Name: Predax Fraud Guard for WooCommerce
Author: Predax

Predax Fraud Guard for WooCommerce is an opt-in checkout-screening tool. After you enter a Predax API key and choose a protection mode, the plugin sends the customer’s IP to the Predax API during WooCommerce checkout so your store can decide whether to allow, tag, or block the order.

On a fresh install the plugin does nothing — no outbound requests are made until you complete setup and pick a protection mode. The default mode once configured is tag-only (no blocking), so you can see flagged orders in your dashboard before turning on anything that rejects a customer.

How It Works

You install and activate the plugin. Nothing happens — the plugin stays dormant until you finish setup.
You enter a Predax API key (free account available at predax.io).
You pick a protection mode in Fraud Guard Settings (or in the 3-step setup wizard). Choices: Tag + note, Block high risk, or Block critical only.
On each WooCommerce checkout after that point, the plugin sends the customer’s IP address to the Predax API, receives back a risk score and signal flags (is_vpn / is_proxy / is_tor / is_datacenter), and tags / holds / blocks the order according to your configuration. Results are cached for up to 5 minutes per IP.

You can revoke the API key or switch the mode back to “Tag only” at any time.

Risk Tagging

Orders that reach the tag threshold (default: risk score 40) are tagged based on band:

Risk 40–69 — tagged “Predax: Medium Risk” with an order note
Risk 70–89 — tagged “Predax: High Risk” with an order note
Risk 90–100 — tagged “Predax: Critical Risk” with an order note

Features

Checkout screening (after you enable a protection mode) — every order is checked against Predax IP threat intelligence
VPN / Proxy / Tor / Datacenter flags — detect anonymised connections at checkout
Risk score threshold blocking — optionally block checkouts above a configurable risk score
Automatic order hold (opt-in) — move high-risk orders to On Hold for manual review instead of processing them
Order velocity rules (opt-in) — flag or block customers placing too many orders in a short window
Billing country vs IP mismatch (opt-in) — flag or block orders where billing country differs from detected IP country
Disposable email detection (opt-in) — reject checkouts using throwaway email providers (30+ supported)
Refund / chargeback feedback (opt-in) — when a tagged order is refunded or cancelled, add its IP to your local deny list, and/or report the outcome to the Community Threat Network (when that opt-in is enabled)
Order meta logging — stores risk score, threat flags, and detected country on every order for WooCommerce reporting
Events Log — a dashboard page showing blocked attempts and flagged orders

Defaults

All protection toggles default to off on a fresh install. The only thing the plugin writes to options on activation is a database version marker for the events-log table. You will need to explicitly enable any rule you want to apply.

Free Tier

Third Party Services

This plugin connects to external services operated by Predax (https://predax.io) only when you have explicitly enabled a protection mode. By activating this plugin and entering an API key you agree to the Predax Terms of Service and Privacy Policy.

You are responsible for ensuring your use of customer IP data at checkout complies with applicable privacy laws (including but not limited to GDPR, CCPA) and your own store’s privacy policy. This plugin does not assert PCI-DSS, GDPR, or CCPA compliance on your behalf.

Predax IP Intelligence API

Used to look up a risk score and classification signals for each checkout IP.

Data sent: the customer’s IP address at checkout; the browser-reported IANA timezone string (when available on the classic checkout form — used for the timezone-mismatch signal); your custom scoring weights (only if Custom Scoring is enabled).
What is NOT sent: no billing/shipping names, street addresses, phone numbers, emails, product details, prices, or payment data. The billing-country-mismatch rule compares your order’s billing country against the API’s IP-country result locally — billing details never leave your site.
When: during WooCommerce checkout validation, and only while a protection mode is saved in settings.
Caching: classification results are cached in the site’s transients for 5 minutes per IP, so repeat checkouts from the same IP do not generate duplicate API calls.
Endpoint: POST https://predax.io/api/v1/check/ip
Service URL: https://predax.io
Terms of Service: https://predax.io/terms
Privacy Policy: https://predax.io/privacy

Predax Community Threat Network (opt-in, off by default)

The plugin can optionally send an anonymised telemetry signal — the IP address, its risk score and detection flags, its network (ASN) number and name, its country code, and the checkout outcome (allowed / monitored / blocked, or refund/chargeback feedback) — to the Predax Community Threat Network so all participating stores benefit from a shared feed. The Refund / Chargeback Feedback “Log” action reports through this same channel, so it requires this opt-in; its “Blacklist” action updates your local deny list regardless.

This feature is off by default. It is controlled by the ipsentry_woo_community_enabled option, which defaults to 'no', with a checkbox on the Advanced settings tab. The plugin will not send community-feedback telemetry unless you enable it. Customers’ personal data (names, emails, billing/shipping addresses, order contents) is never included in the telemetry payload.

Endpoint: POST https://predax.io/api/v1/telemetry/event
Service URL: https://predax.io
Privacy Policy: https://predax.io/privacy

OAuth One-Click Connect (optional)

Only triggered when an administrator clicks the Connect with Predax button in the setup wizard. Your browser is redirected to predax.io to authorise the connection, which returns an API key to your site.

Data sent: your WordPress site URL, site name, and a PKCE state/code-challenge pair. No customer data is involved.
When: only during the click-to-connect OAuth flow.
Endpoint: POST https://predax.io/api/v1/oauth/token
Service URL: https://predax.io
Privacy Policy: https://predax.io/privacy

Cookies set by this plugin

ipsentry_tz — set on WooCommerce checkout pages (only while an API key is configured) via assets/js/ipsentry-woo-tz.js. Stores the customer’s browser-reported IANA timezone (string, max 64 chars). Used server-side for the optional timezone-mismatch fraud rule. Expires after 24 hours (max-age=86400), path=/, SameSite=Lax, and marked Secure on HTTPS stores. The plugin reads this cookie only at checkout-validation time.

The plugin does not set any advertising, analytics, or tracking cookies.