內容簡介
Sarkar IT Fake Order Protector 外掛幫助商家檢視並減少 WooCommerce 的不必要訂單，透過電話格式驗證、重複訂單防護及本地 IP 黑名單管理，提升訂單的真實性與安全性。
【主要功能】
• 驗證孟加拉國電話格式及數字標準化
• 管理本地電話及 IP 黑名單
• 防止在設定時間內重複訂單
• 提供 WhatsApp 支援連結
• 顯示 WooCommerce 訂單的產品及安全資訊
外掛標籤
開發者團隊
② 後台搜尋「Sarkar IT Fake Order Protector」→ 直接安裝（推薦）
原文外掛簡介
Sarkar IT Fake Order Protector helps merchants review and reduce unwanted orders on the WooCommerce classic checkout and Checkout Block.
Validate Bangladeshi phone formats and normalize Bengali digits and country prefixes.
Optionally reject repetitive or sequential number patterns. This heuristic does not verify ownership and can reject real numbers. It is disabled by default for new installations.
Manage local phone and IP blocklists, including CSV import and export.
Prevent repeat orders containing the same product within a configurable interval, using phone or IP matches. Shared IP addresses can affect different customers; staff should review disputed blocks.
Offer WhatsApp support links when customers click them.
Optionally save incomplete checkout details after the customer checks a separate consent box. Capture is disabled by default.
View optional delivery history from configured courier providers after enabling external requests.
Display product and security information in WooCommerce order screens with HPOS support.
Optionally receive low-stock emails and daily dismissible admin reminders, with a paginated inventory list and product edit links. Stock Alerts are off by default and only include published products or variations managing their own stock.
Results do not prove that a customer is fraudulent or guarantee fraud prevention. Review results before making decisions.
Developed by Sarkar IT.
Source: https://github.com/developeralaminvi/advance-fake-order-protector
Scripts, styles and Unicode icons are included locally. No build step is required.
Stock Alerts
Stock Alerts are disabled by default. Turning the switch off disables the inventory list, notices and email checks. This feature does not enable Manage stock, change quantities or replace WooCommerce’s built-in stock notifications.
Only published products and variations with their own Manage stock enabled and a numeric quantity at or below the configured threshold are included. Zero and negative quantities are included. Variations inheriting parent stock are not listed twice; the stock-managing parent appears instead. Draft, private and trashed products, and variations of unpublished parents, are excluded. Variation edit links open the parent product; use the displayed variation name, SKU or ID to locate its inventory settings.
Stock changes queue a background check, and a daily WP-Cron event checks existing low stock. A combined email is sent at most once per site calendar day, while qualifying stock remains low. Emails include up to 100 products with quantities and edit links; the paginated admin list includes all matches. Further stock drops or newly low products after that day’s digest appear immediately in the admin list and in the next day’s email. No email is sent when no products qualify. A failed wp_mail attempt does not mark the day as sent. Actual delivery requires a working WordPress mail setup; WP-Cron checks run when the site receives traffic or its configured system cron runs.
The admin notice lists up to five products with their current quantities, edit links and a link to the full list. Dismissing it hides it for that user for the rest of the site calendar day; it returns on the next day if stock is still low. Restocked products disappear on the next page load. Alerts use the store’s existing WordPress mail service; they do not contact Sarkar IT or courier APIs. WooCommerce may independently send its own stock emails if its built-in notifications are enabled.
External services
Phone validation, local phone/IP blocklists and repeat-order protection do not require an external service or courier account. Courier lookups are optional. The plugin does not send customer information to Sarkar IT.
All courier requests are disabled by default. To use them, a merchant must obtain their own provider credentials, review the policies below, update the store’s customer privacy notice and explicitly enable “Enable external courier requests” in Courier API Settings. Provider subscriptions, fees, permitted uses and rate limits apply separately.
Only logged-in staff with the manage_woocommerce capability and a valid administrative nonce can use the plugin’s courier lookup. Opening a courier report requests data from ALL configured providers, not only the displayed/default provider. The plugin reuses locally cached results until expired; clicking refresh bypasses the cache. Orders-table summaries read the local cache without making external requests. Checkout submission, activation, scheduled cleanup and incomplete checkout capture do not initiate courier requests.
“Check Saved Credentials” is a local field-presence check only. It does not contact any provider, test a phone number, authenticate a key or confirm that live API access works. An authorized order lookup is required to verify live access.
The courier API payloads described below do not include the customer’s name, email, address, cart, payment details or browser IP. As with any server connection, the provider receives the store server’s IP address and normal HTTP connection metadata. Providers handle the data they receive under their own policies. Disabling the setting stops future courier requests; it does not erase information already received by a provider.
BDCourier (BD Courier)
Service and purpose: BDCourier provides customer delivery/return history for merchants verifying a genuine newly received e-commerce order.
Website: https://bdcourier.com/
API destination: POST https://api.bdcourier.com/courier-check
Data sent: the customer’s normalized billing phone number in the JSON phone field, plus the merchant’s own API key in an Authorization: Bearer header.
When sent: after the merchant enables external requests and saves the BDCourier key, when authorized staff open/refresh a courier report and a fresh result is required. No customer number is sent by the local credentials check.
Terms of Service: https://bdcourier.com/terms-of-service
Privacy Policy: https://bdcourier.com/privacy
Use only for new orders awaiting verification, as permitted by BDCourier. Do not use for random number tests, old customer-database screening, marketing, lead generation, recovery-lead screening or bulk/background scans. Each merchant must register directly and use their own API key; this plugin does not provide a shared key, proxy, resale or white-label data service.
Steadfast Courier
Service and purpose: Steadfast Courier provides delivery and return history to help the merchant review an order before shipping.
Website: https://steadfast.com.bd/
API destination: GET https://portal.packzy.com/api/v1/fraud_check/score/{phone}
Data sent: the customer’s normalized billing phone number in the URL path, plus the merchant’s Api-Key and Secret-Key in request headers.
When sent: after the merchant enables external requests and saves both Steadfast credentials, when authorized staff open/refresh a courier report and a fresh result is required. No customer number is sent by the local credentials check.
Terms and Conditions: https://steadfast.com.bd/terms-and-condition
Privacy Policy: https://steadfast.com.bd/privacy
Pathao Courier
Service and purpose: Pathao Courier authenticates the merchant and returns customer delivery ratings/success-rate information.
Website: https://pathao.com/courier/
API destinations: POST /aladdin/api/v1/issue-token and POST /aladdin/api/v1/user/success-rate on the selected host https://api-hermes.pathao.com (production) or https://courier-api-sandbox.pathao.com (sandbox).
Data sent for authentication: merchant client ID, client secret and username/password, or client ID, client secret and refresh token. These authenticate the merchant; they are not customer account credentials. Access/refresh tokens are stored in the site’s options to reuse/renew the connection.
Data sent for a rating lookup: the customer’s normalized billing phone number in the JSON phone field and the merchant’s access token in an Authorization: Bearer header.
When sent: after external requests are enabled and Pathao is configured, when authorized staff open/refresh a courier report and a fresh result is required. Authentication/refresh runs only when that lookup needs a usable token. The local credentials check does not authenticate or contact Pathao.
Merchant Terms of Service: https://pathao.com/terms-of-service-merchant/
Privacy Policy: https://pathao.com/privacy/
Live customer history requires production merchant/API access. Sandbox credentials do not provide production customer history.
WhatsApp (click-to-chat links only)
Service and purpose: WhatsApp opens a conversation with the store’s support number or a customer’s number when a person chooses a WhatsApp recovery action or checkout support link. This plugin does not use the WhatsApp messaging API and does not automatically send messages.
Destination: https://wa.me/{phone}?text={message}
Data sent: the destination phone number and URL-encoded prefilled message. Staff order/recovery links include the customer’s name and, for an order link, the order number in that message; configurable checkout support messages contain the text chosen by the merchant. The visitor’s browser/device contacts WhatsApp and supplies its normal connection information after a click. The person can edit the draft and chooses whether to send it.
When sent: only after a customer or staff member clicks a WhatsApp link. Merely viewing checkout/settings does not load WhatsApp resources.
Terms of Service: https://www.whatsapp.com/legal/terms-of-service
Privacy Policy: https://www.whatsapp.com/legal/privacy-policy
Privacy and data retention
Local blocklists retain phone or IP, reason, administrative username and timestamps until manually removed. Separate order protection history stores order ID, phone, IP, product IDs, total and creation time, and is deleted after two days. Optional incomplete checkout records store name, phone, email, address, city, IP, cart contents, total, status and timestamps only after checkout recovery consent. Leads are retained for the configured 1-365 days (default 30), including converted and recovered records. Courier cache records expire after the configured 1-168 hours (default 24).
Cleanup runs daily through WordPress cron, so removal depends on cron running. Deactivation preserves records and stops cleanup. Uninstall preserves merchant records; remove records through the plugin before uninstalling if no longer needed. WordPress personal data export and erase tools include recovery records matching an email address. Phone/IP-only security records require manual review and removal because an email cannot establish ownership. Adapt the suggested WordPress Privacy Settings text to your actual practices and enabled services.
