Predax Fraud Guard for WooCommerce – Anti-Fraud, Fake Order & Card Testing Protection

Predax Fraud Guard is anti-fraud for WooCommerce: it stops fake orders, card testing and chargebacks before the order exists. Card testers and stolen-card fraudsters typically check out from behind a VPN, proxy, Tor or datacenter IP. Fraud Guard screens the customer’s IP at checkout and scores its fraud risk from 0 to 100, and for each rule you choose what happens. Block refuses the checkout before payment is taken, so a blocked attempt never becomes a gateway fee or a chargeback. Hold lets the payment go through and keeps the order on hold for your review, so nothing ships until you decide. Or simply tag the order. Works with any payment gateway and with both the classic and block checkout.

See what Predax knows about your own IP — free, no signup.

Off by default. A fresh install sends nothing anywhere. Connect your Predax key and choose a protection mode; until then the plugin does nothing.

What it stops

• Card testing — bots running stolen card numbers through your checkout in bulk
• Orders from VPNs, proxies, Tor and datacenter IPs
• Too many orders, too fast — velocity rules catch rapid repeat attempts
• Billing country that doesn’t match the customer’s real location
• Disposable email addresses at checkout

Start in tag-only mode

The default once configured is Tag + note: flagged orders get a “Predax: Medium / High / Critical Risk” tag and an order note, and nothing is blocked. Watch what the rules would have done, then turn on Block high risk or Block critical only when you’re confident. Optionally send high-risk orders to On Hold for review instead of rejecting them: the payment is taken and the order waits for you before anything ships, so you can refund a fraudulent one instead of sending the goods.

Safe for real customers and search traffic

• Verified search engines are never blocked by your VPN, datacenter, country or risk rules.
• Every decision is on the record. The Events Log shows which orders were tagged, held or blocked, and why — so a too-strict rule shows up in the log, not in falling sales.
• One-click allow-listing from the Events Log lets a good customer check out again immediately.

Also included

Risk score, threat flags and country saved on every order for reporting · Refund/chargeback feedback that adds the IP to your deny list · IP and CIDR allow/deny lists · Optional Community Threat Network sharing

Free plan

Click Connect with Predax in the setup wizard and your free account and API key are created for you — nothing to copy or paste. The free plan includes 5,000 IP checks a month with full VPN, proxy, Tor and datacenter detection and risk scoring. No credit card. Checkouts are only checked when they happen and results are cached, so it covers a small store comfortably; busier stores can move to a paid plan — same plugin, same settings, same key.

Third Party Services

This plugin connects to external services operated by Predax (https://predax.io) only after you have saved an API key: checkout screening additionally requires a protection mode to be enabled, and the admin-side account-usage lookup (described below) sends no visitor data at all. By activating this plugin and entering an API key you agree to the Predax Terms of Service and Privacy Policy.

You are responsible for ensuring your use of customer IP data at checkout complies with applicable privacy laws (including but not limited to GDPR, CCPA) and your own store’s privacy policy. This plugin does not assert PCI-DSS, GDPR, or CCPA compliance on your behalf.

Predax IP Intelligence API

Used to look up a risk score and classification signals for each checkout IP.

• Data sent: the customer’s IP address at checkout; the browser-reported IANA timezone string (when available on the classic checkout form — used for the timezone-mismatch signal); your custom scoring weights (only if Custom Scoring is enabled).
• What is NOT sent: no billing/shipping names, street addresses, phone numbers, email addresses (only the email’s domain part, and only under the separate Email Domain Screening below), product details, prices, or payment data. The billing-country-mismatch rule compares your order’s billing country against the API’s IP-country result locally — billing details never leave your site.
• When: during WooCommerce checkout validation, and only while a protection mode is saved in settings.
• Caching: classification results are cached in the site’s transients for between 5 minutes and 1 hour per IP (the lifetime the API recommends), so repeat checkouts from the same IP do not generate duplicate API calls.
• Endpoint: POST https://predax.io/api/v1/check/ip
• Service URL: https://predax.io
• Terms of Service: https://predax.io/terms
• Privacy Policy: https://predax.io/privacy

Email Domain Screening (only when the Disposable Email rule is enabled)

Used to check whether the billing email’s provider is a disposable/throwaway service, against a server-side list of thousands of domains (the plugin’s built-in list covers only ~50).

• Data sent: the domain part of the billing email address only — for example gmail.com. The email address itself is NEVER sent: the part before the @ does not leave your site, and the mailbox-level checks (role account, random-looking name) run locally in PHP on your own server.
• When: during checkout validation, and only while the Disposable Email rule is set to Flag or Block. If the API is unreachable, the plugin falls back to its built-in local list and the checkout proceeds normally.
• Caching: email-domain results are cached in the site’s transients for up to 6 hours per domain, so repeat checkouts with the same email provider do not generate duplicate API calls.
• Endpoint: POST https://predax.io/api/v1/validate/email
• Plan usage: email-domain lookups count against your Predax plan allowance, the same as checkout IP checks. Results are cached per domain for 6 hours and the built-in list is checked first, so in practice this is roughly one lookup per new email provider your customers use.
• Service URL: https://predax.io
• Terms of Service: https://predax.io/terms
• Privacy Policy: https://predax.io/privacy

Account Usage Lookup (admin pages only)

Used to show the “API usage this month” meter on the Fraud Guard settings page, and only when an API key is saved.

• Data sent: your Predax API key (as the authentication header). No customer or visitor data is sent.
• When: when an administrator views the Fraud Guard settings page. The result is cached for 1 hour, so at most one lookup per hour regardless of admin page views.
• Endpoint: GET https://predax.io/api/v1/auth/usage
• Service URL: https://predax.io
• Privacy Policy: https://predax.io/privacy

Predax Community Threat Network (opt-in, off by default)

The plugin can optionally send an anonymised telemetry signal — the IP address, its risk score and detection flags, its network (ASN) number and name, its country code, and the checkout outcome (allowed / monitored / blocked, or refund/chargeback feedback) — to the Predax Community Threat Network so all participating stores benefit from a shared feed. The Refund / Chargeback Feedback “Log” action reports through this same channel, so it requires this opt-in; its “Blacklist” action updates your local deny list regardless.

This feature is off by default. It is controlled by the ipsentry_woo_community_enabled option, which defaults to 'no', with a checkbox on the Advanced settings tab. The plugin will not send community-feedback telemetry unless you enable it. Customers’ personal data (names, emails, billing/shipping addresses, order contents) is never included in the telemetry payload.

• Endpoint: POST https://predax.io/api/v1/telemetry/event
• Service URL: https://predax.io
• Privacy Policy: https://predax.io/privacy

OAuth One-Click Connect (optional)

Only triggered when an administrator clicks the Connect with Predax button in the setup wizard. Your browser is redirected to predax.io to authorise the connection, which returns an API key to your site.

• Data sent: your WordPress site URL, site name, and a PKCE state/code-challenge pair. No customer data is involved.
• When: only during the click-to-connect OAuth flow.
• Endpoint: POST https://predax.io/api/v1/oauth/token
• Service URL: https://predax.io
• Privacy Policy: https://predax.io/privacy

Deactivation Feedback (optional, admin-initiated)

Shown only when an administrator deactivates the plugin from the Plugins screen and chooses to answer the “why are you deactivating?” prompt.

• Data sent: the plugin slug, the plugin version, and a single pre-defined reason code you select (e.g. “it blocked real customers”). No site URL, no email address, no visitor data, and no IP address are sent.
• When: only when you select a reason and click “Send & deactivate”. Clicking “Skip & deactivate” sends nothing at all.
• Endpoint: POST https://predax.io/api/v1/feedback/deactivation
• Service URL: https://predax.io
• Privacy Policy: https://predax.io/privacy

Cookies set by this plugin

• ipsentry_tz — set on WooCommerce checkout pages (only while an API key is configured) via assets/js/ipsentry-woo-tz.js. Stores the customer’s browser-reported IANA timezone (string, max 64 chars). Used server-side for the optional timezone-mismatch fraud rule. Expires after 24 hours (max-age=86400), path=/, SameSite=Lax, and marked Secure on HTTPS stores. The plugin reads this cookie only at checkout-validation time.

The plugin does not set any advertising, analytics, or tracking cookies.