XeroWP
SazCOD – COD Order Confirmation for WooCommerce
SazCOD – COD Order Confirmation for WooCommerce

SazCOD – COD Order Confirmation for WooCommerce

0/5 (0 ratings) — active installs Updated Nov 13, 2026
cash on deliverycodfake order protectionorder confirmationSmart COD
Download v1.0.3
Cash on Delivery confirmation banner on the Order Received page.

Cash on Delivery confirmation banner on the Order Received page.

Cash on Delivery (COD) is essential for e-commerce growth in many regions, but fraudulent orders, impulsive checkouts, and wrong delivery addresses cost merchants substantial fulfillment and return shipping fees.

SazCOD – COD Order Confirmation for WooCommerce is a lightweight, 100% self-hosted plugin that automatically intercepts COD orders containing physical goods and places them into a custom status: Awaiting Confirmation.

The buyer receives an actionable confirmation block in their order email. Clicking the link takes the customer to a secure verification screen where they explicitly confirm their order. Once confirmed, the order instantly transitions to Processing so your warehouse can safely begin packing.

Key Features

  • Zero External Dependencies: 100% self-hosted. No external APIs, SMS gateways, or recurring subscriptions.
  • WooCommerce HPOS Compatible: Fully compatible with High-Performance Order Storage (custom_order_tables).
  • Block Checkout & Classic Checkout Support: Intercepts COD orders across both WooCommerce Checkout Block (Store API) and classic shortcode checkouts.
  • Smart Physical Goods Detection: Only intercepts orders requiring physical shipping; virtual and digital orders pass through normally.
  • Hardened Token Security Architecture:
    • Cryptographically random, SHA-256 hashed tokens bound to the unique order.
    • Encrypted at rest using AEAD AES-256-GCM with order-bound additional authenticated data (v1:{order_id}).
    • Strict anti-cache headers (Cache-Control: no-store, no-cache) to prevent intermediate caching of confirmation screens.
    • Synchronized 48-hour WordPress nonce lifetime matching the token TTL.
    • Pre-commit business guards verifying COD payment method, awaiting-confirm status, and token hash.
    • Sequential token revocation and native WooCommerce order state machine transitions to eliminate double-confirmation races.
    • Post/Redirect/Get (PRG) flow with single-use opaque result tokens to eliminate order status enumeration.
    • Strict Content Security Policy (default-src 'none'), Referrer-Policy, and anti-tampering checks.
  • Responsive, Clean UI: Mobile-friendly confirmation screen rendered using native styles without heavy frontend libraries.
  • Custom Order Received Banner: Enhances the WooCommerce Order Received / Thank You page with a clear verification notice for Cash on Delivery buyers.

Why SazCOD instead of Heavy Gateway Changers?

Unlike bulky Cash on Delivery plugins that lock core settings behind artificial paywalls or break on modern WooCommerce Checkout Blocks, SazCOD runs 100% on-premise, respects Store API block checkouts natively, and requires zero external cloud APIs.

Privacy Policy

The plugin does not transmit customer order data to external services or third-party servers. It stores only confirmation-related metadata (_qcoc_confirmed_at) in the local WooCommerce order. Customer information displayed on the self-hosted confirmation screen is retrieved directly from the merchant’s local WordPress database.