Checkout Shield for WooCommerce – Stop Fake Orders, Spam Bots & Card Testing vs Mydybox Taiwan for WooCommerce (台灣商店：核心助手)

Checkout Shield blocks the scripted checkout submissions that CAPTCHA never sees. Card testing bots don’t fill out your checkout form. They hit your store’s checkout API directly, completely skipping any reCAPTCHA or hCaptcha you’ve set up. That’s why CAPTCHA alone doesn’t stop them. Your site signs a proof into the checkout page it serves. A submission that carries that proof loaded the page; one that doesn’t, didn’t. Submissions with no valid proof are stopped before WooCommerce processes the order. What this stops, and what it does not Being straight about this is more useful than a bigger promise. It stops anything that posts to your checkout without loading the checkout page first: curl scripts, direct Store API calls, replayed form posts, and the card testing runs that work this way. This is the large majority of automated checkout abuse, and it is the part CAPTCHA misses. It does not stop a bot that drives a real browser. Something that genuinely loads your checkout page receives a genuine proof, because that is exactly what the proof records. Once loaded, that proof stays valid for the life of the shopping session, so a script can reuse it. No proof of this kind can tell the second submission from the first, since the thing being proven is identical. For that tier you want a bot mitigation service in front of the site (Cloudflare Bot Fight Mode, Sucuri) alongside this plugin. What this plugin can do is show you when it is happening: the dashboard reports payments that failed repeatedly from a single checkout visit, which is what working through stolen card numbers looks like. In Pro it can also act on it. Once a visit crosses a failure limit you set, the source IP is banned for a while so it can’t just start a fresh visit and keep going, and the ban lifts itself, so a bad guess never becomes a permanent lock-out. A determined attacker can still rotate IPs, which is why the service in front of the site stays the front line, but for the common case this turns the pattern off at the source. Why Store Owners Choose This Plugin Catches what CAPTCHA misses: blocks bots hitting your checkout API directly, without asking shoppers to prove anything Works with any caching: LiteSpeed, Cloudflare, WP Rocket and W3TC, with no conflicts Nothing to configure: no rules to write and no thresholds to tune Never blocks your customers by mistake: it only starts once it has seen a real checkout on your store work, and if your theme ever stops carrying the proof it detects that, keeps letting real shoppers through, and tells you what to fix No external services: everything runs on your server, no subscriptions Adds milliseconds: the check is local, with no third-party call to wait on Features (Free) Automatic bot blocking: no rules to configure; it arms itself once it has seen one checkout on your store work 4 protection levels: Learning, Permissive, Balanced and Strict, so you choose how aggressive you want to be One place for everything: a dedicated Checkout Shield screen with a live “what’s protected right now” overview, plus your settings and logs Dashboard overview: see blocked vs verified orders at a glance with a 7-day chart Order status tracking: know which orders were flagged, passed, or blocked IP whitelist: let trusted addresses through, supports CIDR notation API key authentication: for headless and custom checkout setups Works with all checkout types: classic, block-based, and all payment gateways HPOS compatible: works with High-Performance Order Storage WooCommerce logging: full integration with WooCommerce Status logs Pro Features Pro is about two things: stopping more, and letting you see it happen. Live attack timeline: watch scripted attempts get stopped as they arrive, with the surface, reason, masked email, and IP for each one Test your protection: one button fires the real card-testing request at your own store and shows you it hit a wall, so you never have to wonder whether it’s working Auto-ban repeat offenders: when one visit keeps failing payment past a limit you set, its IP is blocked for a while and then released on its own, so it can’t just start over Registration protection: the same no-CAPTCHA proof on your sign-up forms, plus throwaway-email blocking and per-IP rate limiting, to stop the fake accounts that come before fraud Throwaway email blocking: reject checkouts using a known disposable inbox, with a domain list the plugin keeps up to date for you 3-level logging control: turn logging off, log blocked attempts only, or log everything Recent blocks feed: the last 50 blocked attempts with email, payment method, and reason Automatic CDN/proxy detection: identifies real visitor IPs behind Cloudflare, Sucuri, or Akamai Stronger permissive mode: tighter bot detection with referrer and user-agent checks Checkout details in logs: see which email and payment method bots tried to use Customer blocklist: block repeat offenders by email, name, address, phone, IP, or postal code, all managed from the Checkout Shield screen One-click order blocking: block a customer directly from any order screen Learn more about Pro features

Mydybox Taiwan for WooCommerce 是專為台灣電商市場設計的 WooCommerce 在地化工具箱。本外掛能優化 WooCommerce 的結帳流程以符合台灣消費者的習慣，整合本地物流與金流平台，並提供直覺的視覺化規則引擎來管理常見的商業邏輯。 核心功能 台灣結帳流程優化 — 縣市/鄉鎮市區二級聯動下拉選單、3+3 碼郵遞區號自動填寫。 統一編號與發票載具 — 支援在結帳頁面收集統一編號（公司抬頭）、手機條碼載具、自然人憑證與捐贈碼。 統編自動查詢（選用功能） — 串接台灣政府商工登記開放資料 API。當消費者輸入 8 位數統編時，可自動帶出公司名稱（此功能預設關閉，需由管理員主動開啟）。 視覺化規則引擎 — 無需程式碼即可設定金流、物流與購物車的條件限制與邏輯。 自訂訂單編號 — 建立流水的自訂訂單格式（例如：前綴 + YYYYMMDD + 流水號）。 結帳倒數計時 — 提供購物車保留倒數計時器，提升轉單率。 行動端底部固定購買列 — 在手機版商品頁面顯示固定的「立即購買」按鈕。 社群快速登入 — 整合 LINE、Google 與 Facebook 快速登入（各平台均為選用，預設為關閉狀態）。 便利超商取貨 — 支援串接綠界科技（ECPay）或藍新金流（NewebPay）的物流地圖，讓顧客選擇 7-11 / 全家 / 萊爾富 / OK 超商取貨。 相容 HPOS — 完全支援 WooCommerce 高性能訂單儲存（High-Performance Order Storage）。 Mydybox Taiwan for WooCommerce is a localization toolkit built for stores selling to customers in Taiwan. It adapts the WooCommerce checkout to Taiwanese conventions, integrates with local logistics and payment providers, and provides a visual rule engine for common business logic. Core Features Taiwan Checkout Optimization — City/District cascading dropdowns and 3+3 digit postcode auto-fill. Tax ID Fields — Collect Unified Business Number (UBN), Company Name, Mobile Barcode, Citizen Digital Certificate, and Donation Code at checkout. Optional Tax ID Lookup — When the site owner explicitly opts in, an entered 8-digit Tax ID can be looked up against the Taiwan GCIS open-data API to pre-fill the company name. Disabled by default. Visual Rule Engine — Manage payment, shipping, and cart rules with a visual interface; no coding required. Custom Order Numbers — Sequential number formats (e.g., Prefix + YYYYMMDD + Sequence). Checkout Countdown — Optional reservation timer. Mobile Sticky Bar — Sticky “Buy” button for mobile product pages. Social Login — One-click login with LINE, Google, and Facebook (each optional and disabled by default). Convenience-Store Pickup — 7-11 / FamilyMart / Hi-Life / OK pickup via ECPay or NewebPay logistics. HPOS Ready — Compatible with WooCommerce High-Performance Order Storage. External services 本外掛可以連接多個第三方服務。這些連接僅在網站管理員於設定中主動啟用對應功能時才會發生。預設情況下，所有外部整合皆為關閉狀態。 1. 台灣商工登記資料查詢 (Government Open Data) — 統一編號查詢 * 服務用途：使用經濟部商工登記開放資料 API，根據輸入的 8 位數統編自動查詢註冊的公司名稱。 * 資料傳送：僅當管理員啟用「統編自動查詢」且消費者在結帳頁面輸入 8 位統編時，會將該統編發送至 data.gcis.nat.gov.tw。不會傳送任何其他顧客隱私資料。 * 預設關閉，需主動啟用。 2. LINE 快速登入 (LINE Login OAuth) * 服務用途：使用 LINE Corp 的 OAuth 2.0 / OpenID Connect 端點驗證顧客的 LINE 帳號。 * 資料傳送：僅在管理員啟用 LINE 登入且訪客點擊「使用 LINE 登入」時。授權碼、您的 Channel ID/Secret 及重新導向 URL 會發送至 api.line.me；回傳的資料（LINE 用戶 ID、顯示名稱、選用信箱、頭像）將用於建立或對應 WordPress 用戶。 3. LINE Messaging API — 購物車挽回推送通知 * 服務用途：使用 LINE Corp 的 Messaging API 向已綁定 LINE 的顧客發送購物車挽回訊息。 * 資料傳送：僅在管理員啟用購物車挽回 LINE 通知，且顧客已綁定 LINE 並留下了未結帳購物車時。設定的 Channel Access Token、接收者的 LINE 用戶 ID 及訊息內容會發送至 api.line.me。 4. Google 快速登入 (Google OAuth) * 服務用途：使用 Google 的 OAuth 2.0 端點驗證顧客的 Google 帳號。 * 資料傳送：僅在管理員啟用 Google 登入且訪客點擊「使用 Google 登入」時。授權碼、您的 Client ID/Secret 及重新導向 URL 會發送至 oauth2.googleapis.com；回傳的 ID Token（Google 用戶 ID、姓名、信箱、頭像）將用於建立或對應 WordPress 用戶。 5. Facebook 快速登入 (Facebook Graph API) * 服務用途：使用 Meta 的 Graph API OAuth 端點驗證顧客的 Facebook 帳號。 * 資料傳送：僅在管理員啟用 Facebook 登入且訪客點擊「使用 Facebook 登入」時。授權碼、您的 App ID/Secret 及重新導向 URL 會發送至 graph.facebook.com；回傳的個人資料（Facebook 用戶 ID、姓名、信箱、頭像）將用於建立或對應 WordPress 用戶。 6. 綠界科技 ECPay — 金流與超商取貨 * 服務用途：綠界科技的線上金流支付網關與物流（超商取貨門市選擇）API。 * 資料傳送：僅在管理員啟用綠界支付或超商物流，且顧客在結帳時選擇綠界服務時。訂單摘要（訂單 ID、總金額、商品名稱、顧客姓名/信箱/電話、帳單及運送地址）會發送至 payment.ecpay.com.tw（或測試環境的主機）或 logistics.ecpay.com.tw。 7. 藍新金流 NewebPay — 超商取貨 * 服務用途：藍新金流的超商取貨門市地圖 API。 * 資料傳送：僅在管理員啟用藍新超商物流且顧客打開超商選擇彈窗時。設定的商店代號（Merchant ID）與回傳網址 Nonce 會發送至 cvsmap.newebpay.com，系統隨後會將選定的門市 ID、名稱與地址傳回外掛。 This plugin can connect to several third-party services. Each connection only happens when the corresponding feature is enabled in the plugin settings. By default, every external integration is disabled. 1. Taiwan GCIS (Government Open Data) — Tax ID Lookup * What it is: The Ministry of Economic Affairs (Taiwan) open-data API that returns the registered company name for a given Unified Business Number. * When data is sent: Only when the site owner has enabled “Tax ID Lookup” in Checkout settings, and a customer types an 8-digit Tax ID during checkout. The 8-digit Tax ID is then sent to data.gcis.nat.gov.tw. No other customer data is sent. * Disabled by default; explicit opt-in is required both in the JS payload and on the server endpoint. 2. LINE Login (OAuth) * What it is: LINE Corp’s OAuth 2.0 / OpenID Connect endpoint used to authenticate the customer with their LINE account. * When data is sent: Only after the site owner enables LINE Login and a visitor clicks the “Login with LINE” button. The authorization code, your configured Channel ID/Secret, and the redirect URL are sent to api.line.me; the response (LINE user ID, display name, optional email, profile picture URL) is used to create or match a WordPress user. 3. LINE Messaging API — Abandoned-Cart Push Notifications * What it is: LINE Corp’s Messaging API used to push a recovery message to a customer who linked their LINE account. * When data is sent: Only when the site owner enables abandoned-cart LINE notifications and a customer has linked their LINE account and abandoned a cart. The configured channel access token and the recipient’s LINE user ID + message body are sent to api.line.me. 4. Google OAuth * What it is: Google’s OAuth 2.0 endpoints used to authenticate the customer with their Google account. * When data is sent: Only after the site owner enables Google Login and a visitor clicks “Login with Google”. The authorization code, your configured Client ID/Secret, and the redirect URL are sent to oauth2.googleapis.com; the returned ID token (Google user ID, name, email, picture URL) is used to create or match a WordPress user. 5. Facebook Graph API (Login) * What it is: Meta’s Graph API OAuth endpoints used to authenticate the customer with their Facebook account. * When data is sent: Only after the site owner enables Facebook Login and a visitor clicks “Login with Facebook”. The authorization code, your configured App ID/Secret, and the redirect URL are sent to graph.facebook.com; the returned profile (Facebook user ID, name, email, picture URL) is used to create or match a WordPress user. 6. ECPay (Green World) — Payment Gateway and CVS Pickup * What it is: ECPay’s online payment gateway and logistics (CVS pickup) APIs. * When data is sent: Only when the site owner enables the ECPay payment gateway and/or CVS shipping method, and a customer chooses ECPay at checkout. The order summary (order ID, total amount, item names, customer name/email/phone, billing/shipping address as needed by the chosen ECPay service) is posted to payment.ecpay.com.tw (or the staging host in test mode) or logistics.ecpay.com.tw for store-pickup selection. 7. NewebPay (藍新金流) — CVS Pickup * What it is: NewebPay’s convenience-store pickup map API. * When data is sent: Only when the site owner enables the NewebPay CVS shipping method and a customer opens the store-selection popup. The configured Merchant ID and a return-URL nonce are posted to cvsmap.newebpay.com. NewebPay then returns the selected store’s ID, name, and address to the plugin.