API Reference

Public classes and methods for CCP_Core, CCP_Fraud_Detection, CCP_Risk_Threshold, CCP_Trust_Score, CCP_Platform_Order, CCP_Threat_Intel, CCP_Rate_Limiter, CCP_IP_Whitelist, and CCP_Captcha.

Checkout Security core API

This page documents the public classes and methods available in the Checkout Security core plugin for developers building custom integrations or extensions.

These classes are part of the core plugin's public API. Internal and private methods may change between versions. Only the methods documented here are guaranteed to be stable.

Public classes

CCP_Core

CCP_Core is the main plugin singleton. It handles initialization, platform registration, adapter health checks, and the plugin boot sequence.

Method	Description
`instance()`	Returns the singleton instance of `CCP_Core`. Static method.
`register_platform( $adapter )`	Registers a platform adapter with the core. The adapter implements `CCP_Platform_Adapter_Interface`.
`get_platforms()`	Returns all registered platform adapters.
`is_platform_active( $platform_name )`	Checks whether a platform is registered and its adapter is healthy.
`check_adapter_health()`	Runs health checks on all registered adapters and returns the health status array.
`get_enabled_platforms()`	Returns the list of enabled platform slugs.
`get_security_admin_capability()`	Returns the WordPress capability required for security-sensitive admin actions. Filterable via `ccp_security_admin_capability`.

CCP_Fraud_Detection

CCP_Fraud_Detection is the fraud scoring engine. It runs multi-factor analysis on checkout attempts and produces risk assessments.

Method	Description
`register_platform_hooks()`	Registers platform-specific hooks for fraud checks on the active platform.
`check_checkout_fraud()`	Runs multi-factor fraud analysis on the current classic checkout attempt.
`check_store_api_checkout_fraud( $order = null, $request = null )`	Runs fraud analysis on a Store API checkout request.
`check_cart_fraud()`	Runs fraud analysis on cart operations.
`calculate_risk_score( $context = 'general' )`	Calculates and returns the risk score for the current context.
`ajax_check_fraud_risk()`	AJAX handler for on-demand fraud risk checks.

CCP_Risk_Threshold

CCP_Risk_Threshold manages the progressive risk thresholds used to map risk scores to response actions.

Method	Description
`instance()`	Returns the singleton instance. Static method.
`supports_current_platform()`	Returns whether the risk threshold system supports the current platform. Static method.
`get_risk_thresholds()`	Returns all configured risk thresholds as an array.
`get_risk_level( $score )`	Returns the risk level name for a given numeric score.
`get_risk_action( $risk_level )`	Returns the response action for a given risk level name.
`apply_progressive_actions( $risk_assessment, $context = 'checkout' )`	Applies graduated response actions based on the risk assessment.
`sanitize_thresholds( $input )`	Sanitizes threshold input for safe storage. Static method.
`get_risk_level_statistics( $days = 30 )`	Returns risk level distribution statistics for the given period.

CCP_Trust_Score

CCP_Trust_Score manages customer trust scores and recalculates scores across customers.

Method	Description
`initialize_trust_score( $user_id )`	Creates an initial trust score entry for a new user.
`get_trust_score( $user_id_or_email )`	Returns the trust score for a user ID or email address. Scores range from 0 to 100.
`calculate_trust_score( $user_id )`	Calculates the trust score for a user based on order history and other factors.
`update_trust_on_order_complete( $order_id )`	Updates the trust score after an order completes successfully.
`update_trust_on_order_failed( $order_id )`	Updates the trust score after an order fails.
`update_trust_on_order_cancelled( $order_id )`	Updates the trust score after an order is cancelled.
`update_trust_on_order_refunded( $order_id )`	Updates the trust score after an order is refunded.
`recalculate_trust_score( $user_id )`	Recalculates the trust score for a specific user.
`recalculate_all_trust_scores()`	Recalculates trust scores for all users.
`get_trust_level( $score )`	Returns the trust level label for a given numeric score.
`get_risk_reduction_factor( $trust_score )`	Returns the risk reduction factor based on a trust score.
`qualifies_for_trust_bypass( $user_id_or_email, $action = 'default' )`	Checks whether a user qualifies for a trust-based bypass for the given action.
`adjust_trust_score( $user_id, $adjustment, $reason = '' )`	Manually adjusts a user's trust score by the given amount with an optional reason.

CCP_Platform_Order

CCP_Platform_Order provides a normalized order representation across supported commerce platforms.

Method	Description
`load( $platform_name, $order_id )`	Loads a platform order by platform name and order ID. Static method.
`get_platform()`	Returns the platform name for this order.
`get_id()`	Returns the platform-specific order ID.
`get_status()`	Returns the current order status.
`get_total()`	Returns the order total.
`get_formatted_order_total()`	Returns the formatted order total with currency.
`get_billing_email()`	Returns the billing email address.
`get_billing_first_name()`	Returns the billing first name.
`get_billing_last_name()`	Returns the billing last name.
`get_customer_ip_address()`	Returns the customer's IP address.
`get_meta( $key )`	Returns a metadata value for the given key.
`update_meta_data( $key, $value )`	Updates a metadata value on the order.
`update_status( $status, $note = '' )`	Updates the order status with an optional note.
`add_order_note( $note = '' )`	Adds a note to the order.
`get_data()`	Returns the raw order data array.

CCP_Threat_Intel

CCP_Threat_Intel integrates external threat intelligence providers and exposes IP reputation signals.

Method	Description
`init_threat_intel()`	Initializes the threat intelligence subsystem and registers hooks.
`check_ip_reputation( $ip_address )`	Checks an IP address against configured threat intelligence providers and returns reputation data.
`update_threat_lists()`	Updates cached threat intelligence data from configured providers.
`ajax_check_ip_reputation()`	AJAX handler for on-demand IP reputation checks.

CCP_Rate_Limiter

CCP_Rate_Limiter tracks requests and enforces rate limits for a request type and identifier.

Method	Description
`check_rate_limit( $ip_address, $max_requests = 10, $time_window = 60, $action = 'general' )`	Checks whether an IP has exceeded the rate limit for a given action.
`check_user_rate_limit( $user_id, $max_requests = 20, $time_window = 60, $action = 'general' )`	Checks the rate limit for a user ID.
`check_endpoint_rate_limit( $endpoint, $max_requests = 5, $time_window = 60 )`	Checks the rate limit for a specific endpoint.
`check_global_rate_limit( $max_requests = 1000, $time_window = 60 )`	Checks the global rate limit across all actions.
`get_rate_limit_status( $ip_address, $action = 'general' )`	Returns the current rate limit status for an IP and action.
`reset_rate_limit( $ip_address, $action = 'general' )`	Resets the rate limit counter for an IP and action.
`reset_all_rate_limits( $ip_address )`	Resets all rate limit counters for an IP.
`get_rate_limit_stats( $days = 7 )`	Returns rate limit statistics for the given period.
`get_top_rate_limited_ips( $days = 7, $limit = 10 )`	Returns the most frequently rate-limited IPs.

CCP_IP_Whitelist

CCP_IP_Whitelist manages temporary and persistent IP whitelist entries.

Method	Description
`add_order_ip_to_whitelist( $order_id )`	Adds the customer IP from an order to the whitelist.
`is_ip_whitelisted( $ip_address )`	Returns whether an IP address is currently whitelisted.
`get_whitelist_details( $ip_address )`	Returns details about a whitelist entry, including source order and expiry.
`apply_whitelist_reduction( $risk_factors, $data )`	Reduces risk factors for whitelisted IPs during fraud evaluation.
`cleanup_expired_entries()`	Removes all expired whitelist entries.
`get_statistics()`	Returns whitelist statistics, including entry counts and hit rates.
`manually_whitelist_ip( $ip_address, $reason = '', $duration_days = null )`	Manually adds an IP to the whitelist with an optional reason and duration.
`remove_from_whitelist( $ip_address )`	Removes an IP address from the whitelist.

CCP_Captcha

CCP_Captcha manages CAPTCHA configuration, provider selection, response verification, and risk-based challenges.

Method	Description
`supports_current_platform()`	Returns whether CAPTCHA supports the current active platform. Static method.
`is_enforceable()`	Returns whether CAPTCHA can currently be enforced. Static method.
`add_captcha_to_checkout()`	Renders the CAPTCHA field on the checkout page.
`add_captcha_to_cart()`	Renders the CAPTCHA field on the cart page.
`validate_captcha()`	Validates the CAPTCHA response during checkout submission.
`validate_cart_captcha()`	Validates the CAPTCHA response on the cart page.
`verify_captcha_token( $token )`	Verifies a CAPTCHA token with the configured provider.
`is_verified( $context = 'checkout', $verification_id = null )`	Returns whether the CAPTCHA has been verified for the given context.
`get_captcha_stats()`	Returns CAPTCHA challenge statistics, including success and failure counts.

Usage example

Access the core singleton, check adapter health through the platform registry, assess checkout risk, and verify an IP whitelist entry from a WordPress integration.

<?php

defined( 'ABSPATH' ) || exit;

$core = CCP_Core::instance();

if ( $core->is_platform_active( 'woocommerce' ) ) {
    // Calculate the risk score for the current checkout context.
    $fraud_detection = new CCP_Fraud_Detection();
    $risk_score     = $fraud_detection->calculate_risk_score( 'checkout' );

    // Check the risk level and corresponding action.
    $risk_threshold = CCP_Risk_Threshold::instance();
    $risk_level     = $risk_threshold->get_risk_level( $risk_score );
    $risk_action    = $risk_threshold->get_risk_action( $risk_level );

    // Check whether the customer's IP is whitelisted.
    $ip_whitelist = new CCP_IP_Whitelist();

    if ( $ip_whitelist->is_ip_whitelisted( '198.51.100.42' ) ) {
        error_log(
            sprintf(
                'Whitelisted checkout: risk score %d, level %s, action %s.',
                $risk_score,
                $risk_level,
                $risk_action
            )
        );
    }
}

The platform check prevents custom logic from running before the WooCommerce adapter is registered and healthy. The fraud detector calculates the risk score for the current context, and the risk threshold instance maps the score to a risk level and action. The whitelist manager checks the current status of the customer's IP address.

Next steps

Architecture

Understand the core-plus-adapter architecture and platform registration lifecycle.

Hooks and filters

Extend supported fraud, trust, checkout, email, and permission workflows.

Settings reference

Review configuration options that affect risk scoring, CAPTCHA, rate limiting, and storage.

Was this page helpful?