=== Snagbane Checkout Doctor for WooCommerce ===
Contributors: snagbane
Tags: woocommerce, checkout, failed orders, card testing, payment errors
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Tells you why WooCommerce checkouts fail, whose fault each failure is, and when failed orders are a card-testing attack rather than a broken gateway.

== Description ==

Your uptime monitor is green, the store looks fine, and orders have quietly stopped. Or the Orders screen fills with dozens of failed orders overnight and you cannot tell whether your payment gateway broke or someone is testing stolen cards on your checkout.

Checkout Doctor watches every checkout attempt and answers the question that matters: what went wrong, and whose fault is it.

= What it does =

* **Reads every failed checkout**, on the block checkout and the classic checkout, with any payment method. It records the error the customer actually saw, not just that an order failed.
* **Says whose fault it is.** Each failure is sorted into the customer's bank or card, the customer's input, your store's rules (stock, shipping, coupons), your store's configuration (a wrong API key, an account not activated), or the site itself (expired sessions, errors in code). Only the last two are yours to fix, and those are the ones it raises.
* **Recognises card testing.** Many failed payments in a short time, from few visitors or many throwaway email addresses, refused by the bank: that is an attack, not a broken gateway, and it says so in one sentence.
* **Notices when paid orders stop.** It learns your store's normal pace from its own history and tells you when the time since the last paid order is out of character. Three quiet hours mean nothing for a small store and a lot for a busy one; it knows the difference.
* **Shows what changed.** Plugin, theme and WordPress updates sit on the same timeline as new kinds of failure, so "it started after that update" is visible at a glance.
* **Checks your protection.** Test mode left on in a live store, checkout rate limiting switched off, guest checkout: read from your real settings.
* **Emails you** when card testing starts, when the store causes failed checkouts, or when paid orders stop for far longer than usual. One email per problem, not one per failure.

Everything above is free, on every store, with no limit on orders or payment methods, and 90 days of history.

= Privacy =

No card data, names or addresses are stored. IP and email addresses are kept only as hashes, which can tell repeated attempts apart but cannot be read back. Records are deleted after 90 days. The plugin adds a suggested paragraph to your privacy policy and supports WordPress's personal data export and erasure tools. Its detection runs entirely on your own server; the only outside connection is the optional Freemius opt-in described under External Services.

== Installation ==

1. Install through Plugins > Add New Plugin, or upload the plugin folder to `/wp-content/plugins/`.
2. Activate it. WooCommerce must be active.
3. Open WooCommerce > Checkout Doctor.

The last four weeks of paid and failed orders are read once in the background after activation, so the store's normal pace is known from day one.

== Frequently Asked Questions ==

= Does it change my checkout? =

No. It only reads. It never blocks a customer, changes a payment or slows the checkout down.

= Which payment gateways does it work with? =

All of them. It reads what WooCommerce itself sees: the checkout response, the error notices and the order status. No gateway has to support it.

= Does it support the block checkout and HPOS? =

Yes, both, and the classic checkout.

= Is there a Pro version? =

Yes, as a separate add-on for stores that want an attack stopped, not only reported: an automatic lockdown during card testing that ends by itself, an optional CAPTCHA, gateway error codes explained, alerts in Slack, Discord or any webhook, and a monthly report for clients. Nothing in this plugin is limited or locked; it works fully on its own.

== External Services ==

This plugin connects to one external service:

**Freemius**, our licensing and update platform. The Freemius SDK is used to apply the Free/Pro state and -- only if you opt in on first activation -- share basic, non-personal usage and site data used to improve the plugin. This connects to freemius.com. No data is sent unless you activate the plugin, and the optional opt-in can be declined without affecting anything. See the [Freemius Privacy Policy](https://freemius.com/privacy/) and [Terms of Service](https://freemius.com/terms/).

The plugin makes no other outbound requests. Checkout failures are read from your own store's requests and orders.

== Screenshots ==

1. Card testing spotted the moment it starts: failed attempts, visitors and throwaway emails in the last hour.
2. Every failed checkout, and whose fault it is: store problems, customer mistakes and bank declines kept apart.
3. Each payment method at a glance, and a checklist of the WooCommerce settings that protect your checkout.
4. What changed on the site next to new kinds of failure, plus email alerts.

== Changelog ==

= 0.1.0 =
* First release.
