Checkout Shield for WooCommerce – Stop Fake Orders, Spam Bots & Card Testing vs Boxy WooCommerce Custom Redirect After Checkout

Boxy WooCommerce Custom Redirect After Checkout lets you send customers to any page you choose after a successful WooCommerce order — instead of the default order confirmation page. Whether you want to show a custom thank you page, promote an upsell offer, collect survey responses, or direct customers to a tutorial, this plugin makes it simple. Free Features Redirect all customers to a single custom URL after checkout Optional redirect delay (0–10 seconds) Countdown timer displayed on screen: “You will be redirected in 5… 4… 3… 2… 1…” Works with classic checkout and WooCommerce block checkout Clean modern admin settings page (Boxy Redirect menu) Redirect to full URLs or relative paths (/thank-you) Lightweight — no impact on store performance Fully translatable (i18n ready) Compatible with all major caching plugins Why Redirect After Checkout? The default WooCommerce thank you page is plain and does nothing for your business. A custom redirect lets you: Show a branded thank you page that matches your store design Promote an upsell or cross-sell offer while the customer is in buying mode Collect customer feedback with a post-purchase survey Direct customers to a tutorial or onboarding page Track conversions with Google Analytics or Facebook Pixel Show payment instructions for bank transfer orders Upgrade to Pro — Powerful Rules Engine The free version redirects all customers to the same URL. Pro unlocks a full rules engine so you can redirect different customers to different pages based on what they ordered, who they are, and how they paid. Rules work like this: You create multiple redirect rules Each rule has one or more conditions Rules are checked top-to-bottom by priority The first matching rule fires — the rest are skipped If no rule matches, your free fallback URL is used Every rule shows a plain-English live preview: “When a customer completes checkout and their billing country is Germany, they will be immediately redirected to /de/danke. Customers from other countries will skip this rule.” Test before going live with the Customer Journey Simulator: Enter a hypothetical customer profile and see exactly which rule would fire and why — before a single real customer is affected. Starter Plan — Rules Engine with 4 Conditions Build redirect rules using these conditions: Specific Product Purchased — redirect based on which products are in the order Example: Customer buys a T-Shirt — redirect to /tshirt-care-guide Product Category — redirect based on product category Example: Customer buys from Electronics — redirect to /warranty-registration Order Total — redirect based on amount spent (greater than, less than, between) Example: Order total over $200 — redirect to /vip-club User Role — redirect wholesale, retail, and member customers differently Example: Wholesale customer checks out — redirect to /wholesale-thank-you Each rule supports Match ALL (every condition must be true) or Match ANY (at least one condition must be true). Rules are drag-and-drop sortable and can be individually enabled or disabled. Pro Plan — All 8 Conditions + Order Data in URL Everything in Starter plus: Coupon Code Used — redirect customers based on the coupon they used Example: Customer uses coupon FACEBOOK20 — redirect to /facebook-special-offer Use case: Track ROI from marketing campaigns First Time Buyer — detect a customer’s very first order and treat them differently Example: First order — redirect to /welcome-new-customer with onboarding guide Returning customers automatically skip this rule Payment Method — redirect based on how the customer paid Example: Bank transfer — redirect to /payment-instructions with account details Customer Country — redirect based on billing country Example: Germany — /de/danke, France — /fr/merci, everyone else — /thank-you Pass Order Data in URL — append real order details to your redirect URL using variables: {order_id} {first_name} {last_name} {email} {order_total} {payment_method} {coupon_code} Example: /thanks?name={first_name}&order={order_id} becomes /thanks?name=John&order=1234 Custom Delay Per Rule — set a different countdown timer for each rule (0–30 seconds) Agency Plan — Everything + A/B Testing + Analytics Everything in Pro plus: A/B Testing — split traffic between multiple redirect URLs with percentage control Example: 50% of customers go to Page A, 50% go to Page B — find out which converts better Analytics Dashboard — see every redirect that fired, broken down by rule Includes date range filtering (today, 7 days, 30 days, custom) and A/B test performance comparison Export to CSV — download your full redirect history Unlimited Sites — use on as many WordPress installs as you need Full Customer Journey Example Rules set up by admin: Priority 1: Coupon = VIPCODE — redirect to /vip-thank-you Priority 2: Country = Germany — redirect to /de/danke Priority 3: Order Total over $200 — redirect to /big-spender-offer Customer checks out with coupon SAVE10 from Germany spending $250: Rule 1 checked — coupon is SAVE10 not VIPCODE — skipped Rule 2 checked — billing country is Germany — matched! Customer is redirected to /de/danke Rules 3 and beyond are never checked Is This Plugin GDPR Compliant? Yes. The free version does not collect, store, or transmit any personal data. The Pro analytics feature stores only the order ID and redirect URL in your own database — no data is ever sent to third parties. Works With Everything WooCommerce classic checkout WooCommerce block checkout All major page builders (Elementor, Divi, Beaver Builder) All major caching plugins (WP Rocket, W3 Total Cache, LiteSpeed Cache) Multisite installations

Checkout Shield blocks the scripted checkout submissions that CAPTCHA never sees. Card testing bots don’t fill out your checkout form. They hit your store’s checkout API directly, completely skipping any reCAPTCHA or hCaptcha you’ve set up. That’s why CAPTCHA alone doesn’t stop them. Your site signs a proof into the checkout page it serves. A submission that carries that proof loaded the page; one that doesn’t, didn’t. Submissions with no valid proof are stopped before WooCommerce processes the order. What this stops, and what it does not Being straight about this is more useful than a bigger promise. It stops anything that posts to your checkout without loading the checkout page first: curl scripts, direct Store API calls, replayed form posts, and the card testing runs that work this way. This is the large majority of automated checkout abuse, and it is the part CAPTCHA misses. It does not stop a bot that drives a real browser. Something that genuinely loads your checkout page receives a genuine proof, because that is exactly what the proof records. Once loaded, that proof stays valid for the life of the shopping session, so a script can reuse it. No proof of this kind can tell the second submission from the first, since the thing being proven is identical. For that tier you want a bot mitigation service in front of the site (Cloudflare Bot Fight Mode, Sucuri) alongside this plugin. What this plugin can do is show you when it is happening: the dashboard reports payments that failed repeatedly from a single checkout visit, which is what working through stolen card numbers looks like. In Pro it can also act on it. Once a visit crosses a failure limit you set, the source IP is banned for a while so it can’t just start a fresh visit and keep going, and the ban lifts itself, so a bad guess never becomes a permanent lock-out. A determined attacker can still rotate IPs, which is why the service in front of the site stays the front line, but for the common case this turns the pattern off at the source. Why Store Owners Choose This Plugin Catches what CAPTCHA misses: blocks bots hitting your checkout API directly, without asking shoppers to prove anything Works with any caching: LiteSpeed, Cloudflare, WP Rocket and W3TC, with no conflicts Nothing to configure: no rules to write and no thresholds to tune Never blocks your customers by mistake: it only starts once it has seen a real checkout on your store work, and if your theme ever stops carrying the proof it detects that, keeps letting real shoppers through, and tells you what to fix No external services: everything runs on your server, no subscriptions Adds milliseconds: the check is local, with no third-party call to wait on Features (Free) Automatic bot blocking: no rules to configure; it arms itself once it has seen one checkout on your store work 4 protection levels: Learning, Permissive, Balanced and Strict, so you choose how aggressive you want to be One place for everything: a dedicated Checkout Shield screen with a live “what’s protected right now” overview, plus your settings and logs Dashboard overview: see blocked vs verified orders at a glance with a 7-day chart Order status tracking: know which orders were flagged, passed, or blocked IP whitelist: let trusted addresses through, supports CIDR notation API key authentication: for headless and custom checkout setups Works with all checkout types: classic, block-based, and all payment gateways HPOS compatible: works with High-Performance Order Storage WooCommerce logging: full integration with WooCommerce Status logs Pro Features Pro is about two things: stopping more, and letting you see it happen. Live attack timeline: watch scripted attempts get stopped as they arrive, with the surface, reason, masked email, and IP for each one Test your protection: one button fires the real card-testing request at your own store and shows you it hit a wall, so you never have to wonder whether it’s working Auto-ban repeat offenders: when one visit keeps failing payment past a limit you set, its IP is blocked for a while and then released on its own, so it can’t just start over Registration protection: the same no-CAPTCHA proof on your sign-up forms, plus throwaway-email blocking and per-IP rate limiting, to stop the fake accounts that come before fraud Throwaway email blocking: reject checkouts using a known disposable inbox, with a domain list the plugin keeps up to date for you 3-level logging control: turn logging off, log blocked attempts only, or log everything Recent blocks feed: the last 50 blocked attempts with email, payment method, and reason Automatic CDN/proxy detection: identifies real visitor IPs behind Cloudflare, Sucuri, or Akamai Stronger permissive mode: tighter bot detection with referrer and user-agent checks Checkout details in logs: see which email and payment method bots tried to use Customer blocklist: block repeat offenders by email, name, address, phone, IP, or postal code, all managed from the Checkout Shield screen One-click order blocking: block a customer directly from any order screen Learn more about Pro features