Changelog

1.0.0

First release.

Protection (free)

• Covers every payment route:
  • the block checkout (Store API), including /batch sub-requests, the unversioned route and ?rest_route= URLs
  • the classic checkout
  • pay-for-order, both classic and Store API
  • My Account → Add payment method
  • gateway wc-ajax endpoints (PayPal Payments by default)
• Rate limits per IP (IPv6 per /64), with temporary blocks.
• Temporary blocks after repeated declines from one IP or one email. Declines are de-duplicated per order and attributed correctly for gateway webhooks. Renewals, admin-created orders and staff status changes are ignored.
• Attack mode:
  • switches on automatically on a store-wide spike, or by hand;
  • while on, halves the limits, enforces Turnstile and the browser check (if set) and pauses failed-order emails;
  • sends one admin email when it starts;
  • switches itself off.
• Browser check: a signed token bound to a session cookie, with a minimum human time.
• Optional Cloudflare Turnstile challenge (fails open on outages).
• Allow and block lists: IPs, CIDR ranges, emails and email domains.
• Trusted customers and store managers are never limited. Monitor-only mode.
• Card-testing orders are flagged with an order note.
• Activity log (30 days), temporary block management, privacy export/erase and suggested privacy-policy text.
• Warcal admin design system: dashboard, activity, blocks, settings, help.

Pro

• Fake-order clean-up: one click, or automatically every day (moved to the trash).
• Weekly "money saved" email report.
• Slack and webhook alerts.
• Disposable-email and country rules.
• Up to 365 days of history and CSV export.
• Licensing through Freemius, with a 14-day trial and no card required.