Getting Started

Refinery Fraud Guard adds lightweight anti-fraud protection to WooCommerce. It checks every order at checkout against configurable rules — IP geolocation, minimum order amounts, velocity rate limiting, disposable email blocking, and VPN/proxy detection — and takes automatic action on suspicious orders.

Prerequisites

• WordPress 5.8 or higher
• WooCommerce 5.0 or higher
• PHP 7.4 or higher
• An active Refinery Fraud Guard license key

Installing the plugin

1. Download the plugin ZIP file from the Refinery account dashboard.
2. In the WordPress Admin (WP Admin), navigate to Plugins → Add New → Upload Plugin.
3. Select the ZIP file and click Install Now.
4. Click Activate to enable the plugin.

On activation, the plugin creates its database tables and enables all default fraud rules. Orders are checked immediately — no additional configuration is required to start protecting the store.

Navigating Fraud Guard

Access Fraud Guard by navigating to WooCommerce → Fraud Guard in WP Admin. The interface includes five tabs:

• Dashboard — Real-time fraud metrics, rule breakdown, and recent flagged orders
• Settings — Configure fraud detection rules, whitelists, and blocklist behavior
• Log — Searchable, filterable history of all fraud checks
• Blocklist — Manage blocked IPs, emails, and email domains
• License — Activate and manage the license key

Default configuration

Fraud Guard ships with sensible defaults. Out of the box, these rules are enabled:

• IP Geolocation Check — Flags orders where the IP country does not match the billing country
• Minimum Order Amount — Flags orders below $15 (a common card testing signal)
• Velocity Check — Flags more than 3 orders from the same IP within 60 minutes
• Suspicious Email Check — Flags orders from disposable email providers

The default action for all rules is Hold for Review, which sets the order status to on-hold so it can be reviewed before fulfillment. The VPN/Proxy check is disabled by default because it requires an external API.

How fraud checks work

When a customer places an order, Fraud Guard runs all enabled rules against the order data. If any rule triggers:

1. The triggered rules are recorded in the fraud log.
2. An order note is added listing which rules triggered.
3. The configured action is taken (Flag, Hold, or Cancel).
4. If multiple rules trigger, the most severe action wins — Cancel overrides Hold, which overrides Flag.
5. An email notification is sent to the store admin.

Whitelisted IPs and emails bypass all checks entirely. Blocklisted entries are rejected before payment is processed — the card is never charged.

Compatibility

Refinery Fraud Guard is compatible with:

• High-Performance Order Storage (HPOS) — Works with both the legacy post-based storage and WooCommerce custom order tables.
• Block Checkout — Fully supports the WooCommerce Block Checkout (default in WooCommerce 8.3+) as well as the classic checkout.
• All payment gateways — Works with Stripe, PayPal, and any other WooCommerce payment gateway. Rules can be configured to apply only to specific payment methods.

Activating the license

1. Navigate to WooCommerce → Fraud Guard → License.
2. Enter the license key from the Refinery account dashboard.
3. Click Activate.

An active license enables automatic plugin updates and access to support. Without an active license, the plugin continues to function but does not receive updates.