內容簡介
SazCOD – COD Order Confirmation for WooCommerce 是一款輕量級的外掛，專為解決貨到付款（COD）訂單的確認問題而設計。它能自動攔截包含實體商品的 COD 訂單，並將其設置為「等待確認」狀態，確保商家能有效降低詐騙訂單及錯誤送貨的風險。
【主要功能】
• 零外部依賴：100% 自我託管，無需外部 API 或 SMS 門戶
• WooCommerce HPOS 相容：完全支援高效能訂單儲存
• 智能實體商品檢測：僅攔截需要實體運送的訂單
• 強化的安全架構：使用加密隨機令牌確保安全
• 響應式清晰介面：行動友好的確認畫面
外掛標籤
開發者團隊
② 後台搜尋「SazCOD – COD Order Confirmation for WooCommerce」→ 直接安裝（推薦）
原文外掛簡介
Cash on Delivery (COD) is essential for e-commerce growth in many regions, but fraudulent orders, impulsive checkouts, and wrong delivery addresses cost merchants substantial fulfillment and return shipping fees.
SazCOD – COD Order Confirmation for WooCommerce is a lightweight, 100% self-hosted plugin that automatically intercepts COD orders containing physical goods and places them into a custom status: Awaiting Confirmation.
The buyer receives an actionable confirmation block in their order email. Clicking the link takes the customer to a secure verification screen where they explicitly confirm their order. Once confirmed, the order instantly transitions to Processing so your warehouse can safely begin packing.
Key Features
Zero External Dependencies: 100% self-hosted. No external APIs, SMS gateways, or recurring subscriptions.
WooCommerce HPOS Compatible: Fully compatible with High-Performance Order Storage (custom_order_tables).
Block Checkout & Classic Checkout Support: Intercepts COD orders across both WooCommerce Checkout Block (Store API) and classic shortcode checkouts.
Smart Physical Goods Detection: Only intercepts orders requiring physical shipping; virtual and digital orders pass through normally.
Hardened Token Security Architecture:
Cryptographically random, SHA-256 hashed tokens bound to the unique order.
Encrypted at rest using AEAD AES-256-GCM with order-bound additional authenticated data (v1:{order_id}).
Strict anti-cache headers (Cache-Control: no-store, no-cache) to prevent intermediate caching of confirmation screens.
Synchronized 48-hour WordPress nonce lifetime matching the token TTL.
Pre-commit business guards verifying COD payment method, awaiting-confirm status, and token hash.
Sequential token revocation and native WooCommerce order state machine transitions to eliminate double-confirmation races.
Post/Redirect/Get (PRG) flow with single-use opaque result tokens to eliminate order status enumeration.
Strict Content Security Policy (default-src 'none'), Referrer-Policy, and anti-tampering checks.
Responsive, Clean UI: Mobile-friendly confirmation screen rendered using native styles without heavy frontend libraries.
Privacy Policy
The plugin does not transmit customer order data to external services or third-party servers. It stores only confirmation-related metadata (_qcoc_confirmed_at) in the local WooCommerce order. Customer information displayed on the self-hosted confirmation screen is retrieved directly from the merchant’s local WordPress database.
