Threat Intelligence
External threat intelligence with IP reputation, VPN/proxy/Tor detection, provider manager, and circuit breaker.
Threat intelligence
Checkout Security can query external threat intelligence providers for IP reputation data, including VPN, proxy, and Tor exit-node detection. This data augments the risk score during fraud detection.
IP reputation
When threat intelligence is enabled, Checkout Security checks IP addresses against configured threat intelligence feeds. The results contribute to the risk score and add weight for known malicious or suspicious IP addresses.
VPN, proxy, and Tor detection
Checkout Security identifies traffic from known VPN providers, proxy servers, and Tor exit nodes. Traffic from anonymizing networks may receive a higher risk score as one factor in the fraud risk assessment.
Provider manager
Checkout Security supports multiple threat intelligence providers. The provider manager lets you choose which providers are active and configure an API key for each provider.
Configure providers from Settings → Threat Intel. Provider availability and response quality can vary, so configure the providers that match your account and operational requirements.
Circuit breaker
The threat intelligence provider manager uses a circuit breaker to prevent an unavailable provider from delaying checkout requests. If a provider becomes unresponsive or returns errors repeatedly, the circuit breaker trips and temporarily stops requests to that provider.
Checkout Security falls back to local heuristics while the circuit is open. The fallback prevents repeated API timeouts from blocking all requests. After a cooldown period, the circuit resets automatically and allows the provider to recover without manual intervention.
If external APIs are slow or unavailable, the circuit breaker ensures your checkout is not delayed. Requests proceed using local heuristics until the provider recovers.
Confidence threshold
The confidence threshold controls which threat intelligence results affect the risk score. Results below the threshold are logged but do not influence the fraud risk assessment.
Minimum confidence score required for a threat intelligence result to affect the risk score. The default is 70.
Configuration
Enable threat intelligence with the following option:
Enables the threat intelligence runtime when set to yes. The default is no (disabled). Threat intelligence is off until you explicitly enable it and configure at least one provider.
Threat intelligence lists are updated by the ccp_update_threat_lists scheduled event. WordPress runs the event according to its scheduled-task system, allowing provider data to refresh without requiring a checkout request to wait for an update.