Setup Wizard
Walk through the Checkout Security setup wizard for initial configuration after installation.
Set up Checkout Security
The setup wizard guides you through the initial protection configuration and is recommended for first-time users. It covers the most important settings in a guided sequence.
Starting the Wizard
Open the Checkout Security admin menu in WordPress. Select Run Setup Wizard, or select the setup prompt shown on the dashboard after first activation.
Wizard Steps
Welcome and overview
The wizard introduces the configuration sequence and identifies the settings it will configure:
- Global protection
- Security alert email
- Trusted domains
- Risk thresholds
- CAPTCHA
- Threat intelligence
Protection toggle
Enable or disable global protection. Protection is enabled by default.
Controls whether Checkout Security enforces its protection rules across supported platforms.
Admin email
Enter the address that should receive security alerts and daily digests. The field defaults to the WordPress administrator email address.
Email address for Checkout Security alerts and daily digest messages.
Trusted domains
Enter your site's domain or domains. Trusted domains help prevent referrer-spoofing checks from blocking legitimate traffic.
Add payment gateway domains and CDN domains when your checkout flow or site assets use them.
Domains accepted as trusted referrers during request validation.
Risk thresholds
Review the default graduated responses. Checkout Security uses the risk score to determine how it responds to a request or order.
| Risk score | Response |
|---|---|
| 0 | Allow |
| 25 | Additional checks |
| 50 | CAPTCHA |
| 70 | Hold for review |
| 90 | Block |
Adjust the thresholds if your store needs a different balance between protection and checkout friction.
Risk scores and the actions assigned to each level.
CAPTCHA provider
Choose a CAPTCHA provider and enter its site key and secret key. Supported providers are:
- Google reCAPTCHA v2
- Google reCAPTCHA v3
- hCaptcha
- Cloudflare Turnstile
CAPTCHA is disabled by default. Enable it explicitly if you want suspicious requests to receive a CAPTCHA challenge.
Enables CAPTCHA challenges. The default value is no.
The CAPTCHA provider used for supported WooCommerce CAPTCHA flows.
Threat intelligence
Choose whether to use external threat intelligence during risk evaluation. Threat intelligence is disabled by default and requires at least one configured provider with a valid API key before it can be enabled.
Set the minimum confidence score that a threat provider must return before Checkout Security treats the result as significant.
Enables external threat intelligence. The default is no (disabled). Set to yes after configuring at least one provider.
Minimum threat-confidence score. The default is 70.
Review and finish
Review the settings shown in the summary. Choose whether to enable protection immediately or leave the site in test mode while you verify the configuration.
After finishing, confirm that the selected email address, trusted domains, risk thresholds, CAPTCHA settings, and threat-intelligence settings match your store's checkout flow.
After the Wizard
You can update the wizard's settings later from the Checkout Security admin menu:
- General: Protection, administrator email, logging, and general behavior.
- Request Validation: Trusted domains and invalid-referrer handling.
- Fraud and Risk: Risk thresholds, progressive responses, and fraud-detection behavior.
- CAPTCHA: Provider, keys, challenge threshold, and exemptions.
- Threat Intelligence: Threat intelligence, confidence threshold, providers, and provider keys.
You can re-run the setup wizard at any time from Settings → General.