Checkout Shield for WooCommerce – Stop Fake Orders, Spam Bots & Card Testing vs TrustSig Security

Checkout Shield stops fake checkout orders and card testing attacks — the kind that bypass your CAPTCHA. Card testing bots don’t fill out your checkout form. They hit your store’s checkout API directly, completely skipping any reCAPTCHA or hCaptcha you’ve set up. That’s why CAPTCHA alone doesn’t stop them. This plugin verifies that every checkout request comes from a real browser session. Bots that can’t prove they loaded your checkout page get blocked before WooCommerce processes the order. Why Store Owners Choose This Plugin Catches what CAPTCHA misses — blocks bots hitting your checkout API directly Works with any caching — LiteSpeed, Cloudflare, WP Rocket, W3TC — no conflicts Zero configuration — activate and you’re protected No external services — everything runs on your server, no subscriptions No performance impact — validation adds microseconds, not seconds Features (Free) Automatic bot blocking — works the moment you activate, no setup needed 4 protection levels — Learning, Permissive, Balanced, and Strict — choose how aggressive you want to be Dashboard overview — see blocked vs verified orders at a glance with a 7-day chart Order status tracking — know which orders were flagged, passed, or blocked IP whitelist — let trusted addresses through, supports CIDR notation API key authentication — for headless and custom checkout setups Works with all checkout types — classic, block-based, and all payment gateways HPOS compatible — works with High-Performance Order Storage WooCommerce logging — full integration with WooCommerce Status logs Pro Features Take control with advanced tools: 3-level logging control — turn logging off, log blocked attempts only, or log everything Recent blocks feed — last 50 blocked attempts on your dashboard with email, payment method, and reason Automatic CDN/proxy detection — identifies real visitor IPs behind Cloudflare, Sucuri, or Akamai Stronger permissive mode — tighter bot detection with referrer verification Checkout details in logs — see which email and payment method bots tried to use Customer blocklist — block repeat offenders by email, name, address, phone, IP, or postal code One-click order blocking — block a customer directly from any order screen Learn more about Pro features

TrustSig Security protects WordPress forms and API endpoints from scripted bots and brute-force attacks. No puzzles. No “I am not a robot” checkboxes. No third-party signup required to start. Coverage depends on the protection mode you choose — see “Protection modes” below. Why TrustSig Protects every important form out of the box — login, registration, comments, password reset, WooCommerce checkout, BuddyPress signup, Easy Digital Downloads, Elementor Pro forms, WPForms (including the Mesmerize / Materialis contact form), Contact Form 7, SureForms, and any custom form via shortcode. Stops brute-force login attempts with built-in lockout after repeated failures. Invisible to humans — real visitors are verified in under a second by a non-interactive browser check. No CAPTCHA, no images to click. Three protection modes — Monitor (log only), Challenge (default, soft block with auto-retry), Enforce (hard block). Zero configuration — activate the plugin and protection is live immediately. Anonymous free tier needs no account. Works with caching plugins, WPML, multisite and most themes — forms are signed server-side with a per-site secret. Developer-friendly — PHP helper trustsig_verify(), REST endpoint /wp-json/trustsig/v1/verify, filters and actions for custom forms. Optional admin-ajax and REST API guard for advanced sites. GPLv2 — fully open source. How it works TrustSig injects a lightweight browser SDK, signs every rendered form with a per-site secret, and verifies submissions against the TrustSig Edge service. Real visitors pass an invisible check in about a second; scripted clients that never run JavaScript are stopped. When a request arrives without a valid token, TrustSig does not silently fail open. Depending on the mode you choose it serves a lightweight “please wait” interstitial that re-verifies the browser and then transparently continues the original request — or blocks it. The plugin works out of the box with no account and no API keys (anonymous free tier). Connecting a TrustSig dashboard account is optional and only adds analytics and higher limits. Protection modes Monitor — verify and log only, never block. Used for safe rollout; the upgrade path also pins existing sites here so behaviour never changes silently on update. Challenge (default for new installs) — a missing or invalid token shows the interstitial, then continues or blocks. Enforce — a missing or invalid token is blocked immediately. What it protects Browser forms are protected automatically with no code: WordPress core — login, registration, comments, lost/reset password WooCommerce — login, registration, checkout, pay order, lost password BuddyPress — registration Easy Digital Downloads — login, registration Elementor Pro forms WPForms — contact and other forms, on by default (covers the Mesmerize / Materialis contact section) Contact Form 7 — feedback submissions, on by default (guarded on the REST endpoint CF7 submits to) SureForms — form submissions, on by default (guarded on the REST submit-form endpoint) Any other form (site-wide “protect all forms” option, the [trustsig_form] shortcode, or a hidden trustsig-response input) It also includes optional brute-force lockout for repeated failed logins, an opt-in admin-ajax / REST API guard, and a developer verification API. For developers PHP: trustsig_verify( array( 'token' => $t, 'action' => 'my_form' ) ) returns pass | fail | challenge. Filters: trustsig_pre_verify, trustsig_result. Action: trustsig_blocked. REST: POST /wp-json/trustsig/v1/verify with { "token": "..." }. Known limitations XML-RPC (xmlrpc.php) is intentionally out of scope and is not verified. Disable XML-RPC separately if it is unused on your site. admin-ajax and the REST API are only protected when explicitly enabled in Settings, to avoid breaking third-party integrations. File-upload and AJAX submissions cannot show the interstitial; under Challenge or Enforce mode a missing token on those is blocked, never silently allowed. External services This plugin relies on the TrustSig Edge service to decide whether a request comes from a human or an automated client. This bot-detection verdict cannot be produced locally, so the service is required for the plugin’s core functionality. Service provider: TrustSig — https://trustsig.eu Remote script loaded in the browser: https://edge.trustsig.eu/trustsig.js is loaded on pages that contain a protected form, on the login screen, and on the verification interstitial. The script runs the non-interactive browser check and produces a verification token. Data sent from the visitor’s browser / your server to https://edge.trustsig.eu/verify: the TrustSig verification token generated by the SDK in the visitor’s browser; your site’s host name (e.g. example.com) on the anonymous free tier, or, if you connect a dashboard account, the secret key you entered; as part of any HTTPS request, the visitor’s IP address and standard request metadata (such as the user-agent) are visible to the service. When data is sent: when the SDK loads on a protected page, when a protected form is submitted, and once per browser when the optional verified-session cookie is bootstrapped. Data stored locally on your site: TrustSig writes a verification log to your own WordPress database (custom tables) that includes visitor IP addresses, the action attempted, and the verdict. This data is not sent to TrustSig; you can clear it at any time from Settings → TrustSig → Tools. By installing and activating this plugin you (the site administrator) consent to this data being sent to TrustSig so that requests can be verified. Inform your own site’s visitors as required by your local privacy obligations. Terms of Service: https://trustsig.eu/terms-of-service/ Privacy Policy: https://trustsig.eu/privacy