Settings

The Settings tab is where all fraud detection rules are configured. Each rule can be independently enabled, configured with its own action severity, and limited to specific payment methods.

General

The Enable Fraud Guard checkbox is the master switch. When disabled, all fraud rule checking is bypassed. The blocklist continues to block known bad actors even when the master switch is off.

IP Geolocation Check

Flags orders where the IP address country does not match the billing address country. This catches orders placed from a different country than the billing address — a common fraud signal.

• Enable — Turn this rule on or off
• Match Level — Choose between “Country only” (compares countries) or “Country + State/Region” (also compares state or province for stricter matching)
• Action — What happens when the rule triggers: Flag Only (adds order note), Hold for Review (sets order to on-hold), or Auto-Cancel (cancels the order)
• Payment Methods — Limit this rule to specific payment methods, or apply to all

IP geolocation uses Cloudflare headers when available, falling back to the WooCommerce built-in geolocation service. Results are cached for 24 hours per IP address.

Minimum Order Amount

Flags orders below a configured dollar amount. Card testers often place very small orders to verify stolen card numbers before making large purchases.

• Enable — Turn this rule on or off
• Minimum Amount — The threshold in the store currency (default: $15)
• Action — Flag Only, Hold for Review, or Auto-Cancel
• Payment Methods — Limit to specific payment methods, or apply to all

Velocity Check

Limits how many orders can come from a single IP address within a time window. Rapid-fire orders from the same IP are a strong indicator of automated card testing.

• Enable — Turn this rule on or off
• Max Orders — Maximum number of orders allowed from one IP (default: 3)
• Time Window — The period in minutes to count orders (default: 60)
• Action — Flag Only, Hold for Review, or Auto-Cancel
• Payment Methods — Limit to specific payment methods, or apply to all

Suspicious Email Check

Flags orders from disposable email addresses and custom-blocked domains. Fraudsters frequently use throwaway email services to avoid being traced.

• Enable — Turn this rule on or off
• Block Disposable Emails — Check against a built-in list of 150+ known disposable email providers (Mailinator, Guerrillamail, Yopmail, and others)
• Custom Blocked Domains — Add custom domains to block, one per line (e.g., fakeinbox.com)
• Action — Flag Only, Hold for Review, or Auto-Cancel
• Payment Methods — Limit to specific payment methods, or apply to all

VPN/Proxy Check

Detects orders placed from VPN, proxy, or datacenter IP addresses using the proxycheck.io service. This rule is disabled by default because it requires external API calls.

• Enable — Turn this rule on or off (default: off)
• proxycheck.io API Key — Optional. The free tier allows 1,000 lookups per day, which is sufficient for most stores. Add an API key from proxycheck.io for higher limits
• Action — Flag Only, Hold for Review, or Auto-Cancel
• Payment Methods — Limit to specific payment methods, or apply to all

Proxy check results are cached for 24 hours per IP address to minimize API usage.

Whitelists

Whitelisted IPs and emails bypass all fraud checks and blocklist lookups. Use whitelists for trusted customers, team members, and test accounts.

• Whitelisted IPs — Enter IP addresses, one per line
• Whitelisted Emails — Enter full email addresses ([email protected]) or domains (example.com) to whitelist all addresses at that domain. One entry per line

Whitelists always take priority over the blocklist.

Blocklist settings

Configure how the blocklist behaves. See the Blocklist documentation for managing individual blocklist entries.

• Enable Blocklist — Turn the pre-checkout blocklist on or off
• Block Message — The error message shown to blocked customers at checkout. Keep this message vague to avoid revealing fraud detection details
• Auto-Block — Automatically add flagged IPs and emails to the blocklist
• Auto-Block Target — What to block: IP + Email, IP only, or Email only
• Auto-Block Threshold — When to auto-block: any flagged order, hold or higher, or cancel only

Logging

• Log Passed Orders — Also log orders that pass all checks. Off by default. Enable this for a complete audit trail, but note that it uses more database space

Action severity

When multiple rules trigger on a single order, Fraud Guard takes the most severe action:

1. Flag Only (lowest) — Adds an order note but does not change the order status
2. Hold for Review — Sets the order status to on-hold
3. Auto-Cancel (highest) — Immediately cancels the order

For example, if the geolocation check is set to Flag and the velocity check is set to Cancel, an order that triggers both rules will be cancelled.