **Service URL:** https://predax.io
* **Privacy Policy:** https://predax.io/privacy
#### Predax Community Threat Network (opt-in, off by default)
The plugin can **optionally** send an anonymised telemetry signal — the IP address,
its risk score and detection flags, its network (ASN) number and name, its country
code, and the checkout outcome (allowed / monitored / blocked, or refund/chargeback
feedback) — to the Predax Community Threat Network so all participating stores benefit
from a shared feed. The Refund / Chargeback Feedback “Log” action reports through
this same channel, so it requires this opt-in; its “Blacklist” action updates your
local deny list regardless.
This feature is **off by default**. It is controlled by the `ipsentry_woo_community_enabled`
option, which defaults to `'no'`, with a checkbox on the Advanced settings tab.
The plugin will not send community-feedback telemetry unless you enable it. Customers’
personal data (names, emails, billing/shipping addresses, order contents) is never
included in the telemetry payload.
* **Endpoint:** `POST https://predax.io/api/v1/telemetry/event`
* **Service URL:** https://predax.io
* **Privacy Policy:** https://predax.io/privacy
#### OAuth One-Click Connect (optional)
Only triggered when an administrator clicks the **Connect with Predax** button in
the setup wizard. Your browser is redirected to predax.io to authorise the connection,
which returns an API key to your site.
* **Data sent:** your WordPress site URL, site name, and a PKCE state/code-challenge
pair. No customer data is involved.
* **When:** only during the click-to-connect OAuth flow.
* **Endpoint:** `POST https://predax.io/api/v1/oauth/token`
* **Service URL:** https://predax.io
* **Privacy Policy:** https://predax.io/privacy
#### Deactivation Feedback (optional, admin-initiated)
Shown only when an administrator deactivates the plugin from the Plugins screen
and chooses to answer the “why are you deactivating?” prompt.
* **Data sent:** the plugin slug, the plugin version, and a single pre-defined
reason code you select (e.g. “it blocked real customers”). No site URL, no email
address, no visitor data, and no IP address are sent.
* **When:** only when you select a reason and click “Send & deactivate”. Clicking“
Skip & deactivate” sends nothing at all.
* **Endpoint:** `POST https://predax.io/api/v1/feedback/deactivation`
* **Service URL:** https://predax.io
* **Privacy Policy:** https://predax.io/privacy
#### Cookies set by this plugin
* **`ipsentry_tz`** — set on WooCommerce checkout pages (only while an API key
is configured) via `assets/js/ipsentry-woo-tz.js`. Stores the customer’s browser-
reported IANA timezone (string, max 64 chars). Used server-side for the optional
timezone-mismatch fraud rule. Expires after 24 hours (`max-age=86400`), `path
=/`, `SameSite=Lax`, and marked `Secure` on HTTPS stores. The plugin reads this
cookie only at checkout-validation time.
The plugin does not set any advertising, analytics, or tracking cookies.
## Capturas
[⌊A fraudulent order stopped at checkout: the customer sees a clear message and
the order is never placed.⌉⌊A fraudulent order stopped at checkout: the customer
sees a clear message and the order is never placed.⌉[
A fraudulent order stopped at checkout: the customer sees a clear message and the
order is never placed.
[⌊The Fraud Rules settings tab: API key, risk thresholds, and per-signal VPN / proxy/
Tor / datacenter rules.⌉⌊The Fraud Rules settings tab: API key, risk thresholds,
and per-signal VPN / proxy / Tor / datacenter rules.⌉[
The Fraud Rules settings tab: API key, risk thresholds, and per-signal VPN / proxy/
Tor / datacenter rules.
[⌊Order detail: the Predax risk score, flags, and country appear as an order note
and order tags.⌉⌊Order detail: the Predax risk score, flags, and country appear
as an order note and order tags.⌉[
Order detail: the Predax risk score, flags, and country appear as an order note
and order tags.
[⌊Orders list: the Predax column shows each order's risk score and top threat flag.⌉⌊
Orders list: the Predax column shows each order's risk score and top threat flag
.⌉[
Orders list: the Predax column shows each order’s risk score and top threat flag.
[⌊Advanced rules: order velocity, billing-country mismatch, disposable-email, and
timezone checks.⌉⌊Advanced rules: order velocity, billing-country mismatch, disposable-
email, and timezone checks.⌉[
Advanced rules: order velocity, billing-country mismatch, disposable-email, and
timezone checks.
[⌊Geo blocking: allow, flag, or block checkout by country, region, or IP / CIDR
list.⌉⌊Geo blocking: allow, flag, or block checkout by country, region, or IP /
CIDR list.⌉[
Geo blocking: allow, flag, or block checkout by country, region, or IP / CIDR list.
[⌊Setup Wizard — pick a fraud protection level (Monitor Only, Recommended, or Strict)
in one step⌉⌊Setup Wizard — pick a fraud protection level (Monitor Only, Recommended,
or Strict) in one step⌉[
Setup Wizard — pick a fraud protection level (Monitor Only, Recommended, or Strict)
in one step
[⌊Events Log filtered by reason — narrow blocked attempts down to a single category,
like known-malicious IPs⌉⌊Events Log filtered by reason — narrow blocked attempts
down to a single category, like known-malicious IPs⌉[
Events Log filtered by reason — narrow blocked attempts down to a single category,
like known-malicious IPs
[⌊Events Log with one-click allow-listing — approve a genuine customer's IP straight
from the log, without editing a settings field⌉⌊Events Log with one-click allow-
listing — approve a genuine customer's IP straight from the log, without editing
a settings field⌉[
Events Log with one-click allow-listing — approve a genuine customer’s IP straight
from the log, without editing a settings field
## Instalación
#### From your WordPress dashboard (recommended)
1. Make sure WooCommerce is installed and activated.
2. Go to **Plugins → Add New Plugin** in your WordPress admin.
3. Search for **“Predax Fraud Guard”**.
4. Click **Install Now**, then **Activate**.
5. The Setup Wizard launches on first activation. Either click **Connect with Predax**
for OAuth one-click connection, or enter your API key manually.
6. Pick a protection preset (Recommended / Strict / Monitor Only). This is the step
where you opt in — IP lookups begin after this point.
7. Fine-tune individual rules at **Fraud Guard Settings** any time.
#### Manual installation
1. Download the plugin ZIP from this page and upload it via **Plugins → Add New Plugin
→ Upload Plugin** (or extract the `predax-fraud-guard-for-woocommerce` folder to`/
wp-content/plugins/`).
2. Activate the plugin through the **Plugins** menu and follow the Setup Wizard.
## Preguntas frecuentes
### How do I stop a card testing attack that’s happening right now?
Enable a blocking mode (the wizard’s Recommended preset blocks risk 50 and above),
turn on
the order velocity rule, and set VPN, proxy and datacenter to Block. Card-
testing bots run from datacenter, proxy and VPN addresses, so these rules cut the
attack off at the connection. Every blocked attempt is listed in the Events Log,
and because screening runs during checkout validation — before the order reaches
your payment gateway — a blocked attempt never becomes a transaction, a gateway
fee, or a chargeback.
### Does it work with Stripe, PayPal, or my payment gateway?
Yes, with any gateway. Screening runs during WooCommerce’s own checkout validation,
before
the order is created and before any payment provider is contacted, so it
does not depend on which gateway you use. It complements gateway-side screening
such as Stripe Radar: your gateway only ever sees the orders that already passed
the IP screen.
### How is this different from other WooCommerce anti-fraud plugins?
Most anti-fraud plugins score orders using rules about the order itself — mismatched
names, order size, email patterns. Predax Fraud Guard adds the signal those rules
can’t see: **live IP intelligence**. It knows whether the customer is connecting
through a VPN, proxy, Tor, or a datacenter server _right now_, backed by a continuously-
updated commercial threat database — the same signal used to catch card testing
and stolen-card fraud before payment is taken. It works well alongside rule-based
fraud plugins and payment-processor screening such as Stripe Radar, and alongside
security plugins like Wordfence (which protect your site, not your checkout).
### Does the plugin phone home before I finish setup?
No. Before you enter an API key and save a protection mode, the plugin makes zero
outbound requests to predax.io. Nothing happens silently on activation.
### Will it block legitimate customers?
Only if you enable a blocking mode. Until you complete setup, the mode is **Tag
only** (no blocking — orders just get tags and notes). In the setup wizard, the
pre-selected **Recommended** preset enables blocking of high-risk checkouts (risk
score 50+); choose **Monitor Only** instead if you don’t want any blocking yet —
each preset card lists exactly what it switches on.
### What is the risk score?
A score from 0 to 100 representing how likely an IP is to be associated with fraud,
anonymisation, or abuse. 0 = clean residential IP, 100 = the strongest combination
of threat signals (for example a known-malicious IP arriving over an anonymised
connection). The score combines VPN/proxy/Tor detection, datacenter identification,
historical abuse signals, and geographic heuristics.
### Does it work with Cloudflare?
Yes — enable **Fraud Guard Settings Advanced “Behind a proxy / CDN”** (or the
same toggle on the WooCommerce Predax tab). With it on, the plugin reads the real
customer IP from the `CF-Connecting-IP` / `X-Forwarded-For` headers instead of the
Cloudflare edge IP. It is **off by default**: when your store connects directly
to visitors, trusting those headers would let a customer spoof their IP to bypass
fraud checks, so you only turn it on when a proxy/CDN really is in front of your
site.
### How do I test it without affecting real customers?
Fraud Guard Settings Developer tab enter a Test IP Override. Every checkout is
then evaluated as if it came from that IP. A red admin banner reminds you test mode
is active. Clear the override before going live.
Use `185.220.101.1` (risk 85, Tor-adjacent) to exercise blocking paths, or `1.1.1.1`
to verify pass-through.
### What order metadata is stored?
On each tagged order the plugin stores:
* `_ipsentry_risk_score` — numeric risk score (0–100)
* `_ipsentry_ip` — detected customer IP
* `_ipsentry_country_code` — detected IP country code
* `_ipsentry_flags` — comma-separated threat flag list
### Does it work alongside the Predax Security plugin?
Yes. The plugins are independent but complementary — Security protects logins and
registrations, Fraud Guard protects WooCommerce checkout. Both can share the same
API key.
### Will this block real customers or hurt my store’s SEO?
Search first: verified search engine crawlers — Googlebot, Bingbot and others confirmed
by
reverse DNS — are never caught by your category rules, on both the classic and
the block-based checkout, so screening does not affect how your store is crawled
or indexed.
For customers, the plugin is built so you never have to guess. Start in tag-only
mode and
watch what your rules _would_ have done in the Events Log before you enable
any blocking. Every screening decision is recorded with its reason, and a good customer
caught by an over-strict rule can be allow-listed in one click straight from the
log. If your store serves audiences where VPN use is common, prefer Monitor mode
for the VPN rule.
## Reseñas
No hay reseñas para este plugin.
## Colaboradores y desarrolladores
“Predax Fraud Guard for WooCommerce – Anti-Fraud, Fake Order & Card Testing Protection”
es un software de código abierto. Las siguientes personas han colaborado con este
plugin.
Colaboradores
* [ Predax ](https://profiles.wordpress.org/ipsentry/)
[Traduce “Predax Fraud Guard for WooCommerce – Anti-Fraud, Fake Order & Card Testing Protection” a tu idioma.](https://translate.wordpress.org/projects/wp-plugins/predax-fraud-guard-for-woocommerce)
### ¿Interesado en el desarrollo?
[Revisa el código](https://plugins.trac.wordpress.org/browser/predax-fraud-guard-for-woocommerce/),
echa un vistazo al [repositorio SVN](https://plugins.svn.wordpress.org/predax-fraud-guard-for-woocommerce/),
o suscríbete al [log de desarrollo](https://plugins.trac.wordpress.org/log/predax-fraud-guard-for-woocommerce/)
por [RSS](https://plugins.trac.wordpress.org/log/predax-fraud-guard-for-woocommerce/?limit=100&mode=stop_on_copy&format=rss).
## Registro de cambios
#### 1.12.4
* New: Clock & Country is now a choice of three – Off, Hold or Block. Block refuses
the checkout before the card is charged, so there is no gateway fee and no chargeback.
Hold lets the payment go through and keeps the order on hold for your review.
Off only tags the order. If you saved the 1.12.3 switch, “on” becomes Hold and“
off” stays Off.
* Fixed: an order held by Clock & Country was listed in the Events Log as “flagged”
with a generic reason. It now shows as held, with the reason “tz_country_mismatch”,
and blocked attempts are logged the same way.
* Changed: the description now says plainly which actions happen before payment.
Blocking stops the card being charged; holding does not – a held order has been
paid for and waits for your review before anything ships.
* The Recommended preset uses Hold for Clock & Country, Strict uses Block and Monitor
leaves it off.
#### 1.12.3
* Fixed: orders put on hold by Predax were released again as soon as a card payment
went through. WooCommerce runs the fraud check before the payment gateway charges
the card, and the gateway then moved the order straight on to processing – so
for card payments, Auto Hold and the clock-and-country hold did not actually
hold anything. Held orders now stay on hold until you release them. The payment
is still recorded as normal, and orders held by other plugins are not affected.
* Changed: the clock-and-country hold now has its own switch, “Clock & Country
Hold”, under Order Actions. It works on its own and no longer needs Auto Hold
switched on. Until you change it, it follows your Auto Hold setting, so updating
does not start or stop holding orders on your store.
* Fixed: the clock-and-country check only ran when the separate Billing Country
Mismatch rule was switched on, and that rule is off by default – so on most stores
it did nothing. It now works whatever that rule is set to, and the rule itself
behaves exactly as before.
#### 1.12.2
* New: an order is now held for review when the billing country, the country the
order came from, and the customer’s browser clock all disagree. Each of those
on its own has an innocent explanation – people travel, and a VPN moves the apparent
location – so none of them holds an order by itself. Together they are the pattern
of a card being used from somewhere the cardholder is not. Held orders are tagged“
Predax: Clock & Country Mismatch” and the order note names both countries.
* Note: this holds the order even when the risk score is low, because the score
describes the connection, not the disagreement between three claims of location.
A stolen card used over an ordinary home broadband connection scores near zero
and is exactly the order worth a second look. It respects your Auto-hold setting:
if you have Auto-hold switched off, nothing is ever held – the order is tagged
instead.
* Fixed: the browser timezone your store already collects at checkout never reached
the check that uses it, so the “Predax: TZ Mismatch” tag could not appear on
any order. It works now.
* Improved: a timezone is now judged by the actual clock difference rather than
the zone name, and only counts from three hours apart. A shopper in Paris buying
from a German address is no longer a mismatch, and neither is a customer in California
on a US address – both were flagged before.
* Removed: the “Timezone mismatch” slider under Custom Scoring. It never affected
any score, so it was a control that did nothing. The timezone is still used,
as evidence, in the rule above.
#### 1.12.1
* Changed: the plugin now lists itself under its full name on the Plugins screen,
so it matches the name shown on WordPress.org.
* Fixed: the bundled Predax icon was a 1024×1024 photo-format file displayed at
28 pixels. It is now a correctly sized 256×256 icon, making the download about
220 KB smaller.
* Fixed: the “What’s new” panel inside the plugin listed the previous release’s
changes under the current version number.
* Maintenance release only – no change to screening, scoring, rules or any stored
setting.
#### 1.12.0
* New: a Help page, in the Fraud Guard menu. Plain-English explanation of every
setting and what to choose, stored in the plugin so it works offline.
* Fixed: Apple Private Relay and Cloudflare WARP are no longer treated as datacenter
connections at checkout, so iPhone customers are not refused. Applies to both
the classic checkout and the newer block-based checkout.
* New: a warning when your object cache is silently failing to store results. Screening
stays correct, but every checkout re-checks the same shopper and your plan allowance
is spent several times faster than it should be.
* Improved: the plugin is now fully translatable. The bundled translation template
was previously almost empty.
#### 1.11.0
* New: the Disposable Email rule now checks a continuously updated list of thousands
of throwaway providers instead of the short built-in list. Only the DOMAIN part
of the customer’s address is checked (for example “gmail.com”) – the address
itself, and everything before the @, never leaves your store. The built-in list
is still consulted first and still applies if the API is unreachable, so no store
loses a block it had before.
* New: orders from a domain that cannot receive mail, or with a machine-generated
mailbox name, are noted on the order. Both are record-only signals – they never
block a checkout, place an order on hold, or count towards the tag threshold.
* Fixed: order flags were discarded when the Predax API was briefly unreachable,
so a flagged order could go untagged and unlogged. Fixed on both the classic
and the Blocks checkout.
* Fixed: a malformed billing email domain could previously cause repeated API errors
that temporarily paused IP screening at checkout. Malformed domains are now rejected
on your own server and never sent.
* Note: email-domain lookups count towards your Predax plan allowance. Results
are cached for six hours per domain.
#### 1.10.0
**Setup wizard**
* The Community Threat Network opt-in is now offered as an explicit,
unticked checkbox in the setup wizard, with a plain-English description of exactly
what is shared. It stays off by default and can be changed any time on the Advanced
settings tab.
**Housekeeping**
* The plugin now identifies itself and its version in its API
requests, which helps support diagnose issues faster. * Fix: screening results written
by this plugin now carry the same crawler-identity fields as Predax Security. A
store running both plugins shares one cached verdict per visitor, and the missing
fields could stop Security’s crawler policy from applying to a visitor whose verdict
was cached at checkout. * Corrected in this readme: cached screening results last
between 5 minutes and 1 hour per IP (the lifetime the API recommends), not a fixed
5 minutes. * Corrected in this readme: the “will this block real customers” answer
described dashboard features belonging to the Predax Security plugin rather than
this one.
#### 1.9.0
**Checkout accuracy**
* Fixed one shopper’s screening result being reused for a
different shopper behind the same network. The cached result was keyed on the IP
alone, but the result also depends on the browser’s timezone – which the Blocks
checkout and the classic checkout send differently – so a timezone mismatch could
be inherited by the next genuine customer and get their order tagged or held. *
An allow-listed IP no longer has its order tagged from a screening result recorded
before it was allow-listed. * If the Predax API cannot be reached during checkout,
any earlier screening result is now discarded rather than being applied to the new
order. Previously a customer could be held on a verdict from a previous attempt,
possibly from before they turned a VPN off.
**Events Log**
* “Filter by reason” now works on the Flagged tab. Flagged and held
orders were saved without a reason, so the filter returned nothing whatever you
chose. * Flagged orders now record the rule that actually fired – order velocity,
disposable email, billing mismatch or the risk threshold – instead of always claiming
the risk threshold was crossed. * The chosen reason filter is no longer lost when
you move to the next page of results.
**Community Threat Network**
* The Blocks checkout now contributes to the Community
Threat Network. Only the classic checkout did, so stores using the default Blocks
checkout received other stores’ data without contributing any of their own.
**Other fixes**
* Risk labels on orders now match the bands the Predax API actually
issues; an order scoring 75 previously showed a different level to the one the API
reported. * Importing a settings file can no longer redirect the plugin to a different
address – the API key is sent to that address, so this is now restricted to http
and https as the settings form already was. * Uninstall now removes leftover lookup
locks and the shared verdict cache.
**Efficiency**
* Predax Fraud Guard and Predax Security now share one cached verdict
per visitor, so a store running both no longer spends two checks on the same person.*
Cached verdicts now follow the lifetime the API recommends (up to an hour) instead
of a fixed five minutes. * Tested up to WordPress 7.1.
#### 1.8.4
* Fix: hitting your plan’s DAILY check limit no longer reports it as the monthly
limit. The notice used to say checkout screening was paused “until your quota
resets on the 1st” when it actually resumes at midnight UTC the same day. It
now names the right limit and tells you the exact time screening resumes.
* Improved: fewer API checks are used for the same shopper. Checkout pages make
several parallel requests, and each one used to trigger its own lookup; the plugin
now performs a single lookup and shares the result.
#### 1.8.3
* Fix: re-running the Setup Wizard and choosing “Monitor Only” now also switches
off known-malicious IP blocking. Previously that one rule stayed on if a stricter
preset had enabled it, so a preset promising to block nothing could still reject
checkouts.
* Fix: Fraud Guard admin notices no longer appear on Predax Security plugin pages
when both plugins are installed – they now show only on Fraud Guard’s own screens.
#### 1.8.2
* New: an invitation to join the Community Threat Network now appears on the Predax
screens, with a one-click opt-in. Stores in the network warn each other, so a
card tester blocked at another store is already known to yours. It remains entirely
opt-in and was previously easy to miss.
#### 1.8.1
* Fix: shoppers on a VPN or proxy set to “Monitor” were still rejected when datacenter
blocking was on, because VPN servers run in datacenters. Monitoring now means
monitoring.
* Fix: stores in the Community Threat Network were reporting every shopper as having
no VPN/proxy/Tor/datacenter signal, so shared intelligence was based on incomplete
data.
#### 1.8.0
* Fix: verified search engines are no longer caught by category rules, on both
the classic and block-based checkout.
* New: allow any IP directly from the Events Log.
* New: tell us why you’re deactivating, so we can fix it.
#### 1.7.4
* Fix: turning OFF both “Block VPN” and “Monitor VPN” now genuinely ignores VPN
shoppers. Previously the order fell through to the risk-score check and was blocked
anyway, logged as “high risk” with no mention of VPN. Same fix for the proxy
toggles, on both the classic checkout and the Store API (block-based checkout)
paths.
#### 1.7.3
* Fix: known-malicious IP blocking (introduced in 1.7.2) now correctly reads the
malicious signal from the Predax API — a normalization gap meant it never actually
triggered a block.
* New: the Events Log now shows the specific reason for a malicious-IP flag (botnet
C2 vs. hijacked network range) instead of a generic “malicious” tag.
* New: the API key field is now masked (with a Show/Hide toggle) instead of shown
in plain text — both on the Fraud Rules tab and in the Setup Wizard’s manual-
entry step — and is excluded from Settings Export/Import so it can never leave
the site in a shared file.
#### 1.7.2
* New: known-malicious IP blocking — a dedicated category (separate from your general
risk mode) for botnet C2 and hijacked-netblock IPs. Off by default; enable it
via the Setup Wizard’s Recommended/Strict presets, the Fraud Rules tab, or the
one-click “Enable malicious-IP blocking” notice.
* New: filter the Events Log by reason — narrow the log to just one block category
instead of scrolling the full list.
#### 1.7.1
* New: live API usage meter on the Fraud Guard settings page — shows your monthly
IP-check usage against your plan’s quota (fetched hourly), with an upgrade link
when you’re above 80%.
* New: quota notice — if your plan’s monthly IP checks run out (checkout screening
pauses and orders are allowed through until the quota resets), the plugin now
tells you on its admin pages instead of failing silently. Dismissible per month.
* New: API circuit-breaker — if the Predax API becomes slow or unreachable, checkouts
now fail open instantly after a few consecutive failures instead of each waiting
on the timeout, and the settings page shows an “API degraded” indicator. The
API request timeout was lowered from 8s to 3.5s, so even a first failure delays
a checkout far less.
* Privacy: customer emails in the Events Log are now masked before storage (“bi***@
example.com”). Enough to recognise a repeat customer; the linked order still
holds the full email. Existing rows are untouched and age out via the log retention
setting.
* Performance: the IP allow/deny list options no longer autoload on every page
request (the deny list can grow via the chargeback auto-append). A one-time migration
updates existing installs.
* Docs: installation instructions rewritten for installing from the WordPress.org
plugin directory; added a section on free vs paid plan limits.
#### 1.7.0
* Rebrand: IPSentry is now **Predax**. This is the first WordPress.org release
of the WooCommerce plugin. The plugin name, admin menu, and links now use Predax(
predax.io). Your existing settings, API key, and order data are preserved — internal
option names are unchanged, so nothing needs reconfiguring.
* Admin menu moved to a lower position so it no longer sits among the core WordPress
menu items.
* Compliance: the OAuth-callback exit page now registers and prints its CSS/JS
through the WordPress script API (wp_register_style/wp_register_script + wp_print_styles/
wp_print_scripts) instead of hand-written tags. The WooCommerce settings save
and checkout timezone read run inside WooCommerce’s own nonce-verified flows
and carry inline justifications for the static analyser.
* Compatibility: declared WooCommerce High-Performance Order Storage (HPOS) compatibility.
* Fix: the order-velocity time window now uses a timestamp-based date query (the
previous datetime-string form could be misread by WooCommerce and count orders
outside the window).
* Hardening: checkout error notices are HTML-escaped before being added; the settings-
import upload is capped at 512 KB with bounded JSON depth; the API base URL accepts
http/https only; the timezone cookie is marked Secure on HTTPS stores; the Store
API block path gained an explicit return after blocking.
* Clarity: Refund / Chargeback Feedback labels and docs now state that “Log” reports
go through the Community Threat Network opt-in; the readme documents exact API
endpoints and the full telemetry data list.
* New: IP allow-list (never block trusted IPs) and a managed deny-list, both supporting
single IPs and CIDR ranges (IPv4 + IPv6), editable from the settings page and
the WooCommerce Predax tab.
* New: the Community Threat Network opt-in is now a settings toggle (still off
by default) instead of import/export only.
* New: Events Log retention setting (default 90 days; 0 = keep forever) with automatic
daily cleanup, plus a 7-day/all-time stats summary, CSV export, and a Clear Log
button.
* New: “Behind a proxy / CDN” setting (off by default). Enable it when your store
is behind Cloudflare, a CDN, or a reverse proxy so the real customer IP is read
from forwarded headers; when off, only the direct connection IP is used, so the
customer IP cannot be spoofed to bypass fraud checks.
* Security: the Events Log CSV export now neutralises spreadsheet formula-injection—
a billing email such as “=…@example.com” can no longer execute as a formula when
the export is opened in Excel/Sheets.
* Fix: the “Flag for review” action on the velocity, disposable-email, and billing-
country-mismatch rules now reliably tags the order, adds the order note, and
writes the Events Log entry (previously these markers could be dropped on processed
orders).
* Fix: a critically-risky IP (risk score 90+) is now always blocked while a blocking
mode is active, even when its VPN/proxy category is set to Monitor.
* Fix: the WooCommerce Predax settings tab now saves correctly (removed an invalid
nested import form; import is now on the Fraud Guard Developer page).
* Hardening: /0 (match-all) entries are rejected in the IP allow/deny lists, and
uninstall now cleans every site on a multisite network.
* No change to the opt-in model — the plugin still makes zero outbound requests
until you enter an API key and save a protection mode.
#### 1.6.2
* Compliance: community-feedback telemetry is now explicitly opt-in (off by default)
behind a new `ipsentry_woo_community_enabled` option. Existing installs stop
sending telemetry until they flip this on.
* Compliance: all phoning-home defaults flipped to off — `block_proxy`, `block_tor`,
and `monitor_vpn` default to `'no'` on fresh installs.
* Compliance: removed the self-hosted plugin updater class per WP.org Guideline
8.
* Compliance: extracted every inline `