內容簡介
SentinelGuard 是一款專為 WooCommerce 提供的詐騙與結帳保護外掛，能有效阻擋自動化卡片測試機器人、偵測未經授權的支付閘道篡改，並在支付處理器罰款或帳戶禁用之前阻擋虛假訂單，保護商家的收益和結帳流程。
【主要功能】
• 阻擋自動化卡片測試機器人
• 偵測並防範結帳篡改攻擊
• 過濾虛假與垃圾訂單
• 評估支付速度與失敗嘗試
• 強化 Store API 和 REST 端點安全
• 動態商店基準評估
外掛標籤
開發者團隊
② 後台搜尋「SentinelGuard — Fraud & Checkout Protection for WooCommerce」→ 直接安裝（推薦）
原文外掛簡介
SentinelGuard provides targeted fraud and checkout protection for WooCommerce. It stops automated carding bots, defends against Magecart checkout skimmers, detects unauthorized payment gateway tampering, and blocks fake orders before they trigger payment processor fines or account bans.
While general firewalls handle basic network probes, SentinelGuard inspects checkout velocity, payment failure spikes, and Store API endpoints to protect your revenue and checkout pipeline.
Note: SentinelGuard is an application-level ecommerce defense layer. It is built to complement network-level edge WAFs (such as Cloudflare) and payment gateway fraud tools (such as Stripe Radar), not replace them.
Are you experiencing these attacks?
Card Testing Bots: Hundreds of rapid, small, or failed checkout attempts hitting Stripe, PayPal, or Authorize.Net.
Fake & Spam Orders: Automated bot checkouts using fake names, sequential numbers, or disposable email addresses.
High Decline Penalties: Warnings from payment gateways about elevated failure rates threatening your merchant account standing.
Checkout Script Tampering: Malicious JavaScript or Magecart sniffers attempting to harvest cardholder details on payment forms.
Stealth Database Backdoors: Rogue administrator accounts created directly in MySQL that stay invisible in the standard WordPress user list.
Stop WooCommerce Card Testing & Fake Orders
Pre-Gateway Rate Limiting: Evaluates payment velocity and failed attempt clusters before calls reach your payment gateway, eliminating unnecessary authorization fees.
Store API & REST Endpoint Security: Hardens both classic WooCommerce checkout and modern headless/Block checkout endpoints (/wc/store/v1/checkout) against bot floods.
Disposable Email & Velocity Filters: Flags temporary disposable inbox domains and enforces IP/email velocity limits during flash carding spikes.
Dynamic Store Baselines: Evaluates checkout surges against your store’s 60-day historical transaction volume instead of brittle rigid limits.
Checkout Protection & Skimmer Detection
Magecart & Skimmer Scanning: Continuously scans frontend scripts, database options, and active themes for card harvesting regexes, keylogger beacons, and suspicious eval() rotations.
Gateway Credential Integrity: Real-time alarms alert store owners immediately if Stripe API keys, PayPal merchant emails, or payout settings are modified.
Stealth Admin Account Detection: Queries the database directly to uncover shadow admin accounts that hide from the standard WordPress dashboard users screen.
Safe In-Database Quarantine: Isolates suspicious code into encoded database records with one-click restore and zero executable file storage in wp-content/uploads.
Safe Observe Mode: Ships in default Observe mode to record comprehensive threat telemetry without risking false positives on legitimate buyers.
HPOS & WooCommerce Blocks Ready: Native compatibility with High-Performance Order Storage (HPOS) and the Cart/Checkout Blocks architecture.
External Services Disclosure
This plugin uses third-party services to check for vulnerabilities and provide AI-assisted security summaries.
WordPress.org APIs (api.wordpress.org):
Data sent: WP version, plugin/theme slugs & versions.
When: During security scans to verify core checksums.
Terms & Privacy: https://wordpress.org/about/privacy/
Patchstack Vulnerability Database (api.patchstack.com — Optional):
Data sent: WP version, plugin/theme slugs.
When: Only if you enter your Patchstack API key in Settings.
Terms: https://patchstack.com/terms-and-conditions/
Privacy: https://patchstack.com/privacy-policy/
WPScan Database (wpscan.com — Optional):
Data sent: WP version, plugin/theme slugs.
When: Only if you enter your WPScan API key in Settings.
Terms: https://wpscan.com/terms/
Privacy: https://automattic.com/privacy/
OpenAI API (api.openai.com — Optional):
Data sent: Short, flagged code snippets (no user/store data).
When: Only if you enter your OpenAI API key to get plain-English explanations of findings.
Terms: https://openai.com/policies/terms-of-use/
Privacy: https://openai.com/policies/privacy-policy/
Anthropic API (api.anthropic.com — Optional):
Data sent: Short, flagged code snippets.
When: Only if you enter your Anthropic API key.
Terms: https://www.anthropic.com/legal/commercial-terms
Privacy: https://www.anthropic.com/legal/privacy
Google Gemini API (generativelanguage.googleapis.com — Optional):
Data sent: Short, flagged code snippets.
When: Only if you enter your Google Gemini API key.
Terms: https://ai.google.dev/gemini-api/terms
Privacy: https://policies.google.com/privacy
Webhook Notifications (Optional):
Data sent: Alerts (e.g., “Suspicious login detected”).
When: Only if you configure a custom webhook URL (like Slack/Discord).
