Introduction
Overview of Checkout Security — a multi-platform WordPress fraud protection plugin stack with a core-plus-adapter architecture.
Checkout Security
Checkout Security protects WordPress checkout flows from fraud, bots, and automated abuse using multi-factor risk scoring. The plugin stack supports multiple e-commerce platforms through a shared security core and platform-specific connector plugins.
How it works
Checkout Security separates shared security logic from platform integration. The platform-agnostic core plugin, checkout-security, provides the fraud engine, security logic, administration screens, storage, privacy features, and logging.
Connector plugins connect the core to a specific e-commerce platform:
checkout-security-woocommerce-adapterfor WooCommercecheckout-security-eddfor Easy Digital Downloadscheckout-security-fluentcart-adapterfor FluentCart
Install the core plugin and the adapter or adapters for the platforms you use. The core can be installed without an adapter, but a connector is required before Checkout Security can integrate with a specific platform's cart, checkout, order, and session flows.
The checkout-security core plugin is required. Adapters are optional at installation time, but you must install the matching adapter for each e-commerce platform you want to protect.
Supported platforms
WooCommerce
WooCommerce 5.0 or later, including classic checkout and supported Checkout Block and Store API flows.
Easy Digital Downloads
Easy Digital Downloads 2.9 or later with normalized cart, checkout, order, and session integration.
FluentCart
FluentCart 1.8.0 or later with platform-specific checkout and order protection.
Key features
Fraud detection
- Multi-factor fraud detection with configurable risk scoring and graduated responses.
- Bot and automated-request blocking.
- Referrer and request validation.
- Email and disposable-email validation.
- Geographic and country-risk checks.
- VPN, proxy, and Tor detection.
- Behavioral analysis, including suspicious checkout timing and request patterns.
Access control
- Rate limiting for checkout, API, login, and administration requests.
- CAPTCHA challenges for suspicious requests.
- Support for Google reCAPTCHA v2, Google reCAPTCHA v3, hCaptcha, and Cloudflare Turnstile.
Trust and reputation
- Customer trust scores from 0 to 100 based on order history and behavior.
- IP whitelisting, temporary whitelisting, and automatic whitelisting after approved orders.
- Device fingerprinting and remembered-device trust.
- A Risk Queue for manual review, approval, and rejection of suspicious orders.
- Optional machine-learning-assisted fraud scoring and training workflows.
Compliance and operations
- Integration with WordPress privacy and GDPR exporter and eraser workflows.
- Data anonymization for personal information and security records.
- Authenticated encryption for sensitive data at rest.
- Dashboard, monitoring, reporting, and analytics tools.