baFFLe Search™ requires a paid subscription to the baFFLe Search™ data service. The service supplies the nationwide FFL dealer list and building-level map pins that the dealer search runs on. The plugin is the client for that service: it downloads the list to your own site and searches it there.

What the service adds over the raw ATF file

ATF publishes its dealer list as a plain text file. The data service does the work of turning that file into something a checkout can use, and repeats it every month:

Cleaned. Records are normalized and checked, so bad rows never reach your store.
Deduplicated. One row per active license.
Rooftop-geocoded. Dealers are matched to their actual building, so the map shows the shop and not the middle of a ZIP code. The geocoding runs on our side, across the whole country.
Signed and published monthly. Each list carries a signature that the plugin verifies before using it. A list that fails the check is refused.

What the plugin does

When a cart holds a product you have flagged as an FFL item (a serialized firearm, frame, receiver, suppressor or other NFA item), the buyer searches the dealer list by ZIP code and distance, sees the dealers on a map, and chooses one. The shipping address is pinned to that dealer’s licensed premises and can’t be edited by the buyer. The order then waits in a dedicated Awaiting FFL verification status until you confirm the dealer’s license and press Mark FFL verified on the order screen.

ZIP-radius search (1, 5 or 10 miles) over the Census ZIP table that ships with the plugin, with a map of the results. Search runs on your own site.
Ship-to locked to the dealer. The buyer still enters their own billing address.
Hold for verification. FFL orders stop in Awaiting FFL verification; the buyer gets a “we’re confirming your dealer” email; you see the dealer’s license number, type, expiry month and warnings (license expired, dealer missing from the latest list, address changed) in an FFL Transfer box on the order. Optionally require an uploaded copy of the dealer’s license before an order can be marked verified.
Rules you set: which license types may receive (01, 02, 07 and the rest), blocked states, per-state notes shown to the buyer, in-store pickup for FFL items, your own checkout notice and email text.
Setup wizard under WooCommerce FFL Setup. Every step can be skipped and run again later.

Without an active subscription

Product flagging, the FFL requirement at checkout, the verification hold, the order screen, in-store pickup and every non-firearm product keep working with or without a subscription. What a subscription pays for is the list:

An out-of-date dealer list is not safe to ship against, so the list stops updating when a subscription ends and is removed within 30 days of its last update, the last time the service confirmed it. Until then, dealer search runs on the list you already have.
You get one warning email 17 days after that last update. The plugin asks the service once more before it removes a list, and a removed list comes back with the next update once your subscription is active.
A store that never had a license has no dealer list, so there is nothing to search. Checkout tells buyers to contact the store.

What it is not

You verify licenses. baFFLe Search™ shows you the receiving dealer’s details and links you to ATF eZ Check, but you confirm the license and complete the transfer under your own procedures. The plugin is a compliance aid, not legal advice. No plugin can provide 100% compliance, and it does not replace Form 4473, NICS, your bound book or your state’s rules. The dealer list does not carry SOT status: for NFA items you confirm the receiving dealer’s SOT yourself.

Requirements

A baFFLe Search™ subscription. Buy one here, or from the plugin’s FFL License screen.
WooCommerce 9.0 or newer with the block checkout (the Checkout block). The classic shortcode checkout is not supported: a cart holding an FFL item is refused there and the buyer is sent to the checkout page.
PHP 8.1 or newer.

baFFLe Search™ is published by Quartermaster Arms and is not affiliated with or endorsed by ATF. Terms of Service · Privacy Policy

External services

baFFLe Search™ sends no order or buyer data anywhere. Dealer search runs on your own site’s copy of the dealer list. The plugin uses these outside services:

baFFLe Search™ data service (Quartermaster Arms)

The paid service this plugin is built on. It supplies the FFL dealer list, built from public ATF records, and building-level map pins. Host: ffl-geo-feed.bh2win.workers.dev.

No connection is made until a subscription key is entered. After that the plugin checks the service weekly and downloads a new list when there is one; a new list is published monthly. Each request carries the site’s install ID and a signature made with the install’s secret. Your license key is never sent to this service, and neither is any order or buyer data.

Terms: https://www.quartermasterarms.com/baffle-search/terms/
Privacy: https://www.quartermasterarms.com/baffle-search/privacy/

OpenStreetMap tiles (tile.openstreetmap.org)

Used to draw the dealer map at checkout. The buyer’s browser loads map tiles directly from OpenStreetMap each time the map is shown, which shares the buyer’s IP address and the map area viewed.

Privacy: https://osmfoundation.org/wiki/Privacy_Policy
Tile usage policy: https://operations.osmfoundation.org/policies/tiles/

Freemius (freemius.com)

Used for key activation, the account page and checkout. When you activate a subscription key, Freemius receives:

your license key
your site’s URL and a hashed site ID
the plugin’s ID, slug and version, and the Freemius SDK version
your site’s admin return URLs
status flags: active, localhost, marketing off and tracking off
your server’s IP address
your WordPress version and site URL, carried in the request’s user agent

It does not receive the admin’s name or email, the site title, the site language, or your plugin or theme lists.

After activation, Freemius links this install to the license owner’s account. A daily license sync reports your site URL, plugin version, SDK version and active state, and deactivating or uninstalling the plugin reports the change of state.

Terms: https://freemius.com/terms/
Privacy: https://freemius.com/privacy/

Bundled data and links

ZIP-code center points come from U.S. Census ZCTA data and ship inside the plugin, so no connection to census.gov is made. The order screen has a button that opens ATF eZ Check in a new tab when staff click it; the plugin itself makes no connection to ATF.

Leaflet 1.9.4 (BSD 2-Clause) draws the map. The minified file, its unminified source and its license are all in assets/vendor/leaflet/.

The Freemius SDK in vendor/freemius/ is GPL software. Source for its minified files: the SDK at https://github.com/Freemius/wordpress-sdk, the pricing page at https://github.com/Freemius/pricing-page, jQuery Form at https://github.com/jquery-form/form and jQuery postMessage at https://github.com/cowboy/jquery-postmessage.

Privacy

baFFLe Search™ stores dealer records, order dealer choices, verification records and license copies on your own site only. The publisher never receives your customers’ data.

Terms of Service: https://www.quartermasterarms.com/baffle-search/terms/
Privacy Policy: https://www.quartermasterarms.com/baffle-search/privacy/