Stop fraud before it ships.
Real-time, white-box fraud decisions for WooCommerce. See every signal, control every rule, and stop chargebacks before they ship — with your customer data staying on your own server.
Free core plugin · Self-hosted & GDPR-friendly · Real-time, no checkout friction
Trusted by growing WooCommerce stores
Real merchants using WPSentinel to stop fraud — without a black box.
Every fraudulent order costs you twice
You lose the product and pay the chargeback fee. Then your processor flags your store. Manual review eats hours — and you still guess.
Chargebacks pile up
You ship the order, then weeks later the buyer disputes it. Money gone, goods gone, fee charged.
Manual review is guesswork
A strange order comes in. Is it fraud or a good customer? You have an email and a gut feeling.
Black-box tools hide the “why”
A score says “risky” but never tells you what triggered it — so you cannot trust it or improve it.
What WPSentinel checks — in real time
Every session and order is scored the moment it happens, from a stack of signals you can see and weight yourself.
Real-time decisioning
Accept, review, or reject is decided live — before the order is fulfilled. No batch delay.
IP geolocation
Locate the buyer by IP and compare it to the billing and shipping address for mismatches.
TOR / proxy / VPN detection
Flag connections hiding behind anonymising networks — a classic fraud signal.
Device fingerprinting
Recognise the device behind an order and link it to other sessions, even across accounts.
Email breach evaluation
Check whether the customer email appears in known data breaches to gauge account-takeover risk.
Address location & visualization
Evaluate and map the shipping address so you can spot impossible or high-risk destinations.
One dashboard. Every decision.
Evaluations, active rules, average score, and recent alerts — all at a glance.
Who it’s for
WooCommerce merchants
Stores losing money to chargebacks and fake orders who want fraud stopped before fulfilment — no code.
Operators who want control
Teams that need to read, defend, and tune every fraud decision instead of trusting a black box.
Agencies & data-conscious shops
Builders who need self-hosted, GDPR-friendly fraud tooling they can stand behind for clients.
A rule engine you can actually read
No black box. Build and edit rules in a user-friendly engine, combine any signal — IP, device, email, address, velocity — and see exactly which rule fired on every decision.
- White-box: every decision is explainable and auditable
- User-friendly builder — no code required
- Weight signals and set your own thresholds
Investigate like a detective
A built-in graph database links the email, IP, device, and address behind an order. Pivot from any node, expand multiple levels, and uncover the rings and repeat offenders behind a single fraudulent order.
- Pivot and expand across linked sessions
- Multi-level nodes for deep investigation
- Tag sessions: under review, fraud, false positive
Decide, tag, and stay in control
WPSentinel hands you the evidence and the controls — you make the call, and it remembers every one.
Session tagging
Label sessions “under review”, “fraud”, or “false positive” to train your process and clean up your data.
Previous-session replay
Test a new rule against real past traffic to see what it would have caught — before it touches a live order.
Dynamic API attributes PRO
Pull live external signals into your rules via dynamic API attribute collection. Available on Pro.
Built for the WooCommerce workflow you already use
The risk data lives inside the order you are already looking at — no separate dashboard to learn.
Automatic order decision PRO
On Pro, map the risk score straight to WooCommerce order status so risky orders route themselves. Manual one-click accept/reject is always free.
Investigate from the order
Jump from any order to its full session forensics with a single link.
One-click accept / reject
Approve to keep processing or reject to cancel and notify the customer — right from the order screen.
Why teams choose WPSentinel
White-box, not black box
Every score is explainable. You own the logic and can defend any decision.
Your data stays yours
Self-hosted on your server. GDPR-friendly by design — even the device-ID consortium is GDPR-compliant.
Real-time, zero friction
Decisions happen live in the background. Shoppers notice nothing.
Tune without risk
Replay any rule change against real past orders to measure its exact impact before it goes live. Tag sessions as fraud or false positive to sharpen your rules over time, and watch your false-positive rate with every adjustment — so you cut fraud without ever blocking good customers.
Live in minutes. Working in the background.
1 · Install
WPSentinel + the Fingerprint Collector + the WooCommerce add-on. Activate. Done.
2 · Scan
Every visit and order is fingerprinted and scored in real time — no checkout friction.
3 · Decide
Risky orders surface with the evidence. Accept or reject in one click.
How WPSentinel compares
A white-box, self-hosted alternative to black-box fraud services.
| Capability | WPSentinel | Typical black-box fraud SaaS |
|---|---|---|
| Explainable decisions | Yes — white-box rules | No — opaque score |
| Where your data lives | Your own server | Third-party cloud |
| Investigation | Graph forensics (pivot) | Limited or none |
| Rule control | Full, no-code | Vendor-controlled |
| Test before live | Session replay | Rarely |
| Pricing | Free + €19.99/mo flat | % of revenue or per-order |
Start free. Go Pro for €19.99/month.
The full real-time engine, rules, forensics and replay are free. Pro adds dynamic API attributes and the GDPR-compliant device-ID consortium.
Frequently asked questions
- What does “white-box” mean? You see and control every rule and signal behind a decision — no opaque machine-learning score you cannot question or audit.
- Does WPSentinel slow down my checkout? No. Scoring runs in real time in the background; shoppers see no extra steps.
- Where is my customer data stored? On your own WordPress server. WPSentinel is self-hosted. The optional device-ID consortium is GDPR-compliant.
- Do I need to know how to code? No. The rule engine is user-friendly. Developers can go further with dynamic API attributes (Pro).
- Will it block real customers? It flags, you decide. Tag sessions, replay rules on past traffic, and tune before anything goes live.
- What is in the Pro plan? Everything in Free plus dynamic API attribute collection, the GDPR-compliant device-ID consortium, and priority support — €19.99/month excl. VAT.
Stop guessing. Start scoring.
Install WPSentinel free and see the risk — and the reason — on your next order.
Free core · Self-hosted · WooCommerce 8.0+