Name: Antiro Order Risk Screening for WooCommerce
Author: abdellhadi

Antiro analyzes every order in real-time using IP geolocation, device fingerprinting, VPN/proxy detection, and behavioral analysis to prevent fraudulent orders before they cost you money.

Features:

IP Analysis — Detects non-local IP addresses, VPN connections, Tor exit nodes, and datacenter IPs.
Device Fingerprinting — Identifies suspicious devices using browser canvas, WebGL, and hardware signals.
Bot Detection — Catches headless browsers, Selenium, Puppeteer, and other automation tools.
WooCommerce Integration — Works with both Classic Checkout and Block Checkout (WooCommerce 8+), and with order forms of other plugins that create WooCommerce orders (one-page COD forms on product pages).
Actions — Automated orders are refused before they are created. Doubtful orders are put On hold with a note listing the reasons, so your team calls them first. The protection mode (protect, monitor or off) is set in the Antiro dashboard.
Never loses an order — If Antiro is slow or unavailable, the order is accepted and screened again in the background.
Ad protection — Orders blocked as automated are kept out of your Meta and TikTok conversion data.
Order Risk Column — See risk scores directly in the WooCommerce orders list.
Connection check — The settings page checks your API key with Antiro each time it opens.
Logs — Written to wp-content/uploads/antiro-order-risk-screening/logs for troubleshooting (order IDs and Antiro’s answers, no customer details).

External services

This plugin connects to Antiro, a fraud-screening service operated by Antiro (https://antiro.io). An Antiro account is required.

Order screening — when a customer places an order (Classic or Block Checkout, or an order form of another plugin that creates a WooCommerce order), the plugin sends to https://api.antiro.io: the customer’s IP address (and, when Cloudflare reported it, that it did), name, phone number, wilaya/state, city, address and email; the order total, the number of items and the first product (name, link, image, SKU and product ID); the WooCommerce order ID when the order already exists, or, for a Classic Checkout order, which is checked before it exists, a one-way hash that identifies the checkout attempt (a repeated submission gets the same answer; a delayed check of the order sends both); the site address, the plugin version, how the order reached the plugin (Classic Checkout, Block Checkout, created another way, or a delayed check) and, for the last two, the “created via” value WooCommerce stores on the order; and the Antiro session reference (cookie _atr_st or the form field antiro_token).
The customer’s browser headers — each order check also carries these headers of the customer’s own request to the site: User-Agent, Accept-Language, Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, X-Requested-With, Origin, and the host name of the Referer (never the full referring address). Each header is cut to 256 characters (512 for User-Agent). No other cookie or header of the customer is sent.
The checkout’s script setup — the check of an order placed through the checkout also tells Antiro that the checkout page runs the Antiro script in collect-only mode (sdk_expect “collect”), so that Antiro can recognise an order sent without the script, and whether strict mode is on (sdk_required). It is left out when the plugin does not load the script on the checkout (no publishable key, or the antiro_load_sdk filter), and it is never sent for orders created another way, whose pages may not run the script.
Delayed screening — if Antiro does not answer in time, the plugin keeps the IP address (and whether Cloudflare reported it), the session reference, those headers and, for a checkout order, the script setup (for a Classic Checkout order also the attempt hash) in the order’s data, and sends the check again up to five times within about seven hours. It deletes them as soon as the order is screened, the retries end or protection is turned off; if the plugin is deactivated before that, they stay in the order’s data. The IP address sent with a check also stays recorded on the order, as WooCommerce records the customer’s IP address.
Outcomes — when the store completes, refunds or cancels a screened order, the plugin reports the outcome (delivered, returned or cancelled) of Antiro’s check to the same API. Cancellations made by Antiro itself are not reported.
Browser script — on the checkout page (not its order-received and order-pay pages) and on product pages, the plugin loads https://js.antiro.io/v2/antiro.js asynchronously (it never blocks the page). The script reads device and browser characteristics (screen, language, time zone, platform, processor, memory and touch support, graphics, canvas and audio rendering, automation indicators, including whether a browser automation tool is attached and whether a background worker of the page reports the same characteristics), how long its own first request to Antiro took (connection, encryption handshake and response times), and counts and timings of interactions with the page (clicks, touches and key presses, never which keys), and sends them to https://api.antiro.io with the page address without its query string (for a visit from an ad, only which network the ad belongs to and a one-way hash of its click identifier), the host name of the referring site, and the phone number typed in the order form (to link the visit to the order). Antiro also receives the IP address and the request headers the browser sends with them. When Antiro asks for it, the script can run a WebRTC check that shows Antiro the device’s network addresses; this check contacts a public STUN server (by default Google’s, stun.l.google.com), which sees the device’s IP address. When Antiro sees a VPN or proxy, the script can show the customer a short message asking to turn it off. It stores a visitor identifier in the first-party cookie _atr_v (180 days, renewed at each visit) and in a localStorage copy without expiry that restores the cookie, the session reference in the first-party cookie _atr_st (2 hours), and, for a visit identified as automated, the flag _atr_px in sessionStorage. Site owners can load it on other pages with an order form through the antiro_load_sdk filter.
Ad pixels — for an order Antiro refused or cancelled as automated (not one it judged too late to cancel, which is left to you), the plugin tells Facebook for WooCommerce and Pixel Manager for WooCommerce not to send the purchase, and on that order’s confirmation page prints a small inline script, ahead of the pixel code, that withholds Meta and TikTok pixel events (consent revoke) and Snap pixel events (the Snap library is then not loaded), pushes antiro_verdict “bot” to the Google Tag Manager data layer and sets the same _atr_px flag. This sends nothing anywhere.
Connection — when the administrator clicks “Connect”, the browser is sent to https://dashboard.antiro.io with the site’s domain and the address of the plugin’s settings page. Once the administrator approves the connection there, the plugin asks https://api.antiro.io to complete it: Antiro calls this site’s /wp-json/antiro/v1/verify endpoint to confirm the site belongs to the administrator, and answers with the store’s API key and publishable key. While the site is not connected, the settings page asks https://api.antiro.io whether the site’s domain is already registered; once it is connected, the settings page checks the API key with Antiro each time it is opened. The plugin also asks Antiro for the store’s current publishable key twice a day (with WP-Cron) and when an administrator opens wp-admin (at most every 12 hours), and keeps the key named in the answer to an order check, so that a key renewed, deleted or switched off in the Antiro dashboard reaches your pages.
Relay through your store — some networks cannot reach Antiro’s addresses while they reach your store. For their customers, the browser script sends the same data through your own site instead (REST route /wp-json/antiro/v1/sdk/m), only when Antiro itself does not answer: the plugin forwards each message unchanged to https://api.antiro.io/v1/sdk/r with your secret API key, the customer’s IP address (as the plugin reads it for the order check) and the request headers the browser sent (User-Agent, Accept, Accept-Language, the Sec-CH-UA and Sec-Fetch headers, Origin, X-Requested-With; never cookies). When https://js.antiro.io has not loaded the script within 3.5 seconds, the page loads the same script from your site (REST route /wp-json/antiro/v1/sdk.js), which the plugin fetches from https://js.antiro.io and keeps for 5 minutes. The plugin stores none of this: no option, no log line.