Guard Dog vs Mydybox Taiwan for WooCommerce (台灣商店：核心助手)

Guard Dog is a focused WordPress security plugin for the login door, authentication, sessions, and practical access workflows. With custom login URLs, two-factor authentication, passkeys, CAPTCHA providers, access control, and activity logging, Guard Dog helps site owners tighten the parts of WordPress that get bothered most. Key Features: Custom Login URLs – Hide your wp-admin and wp-login.php from attackers Two-Factor Authentication (2FA) – TOTP-based authentication with recovery codes Social Login (OAuth) – Sign in with Google, Microsoft, or Apple Passkeys – Use device-based biometric authentication like Face ID, Touch ID or Windows Hello Multiple CAPTCHA Providers – Support for Google reCAPTCHA v2/v3, hCaptcha, and Cloudflare Turnstile Login Attempt Limiting – Prevent brute-force attacks with intelligent lockout Access Control – IP-based whitelist/blacklist protection Activity Monitoring – Comprehensive logging of security events Temporary User Access – Create temporary WordPress users with time-limited, secure access Frontend Account Security – Shortcodes and blocks for login, passkeys, 2FA, and session controls Why Choose Guard Dog? Privacy-Focused – Multiple CAPTCHA options including privacy-first providers WordPress.org Compliant – Built following WordPress coding standards Site-Owned Controls – Protections run inside your WordPress site User-Friendly – Intuitive interface with helpful documentation Regular Updates – Actively maintained and updated Perfect For: Business websites requiring enhanced security WordPress sites handling sensitive data Multi-user sites with complex access requirements Anyone wanting practical login and account protection without a central SaaS dependency Frontend Shortcodes: [guard_dog_login_form] renders a public Guard Dog-managed login form [guard_dog_passkey_login] renders a standalone passkey sign-in button for custom login pages [guard_dog_two_factor] renders logged-in 2FA management [guard_dog_passkeys] renders logged-in passkey management [guard_dog_sessions] renders logged-in active-session management [guard_dog_account_security] renders the composite logged-in account security widget for 2FA, passkeys, and sessions [guard_dog_2fa] remains supported as the legacy alias for the account security widget Block-based themes can use the matching Guard Dog Login Form, Passkey Login, Two-Factor Auth, Passkeys, Sessions, and Account Security blocks. Additional Information Support: For support questions, please use the WordPress.org support forums. Privacy: Guard Dog respects user privacy and offers multiple privacy-focused options. Third-party services are only contacted when you enable features that need them, such as CAPTCHA, email delivery, social login, IP reputation, or geolocation. Security: Guard Dog follows WordPress security best practices. User input is sanitized and output is escaped throughout the plugin. Third-Party Services Guard Dog integrates with the following third-party services to provide CAPTCHA protection. These services are optional and only used when CAPTCHA features are enabled. Google reCAPTCHA (v2 and v3) What it is: Google’s CAPTCHA service that helps protect websites from spam and abuse. What it’s used for: – Verifying that login, registration, and password reset attempts are made by humans – Preventing automated bot attacks on your WordPress forms What data is sent and when: – User interaction data (mouse movements, time spent on page) when CAPTCHA is solved – IP address of the user – Site domain for verification – CAPTCHA response token Privacy and Terms: – Google reCAPTCHA Privacy Policy – Google reCAPTCHA Terms of Service – Google reCAPTCHA Data Usage Cloudflare Turnstile What it is: Cloudflare’s privacy-first CAPTCHA alternative that doesn’t require user interaction. What it’s used for: – Invisible verification of human users during login, registration, and password reset – Privacy-focused protection without tracking or cookies What data is sent and when: – Non-interactive browser signals when forms are submitted – IP address for verification – Site domain for validation Privacy and Terms: – Cloudflare Privacy Policy – Cloudflare Terms of Service – Turnstile Documentation hCaptcha What it is: A privacy-focused CAPTCHA service that doesn’t track users across websites. What it’s used for: – Human verification during login, registration, and password reset forms – Privacy-conscious alternative to Google reCAPTCHA What data is sent and when: – User interaction with CAPTCHA challenge – IP address for verification – Site domain for validation Privacy and Terms: – hCaptcha Privacy Policy – hCaptcha Terms of Service – hCaptcha Data Processing Google OAuth (Social Login) What it is: Google’s OAuth 2.0 service that allows users to sign in using their Google account. What it’s used for: – Authenticating WordPress users via their Google account – Retrieving basic profile information (name, email) to link or create accounts What data is sent and when: – User is redirected to Google’s authorization server when clicking “Sign in with Google” – An authorization code is exchanged for an access token on your server – Basic profile information (name, email, Google user ID) is retrieved from Google’s API – No ongoing data sharing – data is only retrieved during the login process Privacy and Terms: – Google OAuth Privacy Policy – Google OAuth Terms of Service – Google API Services User Data Policy Microsoft Azure AD (Social Login) What it is: Microsoft’s OAuth 2.0 service via Azure Active Directory that allows users to sign in using their Microsoft account. What it’s used for: – Authenticating WordPress users via their personal Microsoft account or organizational (work/school) account – Retrieving basic profile information (name, email) to link or create accounts What data is sent and when: – User is redirected to Microsoft’s authorization server when clicking “Sign in with Microsoft” – An authorization code is exchanged for an access token and ID token (JWT) on your server – Basic profile information (name, email, Azure object ID) is extracted from the ID token – No ongoing data sharing – data is only retrieved during the login process Privacy and Terms: – Microsoft Privacy Statement – Microsoft Services Agreement – Microsoft Identity Platform Documentation Apple Sign In (Social Login) What it is: Apple’s OAuth 2.0 / OpenID Connect service that allows users to sign in using their Apple ID. What it’s used for: – Authenticating WordPress users via their Apple ID – Retrieving basic profile information (name, email) to link or create accounts What data is sent and when: – User is redirected to Apple’s authorization server when clicking “Sign in with Apple” – An authorization code is exchanged for an access token and ID token (JWT) on your server – Basic profile information (email, user ID) is extracted from the ID token – User’s name is only provided on first authorization; subsequent logins return only the user ID – Apple may provide a private relay email address instead of the user’s real email – No ongoing data sharing – data is only retrieved during the login process Privacy and Terms: – Apple Privacy Policy – Sign in with Apple Guidelines – Apple Developer Program License Agreement TOTP (Time-based One-Time Password) Standard What it is: An open standard (RFC 6238) for generating time-based one-time passwords used in two-factor authentication. What it’s used for: – Generating secure, time-limited authentication codes for 2FA – Providing backup authentication when primary 2FA methods are unavailable – Enabling compatibility with popular authenticator apps (Google Authenticator, Authy, Microsoft Authenticator, etc.) What data is sent and when: – No external data transmission – TOTP codes are generated locally using the TOTP algorithm – Secret key generation – A unique secret key is generated locally when 2FA is enabled for a user – QR code generation – QR codes are generated locally for easy setup with authenticator apps – Code verification – Generated codes are verified locally against the stored secret key Privacy and Terms: – RFC 6238 – TOTP Standard – Google Authenticator Privacy Policy (if using Google Authenticator app) – Authy Privacy Policy (if using Authy app) – Microsoft Authenticator Privacy Policy (if using Microsoft Authenticator app) Data Handling Summary When CAPTCHA is disabled: No data is sent to any third-party services. When CAPTCHA is enabled: Only the specific provider you choose receives verification data. Data is not shared between providers or stored by Guard Dog beyond the verification process. When 2FA is disabled: No external data transmission occurs. When 2FA is enabled: – All TOTP operations (code generation, verification) happen locally on your server – No data is transmitted to external services for 2FA functionality – Authenticator apps only receive the initial setup QR code or secret key – Recovery codes are generated locally and stored securely When Social Login is disabled: No data is sent to any OAuth provider. When Social Login is enabled: – Data is only sent to the configured providers (Google, Microsoft, Apple) during the login process – Only basic profile information (name, email, user ID) is retrieved – Social account links are stored locally in your WordPress database – Users can unlink their social accounts from their profile at any time User control: Users can choose which CAPTCHA provider to use, or disable CAPTCHA entirely. 2FA can be enabled/disabled per user, and users can choose their preferred authenticator app. Social login can be enabled/disabled by administrators, and users can manage their linked social accounts. All security features are optional and configurable.

Mydybox Taiwan for WooCommerce 是專為台灣電商市場設計的 WooCommerce 在地化工具箱。本外掛能優化 WooCommerce 的結帳流程以符合台灣消費者的習慣，整合本地物流與金流平台，並提供直覺的視覺化規則引擎來管理常見的商業邏輯。 核心功能 台灣結帳流程優化 — 縣市/鄉鎮市區二級聯動下拉選單、3+3 碼郵遞區號自動填寫。 統一編號與發票載具 — 支援在結帳頁面收集統一編號（公司抬頭）、手機條碼載具、自然人憑證與捐贈碼。 統編自動查詢（選用功能） — 串接台灣政府商工登記開放資料 API。當消費者輸入 8 位數統編時，可自動帶出公司名稱（此功能預設關閉，需由管理員主動開啟）。 視覺化規則引擎 — 無需程式碼即可設定金流、物流與購物車的條件限制與邏輯。 自訂訂單編號 — 建立流水的自訂訂單格式（例如：前綴 + YYYYMMDD + 流水號）。 結帳倒數計時 — 提供購物車保留倒數計時器，提升轉單率。 行動端底部固定購買列 — 在手機版商品頁面顯示固定的「立即購買」按鈕。 社群快速登入 — 整合 LINE、Google 與 Facebook 快速登入（各平台均為選用，預設為關閉狀態）。 便利超商取貨 — 支援串接綠界科技（ECPay）或藍新金流（NewebPay）的物流地圖，讓顧客選擇 7-11 / 全家 / 萊爾富 / OK 超商取貨。 相容 HPOS — 完全支援 WooCommerce 高性能訂單儲存（High-Performance Order Storage）。 Mydybox Taiwan for WooCommerce is a localization toolkit built for stores selling to customers in Taiwan. It adapts the WooCommerce checkout to Taiwanese conventions, integrates with local logistics and payment providers, and provides a visual rule engine for common business logic. Core Features Taiwan Checkout Optimization — City/District cascading dropdowns and 3+3 digit postcode auto-fill. Tax ID Fields — Collect Unified Business Number (UBN), Company Name, Mobile Barcode, Citizen Digital Certificate, and Donation Code at checkout. Optional Tax ID Lookup — When the site owner explicitly opts in, an entered 8-digit Tax ID can be looked up against the Taiwan GCIS open-data API to pre-fill the company name. Disabled by default. Visual Rule Engine — Manage payment, shipping, and cart rules with a visual interface; no coding required. Custom Order Numbers — Sequential number formats (e.g., Prefix + YYYYMMDD + Sequence). Checkout Countdown — Optional reservation timer. Mobile Sticky Bar — Sticky “Buy” button for mobile product pages. Social Login — One-click login with LINE, Google, and Facebook (each optional and disabled by default). Convenience-Store Pickup — 7-11 / FamilyMart / Hi-Life / OK pickup via ECPay or NewebPay logistics. HPOS Ready — Compatible with WooCommerce High-Performance Order Storage. External services 本外掛可以連接多個第三方服務。這些連接僅在網站管理員於設定中主動啟用對應功能時才會發生。預設情況下，所有外部整合皆為關閉狀態。 1. 台灣商工登記資料查詢 (Government Open Data) — 統一編號查詢 * 服務用途：使用經濟部商工登記開放資料 API，根據輸入的 8 位數統編自動查詢註冊的公司名稱。 * 資料傳送：僅當管理員啟用「統編自動查詢」且消費者在結帳頁面輸入 8 位統編時，會將該統編發送至 data.gcis.nat.gov.tw。不會傳送任何其他顧客隱私資料。 * 預設關閉，需主動啟用。 2. LINE 快速登入 (LINE Login OAuth) * 服務用途：使用 LINE Corp 的 OAuth 2.0 / OpenID Connect 端點驗證顧客的 LINE 帳號。 * 資料傳送：僅在管理員啟用 LINE 登入且訪客點擊「使用 LINE 登入」時。授權碼、您的 Channel ID/Secret 及重新導向 URL 會發送至 api.line.me；回傳的資料（LINE 用戶 ID、顯示名稱、選用信箱、頭像）將用於建立或對應 WordPress 用戶。 3. LINE Messaging API — 購物車挽回推送通知 * 服務用途：使用 LINE Corp 的 Messaging API 向已綁定 LINE 的顧客發送購物車挽回訊息。 * 資料傳送：僅在管理員啟用購物車挽回 LINE 通知，且顧客已綁定 LINE 並留下了未結帳購物車時。設定的 Channel Access Token、接收者的 LINE 用戶 ID 及訊息內容會發送至 api.line.me。 4. Google 快速登入 (Google OAuth) * 服務用途：使用 Google 的 OAuth 2.0 端點驗證顧客的 Google 帳號。 * 資料傳送：僅在管理員啟用 Google 登入且訪客點擊「使用 Google 登入」時。授權碼、您的 Client ID/Secret 及重新導向 URL 會發送至 oauth2.googleapis.com；回傳的 ID Token（Google 用戶 ID、姓名、信箱、頭像）將用於建立或對應 WordPress 用戶。 5. Facebook 快速登入 (Facebook Graph API) * 服務用途：使用 Meta 的 Graph API OAuth 端點驗證顧客的 Facebook 帳號。 * 資料傳送：僅在管理員啟用 Facebook 登入且訪客點擊「使用 Facebook 登入」時。授權碼、您的 App ID/Secret 及重新導向 URL 會發送至 graph.facebook.com；回傳的個人資料（Facebook 用戶 ID、姓名、信箱、頭像）將用於建立或對應 WordPress 用戶。 6. 綠界科技 ECPay — 金流與超商取貨 * 服務用途：綠界科技的線上金流支付網關與物流（超商取貨門市選擇）API。 * 資料傳送：僅在管理員啟用綠界支付或超商物流，且顧客在結帳時選擇綠界服務時。訂單摘要（訂單 ID、總金額、商品名稱、顧客姓名/信箱/電話、帳單及運送地址）會發送至 payment.ecpay.com.tw（或測試環境的主機）或 logistics.ecpay.com.tw。 7. 藍新金流 NewebPay — 超商取貨 * 服務用途：藍新金流的超商取貨門市地圖 API。 * 資料傳送：僅在管理員啟用藍新超商物流且顧客打開超商選擇彈窗時。設定的商店代號（Merchant ID）與回傳網址 Nonce 會發送至 cvsmap.newebpay.com，系統隨後會將選定的門市 ID、名稱與地址傳回外掛。 This plugin can connect to several third-party services. Each connection only happens when the corresponding feature is enabled in the plugin settings. By default, every external integration is disabled. 1. Taiwan GCIS (Government Open Data) — Tax ID Lookup * What it is: The Ministry of Economic Affairs (Taiwan) open-data API that returns the registered company name for a given Unified Business Number. * When data is sent: Only when the site owner has enabled “Tax ID Lookup” in Checkout settings, and a customer types an 8-digit Tax ID during checkout. The 8-digit Tax ID is then sent to data.gcis.nat.gov.tw. No other customer data is sent. * Disabled by default; explicit opt-in is required both in the JS payload and on the server endpoint. 2. LINE Login (OAuth) * What it is: LINE Corp’s OAuth 2.0 / OpenID Connect endpoint used to authenticate the customer with their LINE account. * When data is sent: Only after the site owner enables LINE Login and a visitor clicks the “Login with LINE” button. The authorization code, your configured Channel ID/Secret, and the redirect URL are sent to api.line.me; the response (LINE user ID, display name, optional email, profile picture URL) is used to create or match a WordPress user. 3. LINE Messaging API — Abandoned-Cart Push Notifications * What it is: LINE Corp’s Messaging API used to push a recovery message to a customer who linked their LINE account. * When data is sent: Only when the site owner enables abandoned-cart LINE notifications and a customer has linked their LINE account and abandoned a cart. The configured channel access token and the recipient’s LINE user ID + message body are sent to api.line.me. 4. Google OAuth * What it is: Google’s OAuth 2.0 endpoints used to authenticate the customer with their Google account. * When data is sent: Only after the site owner enables Google Login and a visitor clicks “Login with Google”. The authorization code, your configured Client ID/Secret, and the redirect URL are sent to oauth2.googleapis.com; the returned ID token (Google user ID, name, email, picture URL) is used to create or match a WordPress user. 5. Facebook Graph API (Login) * What it is: Meta’s Graph API OAuth endpoints used to authenticate the customer with their Facebook account. * When data is sent: Only after the site owner enables Facebook Login and a visitor clicks “Login with Facebook”. The authorization code, your configured App ID/Secret, and the redirect URL are sent to graph.facebook.com; the returned profile (Facebook user ID, name, email, picture URL) is used to create or match a WordPress user. 6. ECPay (Green World) — Payment Gateway and CVS Pickup * What it is: ECPay’s online payment gateway and logistics (CVS pickup) APIs. * When data is sent: Only when the site owner enables the ECPay payment gateway and/or CVS shipping method, and a customer chooses ECPay at checkout. The order summary (order ID, total amount, item names, customer name/email/phone, billing/shipping address as needed by the chosen ECPay service) is posted to payment.ecpay.com.tw (or the staging host in test mode) or logistics.ecpay.com.tw for store-pickup selection. 7. NewebPay (藍新金流) — CVS Pickup * What it is: NewebPay’s convenience-store pickup map API. * When data is sent: Only when the site owner enables the NewebPay CVS shipping method and a customer opens the store-selection popup. The configured Merchant ID and a return-URL nonce are posted to cvsmap.newebpay.com. NewebPay then returns the selected store’s ID, name, and address to the plugin.