Establish checkout flow
A short-lived, signed, cache-safe token shows the client came through the expected checkout flow.
Architecture · Safe overview
Protection before payment, whenever technically possible.
Cheap local checks run first. Uncertain traffic gets a recoverable challenge. Clear abuse is blocked before the gateway whenever the available signals allow it.
Evaluate local signals
Velocity is evaluated across IP, email, session, combinations, trust context, and recent failure history.
Challenge uncertainty
The local check, Turnstile, or reCAPTCHA can recover suspicious requests without a hard block.
Make the decision
The request is allowed, challenged, or temporarily blocked with a stable reason code.
Learn from payment feedback
Actual gateway declines increase suspicion; form errors and broad outages are handled differently.
Explain and recover
Aggregated logs show what happened, masked identifiers protect privacy, and admins can unblock mistakes.
Version 1.0.0 · Available on WordPress.org
Put a control between checkout abuse and your payment gateway.
Install the complete Free edition from the official WordPress.org Plugin Directory. New installations begin safely in Observe Mode.