WebMe Carding Shield Documentation

Technical Specs

Documentation for WebMe Carding Shield.

Documentation

Documentation for WebMe Carding Shield.

Documentation Home Changelog

User Documentation

Developer

Developer Documentation Technical Specs Testing Strategy

Release

Release Readiness

Planning

Requirements Checkout Hooks Event Table Order Metadata Default Thresholds Security/Privacy

WebMe Carding Shield Technical Specs

Requirements

Requirement	Value
WordPress	6.4+
PHP	7.4+
WooCommerce	8.8+ target, needs final compatibility matrix
External APIs	None for core protection

Checkout Hooks

Flow	Hook	Purpose
Store API	`woocommerce_store_api_rate_limit_options`	Enable/localize Store API rate limiting.
Store API	`woocommerce_store_api_rate_limit_id`	Replace default rate-limit ID with local fingerprint hash.
Store API	`woocommerce_store_api_checkout_update_customer_from_request`	Evaluate risk before draft/order creation in normal checkout POST flow.
Store API	`woocommerce_store_api_checkout_order_processed`	Persist risk metadata and hold orders after order object exists.
Classic	`woocommerce_after_checkout_validation`	Evaluate and block before classic checkout completes.
Classic	`woocommerce_checkout_order_processed`	Persist risk metadata after classic order processing.

Event Table

Table: {prefix}webme_carding_shield_events

Column	Type
`id`	bigint unsigned
`created_at`	datetime
`ip_address`	varchar(45)
`ip_hash`	char(64)
`email_hash`	char(64)
`fingerprint_hash`	char(64)
`event_type`	varchar(40)
`decision`	varchar(20)
`score`	smallint unsigned
`rule_ids`	text
`request_path`	varchar(191)

Indexes:

created_at
ip_hash, created_at
email_hash, created_at
fingerprint_hash, created_at
decision, created_at

Order Metadata

_webme_carding_shield_score
_webme_carding_shield_level
_webme_carding_shield_decision
_webme_carding_shield_rules
_webme_carding_shield_version

Default Thresholds

Setting	Default
IP window	10 minutes
IP threshold	8
Email window	30 minutes
Email threshold	4
Fingerprint threshold	6
Medium risk	40
High risk	70
Retention	14 days
Store API limit	10 per 60 seconds

Security/Privacy

No raw card data handling.
No raw request-body logging.
Email and fingerprint values are HMAC-SHA256 hashed with WordPress salt.
Admin screens require manage_woocommerce.
Settings values are sanitized before storage.