Settings Reference
Complete reference of all Checkout Security configuration options with option names, defaults, and descriptions.
Configuration options
This page lists every configuration option stored by Checkout Security, grouped by category. Options are stored in the WordPress wp_options table and can be accessed with get_option().
The option names documented here are the authoritative names used by the runtime. Some settings reference descriptive controls in the admin UI that may not map directly to a single stored option. Those cases are noted where applicable.
General
| Option | Default | Description |
|---|---|---|
ccp_enable_protection | enabled | Master protection switch. When enabled, fraud detection and security checks run on checkout. |
ccp_admin_email | WordPress admin email | Email address for security alerts and daily digests. |
ccp_email_notifications | yes | Enables email notifications for security events. |
ccp_explanation_page_id | 0 | Page ID for the referrer-explanation redirect page. Set to 0 to disable. |
ccp_whitelist | empty array | Manual IP and email whitelist entries. |
ccp_ip_whitelist | empty array | Manual IP whitelist entries. |
ccp_setup_complete | no | Whether the setup wizard has been completed. |
ccp_enabled_platforms | woocommerce, edd, fluentcart | Enabled platform slugs. A missing option defaults to all supported platforms for backward compatibility. |
ccp_legacy_wc_mode | not set | WooCommerce migration and legacy-mode flag. The WooCommerce adapter manages this option automatically. |
Request validation
| Option | Default | Description |
|---|---|---|
ccp_invalid_referrer_action | redirect | Action for invalid referrers. Values: block, redirect, log-only. |
ccp_trusted_domains | empty array | Allowed referrer domains. Include payment gateway and CDN domains. |
Threat intelligence
| Option | Default | Description |
|---|---|---|
ccp_enable_threat_intel | no | Enables the external threat intelligence runtime. The core checks for the value yes. |
ccp_threat_intel_confidence_threshold | 70 | Minimum threat-confidence score required to act on a result. Results below this threshold are logged but do not affect the risk score. |
Behavioral analysis
| Option | Default | Description |
|---|---|---|
ccp_enable_behavioral_analysis | yes | Enables behavioral signal evaluation. |
ccp_enable_js_detection | no | Enables JavaScript-disabled detection. |
ccp_enable_resolution_detection | yes | Enables screen-resolution analysis. |
ccp_enable_business_hours_detection | yes | Enables unusual-time detection based on business hours. |
ccp_behavioral_action | block | Action when behavioral risk threshold is exceeded. Values: block, on_hold, log_only. |
ccp_behavioral_risk_threshold | 70 | Risk score threshold for behavioral analysis enforcement. |
Fraud and risk
| Option | Default | Description |
|---|---|---|
ccp_enable_fraud_detection | yes | Master toggle for fraud detection initialization. |
ccp_risk_thresholds | 0/25/50/70/90 | Progressive risk threshold array. The thresholds map to Allow, Additional Checks, CAPTCHA, Hold, and Block. |
ccp_progressive_mode | enabled | Enables graduated response actions based on the risk score. |
ccp_fraud_threshold | 70 | Risk score threshold at which the fraud action is triggered. |
ccp_fraud_action | on_hold | Action to take when the fraud threshold is reached. Values: on_hold, block, log_only. |
Machine learning
| Option | Default | Description |
|---|---|---|
ccp_ml_enabled | false | Enables machine-learning-assisted fraud scoring. The runtime defaults this option to false. The runtime behavior is authoritative if the settings guide describes a different default. |
ccp_ml_weight | 0.3 | Weight of the machine learning score in the overall risk calculation. |
ccp_ml_training_mode | initializing | ML training mode. When set to training, the ML engine collects learning data without enforcing decisions. Other values: initializing, ready. |
ccp_ml_fraud_action | on_hold | Action for ML-flagged orders. Values: on_hold, block, log_only. |
CAPTCHA
| Option | Default | Description |
|---|---|---|
ccp_captcha_enabled | no | Enables CAPTCHA challenges. CAPTCHA must be explicitly enabled. |
ccp_captcha_provider | turnstile | CAPTCHA provider. Values: recaptcha_v2, recaptcha_v3, hcaptcha, turnstile. |
ccp_captcha_risk_threshold | 60 | Risk score at which CAPTCHA is triggered. |
ccp_captcha_exempt_roles | array('administrator') | User roles exempt from CAPTCHA challenges. |
Whitelist
| Option | Default | Description |
|---|---|---|
ccp_order_whitelist_duration | 2592000 (30 days) | Auto-whitelist duration in seconds after approved orders. |
Logging
| Option | Default | Description |
|---|---|---|
ccp_log_retention_days | 30 | Number of days to retain logs before automatic cleanup. |
Order review notifications
| Option | Default | Description |
|---|---|---|
ccp_notify_admin_on_hold | yes | Sends an email notification when an order is held for review. |
ccp_on_hold_notification_email | WordPress admin email | Email address for order-held-for-review notifications. |
ccp_daily_digest_enabled | no | Enables a daily digest email summarizing security activity. |
ccp_daily_digest_email | WordPress admin email | Email address for the daily security digest. |
Privacy and retention
| Option | Default | Description |
|---|---|---|
ccp_retention_security_logs | 90 days | Retention period for security log entries. |
ccp_retention_device_fingerprints | 180 days | Retention period for device fingerprint records. |
ccp_retention_trust_scores | 365 days | Retention period for trust score history. |
ccp_retention_whitelist_entries | 30 days | Retention period for whitelist entries. |
ccp_retention_ml_training_data | 180 days | Retention period for ML training data. Reserved: listed in the uninstall cleanup inventory but not actively read by the current runtime. |
ccp_retention_threat_intel_cache | 7 days | Retention period for cached threat intelligence results. Reserved: listed in the uninstall cleanup inventory but not actively read by the current runtime. |
ccp_gdpr_anonymize_after_days | 365 | Number of days before personal data is automatically anonymized. |
ccp_gdpr_anonymize_method | partial | Anonymization method. Values: partial (keyed pseudonymization), full (complete removal), hash (one-way hashing). |
ccp_gdpr_require_consent | yes | Whether consent is required before collecting device fingerprints. |
ccp_gdpr_consent_text | configurable | Consent text displayed to customers. |
ccp_gdpr_allow_log_deletion | yes | Allows customers to request deletion of their security logs. |
ccp_gdpr_allow_device_deletion | yes | Allows customers to request deletion of their device fingerprint data. |
ccp_gdpr_allow_trust_deletion | no | Allows customers to request deletion of their trust score data. |
Performance
| Option | Default | Description |
|---|---|---|
ccp_cache_enabled | enabled | Enables internal caching through the WordPress object cache, with a transient fallback. |
ccp_enable_rate_limiting | yes | Enables rate limiting across checkout, API, login, and administration endpoints. |
ccp_rate_limit_requests | 10 | Maximum requests allowed per time window before rate limiting kicks in. |
ccp_rate_limit_window | 60 | Rate limit time window in seconds. |
ccp_store_api_rate_limit | 20 | Maximum Store API requests allowed per time window. |
Encryption
| Option | Default | Description |
|---|---|---|
CCP_ENCRYPTION_KEY | not set | Optional wp-config.php constant for a custom encryption key. If undefined, the key is derived from the WordPress authentication salt. |
Define the CCP_ENCRYPTION_KEY constant in wp-config.php, not in the database. Define it before activating the plugin to keep encryption consistent across environments.
Next steps
Was this page helpful?