WP-CLI commands

Refinery Fraud Guard includes built-in WP-CLI commands for querying the fraud log, managing the blocklist, running fraud checks on orders, and viewing settings from the command line. These commands are useful for incident response, bulk blocklist management, scripting, and integration with AI development tools like Claude Code.

Prerequisites

• WP-CLI version 2.5 or later
• WooCommerce installed and active
• A WordPress user with the manage_woocommerce capability

Log commands

All log commands are under the wp refinery fraud-guard log namespace.

List log entries

Display a filterable, paginated list of fraud check log entries.

wp refinery fraud-guard log list
wp refinery fraud-guard log list --action=flag --rule=velocity --per_page=50
wp refinery fraud-guard log list --date_from=2026-01-01 --date_to=2026-03-31 --format=json

Options:

• --search=<term> — Search by order ID or IP address
• --action=<action> — Filter by action: pass, flag, hold, cancel, or block
• --rule=<rule> — Filter by rule: geo_mismatch, min_amount, velocity, suspicious_email, or proxy_vpn
• --payment_method=<method> — Filter by payment method
• --date_from=<YYYY-MM-DD> — Start date
• --date_to=<YYYY-MM-DD> — End date
• --per_page=<number> — Results per page (default: 25)
• --page=<number> — Page number
• --format=<format> — table, json, csv, or count

View stats

Display a fraud detection dashboard with flagged counts, revenue protected, and a rule breakdown for the last 30 days.

wp refinery fraud-guard log stats
wp refinery fraud-guard log stats --format=json

Clear logs

Delete old log entries. Specify either --days or --all. A confirmation prompt appears unless --yes is passed.

wp refinery fraud-guard log clear --days=90
wp refinery fraud-guard log clear --all --yes

Clearing logs is permanent and cannot be undone.

Blocklist commands

All blocklist commands are under the wp refinery fraud-guard blocklist namespace.

List blocklist entries

Display all blocklist entries with filtering and pagination.

wp refinery fraud-guard blocklist list
wp refinery fraud-guard blocklist list --type=ip --source=auto --format=json

Options:

• --type=<type> — Filter by ip, email, or email_domain
• --search=<term> — Search block values or reasons
• --source=<source> — Filter by manual or auto
• --per_page=<number> — Results per page (default: 25)
• --format=<format> — table, json, csv, or count

Add to blocklist

Add an IP address, email, or email domain to the blocklist. IP addresses and emails are validated before being added. If an invalid format is provided, the command exits with an error.

wp refinery fraud-guard blocklist add --type=ip --value=1.2.3.4 --reason="Repeated fraud attempts"
wp refinery fraud-guard blocklist add --type=email_domain --value=tempmail.com
wp refinery fraud-guard blocklist add --type=email [email protected] --expires="2026-12-31 00:00:00"

Options:

• --type=<type> — ip, email, or email_domain (required)
• --value=<value> — The value to block (required)
• --reason=<text> — Reason for blocking
• --expires=<datetime> — Expiration in MySQL datetime format (UTC). Omit for a permanent block.

Remove from blocklist

Remove a blocklist entry by its ID. Add --yes to skip the confirmation prompt.

wp refinery fraud-guard blocklist remove 42 --yes

Check blocklist

Check whether an IP address or email is currently blocklisted. Provide at least one of --ip or --email.

wp refinery fraud-guard blocklist check --ip=1.2.3.4
wp refinery fraud-guard blocklist check [email protected]
wp refinery fraud-guard blocklist check --ip=1.2.3.4 [email protected]

Check an order

Run all fraud detection rules against an existing WooCommerce order. The result (pass or flagged) is displayed along with the log entry. This re-runs the full check and updates the order metadata.

wp refinery fraud-guard check-order 1234

Settings

Display current Fraud Guard settings.

wp refinery fraud-guard settings
wp refinery fraud-guard settings --format=json