Sooner or later every WooCommerce store gets them. Orders from names that are just random letters. A burst of checkouts testing stolen card numbers. Sign-ups from addresses that disappear an hour later. Each one lands in your orders list, sends you an email and throws off your reports.

OrderSieve looks at every checkout before the order is placed and turns away the ones that were clearly not made by a person. The checks run in the background, so your customers check out exactly as before. The recommended settings are on as soon as you activate the plugin, and you can fine-tune them from one settings tab.

OrderSieve requires WooCommerce 8.0 or later.

What it checks

A hidden field. The checkout form gets an extra field that people never see. Bots that fill in every field give themselves away. This one needs the classic checkout.
How fast the checkout was. A person needs a few seconds at least to fill in a checkout form. Checkouts submitted faster than that, 3 seconds by default, are turned away. On the classic checkout the start time is signed and tied to the shopper’s session, so it cannot be forged or reused. On the block checkout it is the moment the shopper first added something to the cart.
The email address. Addresses from throwaway providers such as mailinator.com or temp-mail.org are rejected, along with any subdomain of them. You can add your own domains to the list.

What happens to a blocked checkout

The shopper sees your rejection message and the order is not placed. On the classic checkout no order is created at all. On the block checkout the check runs before WooCommerce creates a customer account, holds coupons, reserves stock or takes payment. The unfinished order is cancelled and gets a note with the reason, and you are not sent a “Cancelled order” email about it.

With logging on, which is the default, every blocked attempt is logged with the reason, the email address entered and the IP address.

It fails on the safe side

When OrderSieve cannot tell how long a checkout took, for example for a shopper whose cart was started before the plugin was activated, it lets the order through. A lost sale costs more than a stray junk order, so the time check only ever blocks when it is sure.

Keep an eye on what was blocked

Tools OrderSieve Logs shows the 100 most recent blocked attempts, with the time, the reason, the email address and the IP address. The same entries are in WooCommerce Status Logs under the source ordersieve, whether WooCommerce writes its logs to files or to the database. From the logs screen you can clear the log or run the junk order cleanup straight away.

Clean up junk orders

Blocked block-checkout orders stay in your orders list as cancelled. If you would rather not keep them, turn on the cleanup. Once a day, through WooCommerce’s Action Scheduler, it deletes orders that OrderSieve blocked and that are older than the number of days you choose, up to 50 per run. Orders OrderSieve did not block are never touched, including ones you cancelled yourself. The cleanup is off by default.

What you can adjust

Everything lives on one tab under WooCommerce Settings OrderSieve:

Turn all checks on or off.
The minimum time a checkout must take, from 0 to 60 seconds. 0 turns the time check off.
Whether to block throwaway email providers, and your own list of extra domains, one per line.
The message a blocked shopper sees. Leave it empty and shoppers get the default message in their own language.
Whether blocked attempts are logged.
How many days to keep blocked orders before the cleanup deletes them, from 0 to 365. 0 turns the cleanup off.

For developers

Filters let you add domains to the block list, change the rejection message, or skip the time check, for example on a store that relies on one-click express payments. An action fires on every blocked attempt, so you can count attempts or alert someone. The available hooks are listed in the FAQ below.

Privacy

OrderSieve runs entirely on your own server. It does not call out to any service, load anything from a CDN, collect usage data or set cookies of its own. The time check stores one timestamp in the shopper’s existing WooCommerce session. When an attempt is blocked and logging is on, the reason, the email address entered and the IP address are written to your WooCommerce logs, where they stay on your server and follow your WooCommerce log retention setting. Suggested text for your privacy policy is added under Settings Privacy Policy Guide.

When you delete the plugin it removes its settings, its scheduled cleanup and its log entries.