Hooks & Filters
All public actions, filters, and scheduled events for extending Checkout Security.
Extending Checkout Security
Checkout Security exposes WordPress actions and filters for customizing fraud detection, trust management, email, permissions, and scheduled behavior.
Use only the hooks documented on this page. Hooks not listed here are not fired by the current PHP codebase and should not be relied upon.
The plugin also uses the WooCommerce core filter woocommerce_checkout_no_payment_needed_redirect in CCP_Risk_Threshold to redirect customers after a held order is approved. This is a WooCommerce filter, not a Checkout Security hook.
Actions
| Hook | Parameters | Description |
|---|---|---|
ccp_before_fraud_check | (none) | Fires before a fraud check starts |
ccp_after_fraud_check | (none) | Fires after a fraud check completes |
ccp_cart_cleared_high_risk | array $risk_assessment | Fires when a high-risk checkout cart is cleared |
ccp_order_manually_approved | int $order_id, WC_Order|CCP_Platform_Order $order, string $source | Fires when an order is approved from the Risk Queue |
ccp_order_manually_rejected | int $order_id, WC_Order|CCP_Platform_Order $order, string $source | Fires when an order is rejected from the Risk Queue |
ccp_trust_score_updated | int $user_id, int $new_score, array $factors | Fires when a customer trust score changes |
Filters
| Hook | Parameters | Description |
|---|---|---|
ccp_bypass_fraud_check | bool $bypass, string $context | Return true to skip the fraud check entirely. The context value passed is fraud_detection. |
ccp_fraud_risk_assessment | array $risk_assessment, string $context | Modify the risk assessment result before threshold enforcement |
ccp_is_email_verified | null|bool $verified, int $user_id | Override email verification status; leave null to use the built-in check |
ccp_is_phone_verified | null|bool $verified, int $user_id | Override phone verification status; leave null to use the built-in check |
ccp_security_admin_capability | string $capability | Change the capability required for security admin actions. Defaults to manage_options. |
Scheduled Events
ccp_cleanup_logs(daily): Removes logs older than the retention period.ccp_cleanup_sessions(daily): Cleans up expired sessions.ccp_cleanup_expired_whitelists(hourly): Removes expired IP whitelist entries.ccp_recalculate_trust_scores(daily): Recalculates customer trust scores.ccp_update_threat_lists(hourly): Updates threat intelligence lists from providers.ccp_send_daily_digest(daily): Sends the daily security digest email.ccp_gdpr_anonymization(daily): Runs automated data anonymization.ccp_gdpr_data_retention(daily): Enforces data retention policies.ccp_data_cleanup(daily): Runs general data cleanup.ccp_database_optimization(weekly): Runs database optimization tasks.
Usage examples
Use the following examples as starting points for integrating Checkout Security with site-specific workflows.
<?php
add_action(
'ccp_order_manually_approved',
function ( $order_id, $order, $source ) {
$recipient = 'security-team@acme.test';
$subject = sprintf( 'Order %d approved', $order_id );
$message = sprintf(
'Order %d was approved from the Risk Queue by the %s workflow.',
$order_id,
$source
);
wp_mail( $recipient, $subject, $message );
},
10,
3
);
<?php
add_filter(
'ccp_bypass_fraud_check',
function ( $bypass, $context ) {
$user = wp_get_current_user();
if ( ! $user || ! $user->exists() ) {
return $bypass;
}
$allowed_roles = array( 'shop_manager', 'administrator' );
if ( array_intersect( $allowed_roles, (array) $user->roles ) ) {
return true;
}
return $bypass;
},
10,
2
);
<?php
add_filter(
'ccp_fraud_risk_assessment',
function ( $risk_assessment, $context ) {
if ( ! isset( $risk_assessment['factors'] ) || ! is_array( $risk_assessment['factors'] ) ) {
$risk_assessment['factors'] = array();
}
$risk_assessment['factors']['custom_customer_segment'] = 10;
return $risk_assessment;
},
10,
2
);
Next steps
Was this page helpful?