This guide will show you how to use Checkout Origin Guard<\/strong> and explain what each setting does.<\/p>\n\n\n\n These options harden the checkout process against automated scripts and \u201cdrive-by\u201d bots.<\/p>\n\n\n\n This module catches orders with suspicious or junk data in the Company<\/strong> field.<\/p>\n\n\n\n Every time a checkout is blocked, Checkout Origin Guard<\/strong> records the details:<\/p>\n\n\n\n You can view the most recent 200 entries right on the settings page. If you want to clear them out, click Purge Logs<\/strong>.<\/p>\n\n\n\n Unlike generic anti-spam plugins, Checkout Origin Guard is built specifically for WooCommerce checkout. It\u2019s lightweight, requires no external service, and defends against the real patterns bots use:<\/p>\n\n\n\n With it in place, you\u2019ll spend less time dealing with fake orders and more time focusing on real customers.<\/p>\n\n\n\n
\n\n\n\nGetting Started<\/h2>\n\n\n\n
\n
\n\n\n\nOrigin Guard Settings<\/h2>\n\n\n\n
\n
Turns the entire origin validation system on or off.<\/li>\n\n\n\n
Forces a short \u201cthink time\u201d before checkout can be submitted. Bots usually rush; real customers take at least a few seconds. Default is 8 seconds.<\/li>\n\n\n\n
Caps how many checkout attempts a single IP can make within a time window. For example, 6 \/ 600<\/code> means 6 attempts every 600 seconds (10 minutes). If exceeded, new checkouts are blocked until the window resets.<\/li>\n\n\n\n
Ensures the checkout form was submitted from your own site. Many bots post directly to \/?wc-ajax=checkout<\/code> without ever visiting your pages.<\/li>\n\n\n\n
Adds a hidden JavaScript nonce field to the checkout form. Since most bots don\u2019t execute JS, this weeds them out.<\/li>\n<\/ul>\n\n\n\n
\n\n\n\nCompany Name Guard<\/h2>\n\n\n\n
\n
Enables validation on the company name field.<\/li>\n\n\n\n
Rejects names that are too short (e.g., \u201cx\u201d or \u201c-\u201d).<\/li>\n\n\n\n
Measures how many letters are in the name compared to symbols or numbers. For example, a ratio of 0.5<\/code> means at least half of the characters must be letters. This blocks garbage like !!!###@@@<\/code>.<\/li>\n\n\n\n
Add trusted company names here (one per line). Any order from a whitelisted company will always pass validation, even if it doesn\u2019t meet the other rules.<\/li>\n<\/ul>\n\n\n\n
\n\n\n\nLogs<\/h2>\n\n\n\n
\n
\n\n\n\nBest Practices<\/h2>\n\n\n\n
\n
8s dwell, 6\/600 rate limit, referrer & JS proof enabled<\/code>).<\/li>\n\n\n\n
\n\n\n\nWhy Use Checkout Origin Guard?<\/h2>\n\n\n\n
\n
\n\n\n\n\ud83d\udc49 Ready to protect your store?<\/h1>\n\n\n
![\"Checkout](\"https:\/\/wcog.michaelwinchester.com\/wcog\/wp-content\/uploads\/2025\/10\/icon-256x256-1.png\"){kind=icon}
<\/figure>\n<\/div>\n\n\n