=== Fraud and Scam Detection For WooCommerce ===
Contributors: linknacional
Donate link: https://www.linknacional.com.br/wordpress/
Tags: woocommerce, antifraud, recaptcha, security, cloudflare
Requires at least: 5.8
Tested up to: 7.1
Stable tag: 1.3.8
Requires PHP: 8.2
Requires Plugins: woocommerce
License: GPL-2.0+
License URI: http://www.gnu.org/licenses/gpl-2.0.txt

Add Google reCAPTCHA or Cloudflare Turnstile verification to WooCommerce checkout to prevent fraudulent transactions.

== Description ==

The **Fraud and Scam Detection For WooCommerce** plugin helps protect your online store by adding a verification layer to the [WooCommerce](https://www.linknacional.com.br/wordpress/woocommerce/) checkout.  
Using **Google reCAPTCHA** or **Cloudflare Turnstile**, the plugin automatically analyzes user interactions and blocks suspicious checkout attempts, reducing fraudulent transactions and ensuring safer payments.

**Main Features:**
- Integration with **Google reCAPTCHA v3** (site key, secret key, configurable minimum score);
- Integration with **Cloudflare Turnstile** (site key, secret key, selectable widget theme: auto, light or dark);
- Protects [WooCommerce](https://www.linknacional.com.br/wordpress/woocommerce/) checkout against automated bots and fraudulent activity;
- **Configurable antifraud behavior** — choose whether to block the order, mark it as fraud, add an internal note, or any combination of these actions;
- Marks suspicious orders with a dedicated **custom fraud order status** for manual review;
- Adds **internal order notes** with the validation result and, when a block occurs, the detailed reason (the provider error code, e.g. an expired or already-used token, or an invalid key);
- **Support tab with diagnostics** — enable full **debug logging** of every block (by IP, by data, by Cloudflare or by Google) to the [WooCommerce](https://www.linknacional.com.br/wordpress/woocommerce/) log and to the order itself, view the stored log inside the order, and clear it in one click;
- **One-click support** — send your plugin settings to the support team via WhatsApp, with secret keys masked;
- **Advanced IP banning** — ban IPs for a defined duration (hours, days, weeks, months, years) or permanently, with automatic expiration for temporary bans;
- Banned IPs management panel and IP lookup / order filtering by IP directly from the order detail page;
- **Data-based blocking** — block orders by email address, email domain, phone number, country, or device fingerprint;
- Compatible with both the **classic** and the **block-based (Store API)** checkout;
- Lightweight and optimized for performance.

**Dependencies**

This plugin requires [WooCommerce](https://www.linknacional.com.br/wordpress/woocommerce/) to be installed and active.  
For Google reCAPTCHA, you also need valid [Google reCAPTCHA API keys](https://www.google.com/recaptcha/admin/create).  
For Cloudflare Turnstile, you need valid [Cloudflare Turnstile site and secret keys](https://dash.cloudflare.com/?to=/:account/turnstile).

**User instructions**

1. Go to [WordPress](https://www.linknacional.com.br/wordpress/) admin panel > [WooCommerce](https://www.linknacional.com.br/wordpress/woocommerce/) > Settings > Anti-Fraud;

2. Enable the antifraud option and choose between **Google reCAPTCHA** or **Cloudflare Turnstile**;

3. Enter the corresponding **Site Key** and **Secret Key** for the chosen service;

4. For reCAPTCHA: set the **minimum score threshold** (higher values = stricter validation);

5. Optionally enable **IP check** to ban specific IP addresses from checkout;

6. Optionally enable **data-based blocking** (email, email domain, phone, country, device) and manage the lists in the **Block by Data** tab;

7. Optionally open the **Support** tab to enable **debug logging** (records the full context of every block in the [WooCommerce](https://www.linknacional.com.br/wordpress/woocommerce/) log and on the order), show the order log inside the order, clear stored logs, and send your settings to the support team;

8. Save the settings. From now on, the [WooCommerce](https://www.linknacional.com.br/wordpress/woocommerce/) checkout will require security validation.

== External services ==

This plugin integrates with Google reCAPTCHA v3 and Cloudflare Turnstile to provide fraud and bot protection for [WooCommerce](https://www.linknacional.com.br/wordpress/woocommerce/) checkout processes.

**Google reCAPTCHA v3**

What the service is and what it is used for:  
Google reCAPTCHA v3 is a security service that analyzes user behavior to determine if a user is likely human or bot. It's used to protect the [WooCommerce](https://www.linknacional.com.br/wordpress/woocommerce/) checkout process from automated fraud attempts and malicious activities.

What data is sent and when:  
When a customer attempts to complete a checkout, the plugin sends the following data to Google reCAPTCHA servers:
- User's IP address
- Browser and device information
- User interaction patterns during checkout
- reCAPTCHA response token

- Google reCAPTCHA Terms of Service: https://developers.google.com/recaptcha/docs/terms
- Google Privacy Policy: https://policies.google.com/privacy

**Cloudflare Turnstile**

What the service is and what it is used for:  
Cloudflare Turnstile is a privacy-friendly CAPTCHA alternative that verifies users without tracking or invasive data collection. It's used to protect the [WooCommerce](https://www.linknacional.com.br/wordpress/woocommerce/) checkout from bots and fraudulent activity.

What data is sent and when:  
When a customer attempts to complete a checkout, the plugin sends the Turnstile response token to Cloudflare servers for validation:
- Turnstile response token
- User's IP address (handled by Cloudflare)

- Cloudflare Turnstile Terms of Service: https://www.cloudflare.com/terms/
- Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/

== Installation ==

1. Look in the sidebar for the [WordPress](https://www.linknacional.com.br/wordpress/) plugins area;

2. In installed plugins look for the option 'add new';

3. Click on the 'send plugin' option in the page title and upload the fraud-scam-detection-woocommerce.zip plugin;

4. Click on the 'install now' button and then activate the installed plugin;

5. Now go to [WooCommerce](https://www.linknacional.com.br/wordpress/woocommerce/) settings > Anti-Fraud;

6. Enter your Google reCAPTCHA credentials, configure the minimum score, and save.

== Frequently Asked Questions ==

= What is the plugin license? =

* This plugin is released under a GPL license.

= What is needed to use this plugin? =

* [WooCommerce](https://www.linknacional.com.br/wordpress/woocommerce/) installed and active;
* Google reCAPTCHA API keys (if using reCAPTCHA);
* Cloudflare Turnstile site and secret keys (if using Turnstile).

= How does the minimum score work? =

* Google reCAPTCHA v3 assigns a score between 0.0 (likely a bot) and 1.0 (likely human).  
  You can configure the threshold in plugin settings to determine how strict the validation should be.

= How does the antifraud behavior work? =

* When fraud is detected, the plugin can perform one or more of the following actions — independently or combined:
  - **Block Order**: prevents the order from being placed and returns an error to the customer;
  - **Mark Order as Fraud**: changes the order status to the custom fraud status for manual review, without necessarily blocking the transaction;
  - **Add Note to Order Only**: adds an internal note with detection details without blocking or changing the order status.

  This lets store owners choose between a conservative approach (observe and log) or a strict one (block immediately).

= How does the IP banning system work? =

* When the **Ban IPs** option is active, a ban/unban panel appears on each order detail page.  
  You can also manage the full list of banned IPs in **[WooCommerce](https://www.linknacional.com.br/wordpress/woocommerce/) > Settings > Anti-Fraud > Banned IPs**.  
  The improved ban system supports **temporary bans** with a configurable duration (hours, days, weeks, months, or years) that expire automatically, as well as **permanent bans** by selecting the “Forever” unit.  
  Any customer attempting to checkout from a banned IP within the active ban period will be blocked and the configured antifraud behavior will be applied.


== Changelog ==
= 1.3.8 =
* Fixed: orders were rejected with "Security verification failed. Please try again." when the customer created an account during checkout (guest checkout disabled). WooCommerce logs the customer in mid-request, which invalidated the form nonce; the nonce is now accepted for both guest and freshly logged-in customers.

= 1.3.7 =
* Orders blocked by the captcha (Google reCAPTCHA or Cloudflare Turnstile) now get an order note explaining the failure reason, with the error code translated (e.g. expired/already-used token, missing or invalid key).
* The captcha success note now makes it explicit that the verification was completed (e.g. "Google reCAPTCHA verification passed. Customer's ANTIFRAUD score: ...").
* Fixed: a successful Google reCAPTCHA response without a score was incorrectly treated as fraud.
* New "Support" settings tab with the debug options, "View Order Log" (shows the order log) and clear logs.
* New "Send settings to support" button in the Support tab: opens WhatsApp with the plugin settings (secret keys masked) to speed up support.
* The debug log now records the full context of every block (by IP, by data, Cloudflare or Google) in the [WooCommerce](https://www.linknacional.com.br/wordpress/woocommerce/) log and on the order itself.

= 1.3.6 =
* Captcha (Google reCAPTCHA or Cloudflare Turnstile) is now rendered on the order-received (receipt) page, right above the order notes.

= 1.3.5 =
* New "Captcha" tab: picking a provider (Google reCAPTCHA or Cloudflare Turnstile) enables verification and reveals the credentials in cascade, without leaving the screen.
* Settings page reorganized into 4 tabs: Captcha, Data Blocking, Banned IPs, and Blocked Data.
* Updated admin menu with Captcha and Data Blocking shortcuts.
* Source strings standardized to English for [WordPress.org](https://www.linknacional.com.br/wordpress/) translation.

= 1.3.4 =
* Security: the antifraud settings save is restricted to the plugin's own options, preventing lower-privileged roles from overwriting arbitrary [WordPress](https://www.linknacional.com.br/wordpress/) options.
* Security: enabling security verification now requires the provider credentials to be filled in — a settings-page warning links straight to the provider configuration — and checkout is blocked (instead of skipping verification) when a misconfigured provider has none.
* New "AntiFraud" admin menu with shortcuts to the settings, banned IPs, and data-based blocking tabs.

= 1.3.3 =
* IP verification and data-based (email/phone) banning no longer require the security verification to be enabled.
* Fixed the settings page scroll jump when toggling the security verification option.
* Removed an unused admin settings script.

= 1.3.2 =
* Fix checkout breaking when CAPTCHA is enabled without credentials: shows a neutral notice and skips verification instead of blocking the order.
* UX improvements on the settings page: missing-credential warnings on the provider fields and tabs, with a link to fill them in.

= 1.3.1 =
* New option to ban by phone number via order notes.

= 1.3.0 =
* New data-based blocking system.

= 1.2.1 =
* Fix default state of checkboxes on the settings page.

= 1.2.0 =
* New security verification system with Cloudflare Turnstile.
* New IP banning system.

= 1.1.9/1.1.10 =
* New banners according to country.

= 1.1.8 =
* New layout for the plugin images.

= 1.1.7 =
* Fix the plugin URL.

= 1.1.6 =
* Change actions.

= 1.1.5 =
* Fix [Wordpress](https://www.linknacional.com.br/wordpress/) issues.

= 1.1.4 =
* Fix [Wordpress](https://www.linknacional.com.br/wordpress/) issues.

= 1.1.3 =
* Remove plugin updater.

= 1.1.2 =
* Change plugin title.

= 1.1.1 =
* Fix GitHub actions.

= 1.1.0 =
* Add compatibility with shortcode form.

= 1.0.0 =
* Plugin launch with Google reCAPTCHA integration for [WooCommerce](https://www.linknacional.com.br/wordpress/woocommerce/) checkout.

== Upgrade Notice ==
= 1.3.8 =
* Fixed: checkout no longer fails with a security verification error when the customer creates an account while placing the order.

= 1.3.7 =
* Captcha blocks now explain the failure reason. New Support tab: debug logging, order log viewer, and one-click settings send to support.

= 1.3.6 =
* Captcha now shows on the receipt page, above the order notes.

= 1.3.5 =
* New Captcha tab with cascading provider setup; settings reorganized into 4 tabs.

= 1.3.4 =
* Security fixes; add the "AntiFraud" admin menu with shortcuts to the settings tabs.

= 1.3.3 =
* Decouple IP and data-based banning from the security verification; fix settings scroll jump.

= 1.3.2 =
* Fix checkout when CAPTCHA credentials are empty; add settings UX warnings.

= 1.3.1 =
* New option to ban by phone number via order notes.

= 1.3.0 =
* New antifraud behavior controls, configurable IP ban duration, and data-based blocking by email, phone, country, and device fingerprint.

= 1.2.1 =
* Fix default state of checkboxes on the settings page.

= 1.2.0 =
* New security verification system with Cloudflare Turnstile and IP banning feature.

= 1.1.9/1.1.10 =
* New banners according to country.

= 1.1.8 =
* New layout for the plugin images.

= 1.1.7 =
* Fix the plugin URL.

= 1.1.6 =
* Change actions.

= 1.1.5 =
* Fix [Wordpress](https://www.linknacional.com.br/wordpress/) issues.

= 1.1.4 =
* Fix [Wordpress](https://www.linknacional.com.br/wordpress/) issues.

= 1.1.3 =
* Remove plugin updater.

= 1.1.2 =
* Change plugin title.

= 1.1.1 =
* Fix GitHub actions.

= 1.1.0 =
* Add compatibility with shortcode form.

= 1.0.0 =
* Plugin launch.
