Typical delivery is one working week from confirmation, depending on how custom your rules, gateway and OTP provider integrations are. We build the plugin against your WordPress and WooCommerce versions, install it on a staging or live site, configure your blacklist and risk rules, and confirm it works through real test orders before go-live. You'll get a clear timeline before we start.

The build includes two weeks of go-live support for bug fixes and configuration tweaks. After that, you own the plugin outright and can run it indefinitely with no per-order or subscription fee. We offer an optional ongoing maintenance arrangement for WooCommerce/WordPress version-compatibility updates, new rules and feature additions — quoted separately based on scope.

Yes. The plugin is built for WooCommerce HPOS (High-Performance Order Storage / custom order tables) and falls back gracefully to legacy post-meta where needed. Because it hooks into standard checkout actions and filters rather than overriding the checkout template, it coexists with most checkout, gateway and shipping plugins. If you use a heavily customized or block-based checkout, we verify compatibility during the build and adjust the hook strategy accordingly.

At checkout, risky or all orders (your choice) can be required to verify a one-time code sent to the customer's phone and/or email before the order is created. For SMS you bring an SMS gateway account (Twilio, your local aggregator, etc.) and we wire it in; email OTP uses your existing WordPress mailer. Codes, retry limits and expiry are stored in custom tables and cleaned up by a scheduled WP-Cron job.

It's built to be precise, not blunt. You decide whether verification applies to every order or only to orders that trip risk signals (blacklist match, VPN/proxy, disposable email, high velocity, prior RTO). Genuine repeat customers can be whitelisted, and the manual review queue lets your team allow a flagged order in one click. We tune thresholds with you during setup so you stop fraud without adding friction for good buyers.

The plugin stores fraud-relevant signals (IP, hashed device fingerprint, verification events) as order/customer meta on your own server — nothing is sent to a third-party SaaS unless you enable an external VPN/disposable-email lookup, which is configurable. Because the data lives in your WordPress database, you control retention; the WP-Cron pruning job can auto-delete old logs to support your GDPR/PDPA retention policy. We'll document exactly what is collected so you can update your privacy notice.