Typical delivery is 1 to 2 weeks from confirmation, depending on how custom your rules, gateway and OTP provider integrations are. We build the plugin against your WordPress and WooCommerce versions, install it on a staging or live site, configure your blacklist and risk rules, and confirm it works through real test orders before go-live. You'll get a clear timeline before we start.

The build includes 30 days of post-launch support for bug fixes and configuration tweaks. After that, you own the plugin outright and can run it indefinitely with no per-order or subscription fee. We offer an optional ongoing maintenance arrangement for WooCommerce/WordPress version-compatibility updates, new rules and feature additions — quoted separately based on scope.

Yes. The plugin is built for WooCommerce HPOS (High-Performance Order Storage / custom order tables) and falls back gracefully to legacy post-meta where needed. Because it hooks into standard checkout actions and filters rather than overriding the checkout template, it coexists with most checkout, gateway and shipping plugins. If you use a heavily customized or block-based checkout, we verify compatibility during the build and adjust the hook strategy accordingly.

At checkout, risky or all orders (your choice) can be required to verify a one-time code sent to the customer's phone and/or email before the order is created. For SMS you bring an SMS gateway account (Twilio, your local aggregator, etc.) and we wire it in; email OTP uses your existing WordPress mailer. Codes, retry limits and expiry are stored in custom tables and cleaned up by a scheduled WP-Cron job.

It's built to be precise, not blunt. You decide whether verification applies to every order or only to orders that trip risk signals (blacklist match, VPN/proxy, disposable email, high velocity, prior RTO). Genuine repeat customers can be whitelisted, and the manual review queue lets your team allow a flagged order in one click. We tune thresholds with you during setup so you stop fraud without adding friction for good buyers.

The plugin stores fraud-relevant signals (IP, hashed device fingerprint, verification events) as order/customer meta on your own server — nothing is sent to a third-party SaaS unless you enable an external VPN/disposable-email lookup, which is configurable. Because the data lives in your WordPress database, you control retention; the WP-Cron pruning job can auto-delete old logs to support your GDPR/PDPA retention policy. We'll document exactly what is collected so you can update your privacy notice.