Getting started
Getting started with ChargeWarden
Install ChargeWarden on WooCommerce, run the five-step setup wizard and check that your checkout is protected. What you need before you start.
Last updated by the PluginLoom team
ChargeWarden installs like any WordPress plugin and protects your checkout as soon as it is active. The setup wizard takes about three minutes and lets you choose a protection level, an optional challenge, what happens to risky orders and where alerts go.
What do I need?#
| Item | Requirement |
|---|---|
| WordPress | 6.0 or newer |
| PHP | 7.4 or newer (8.3 recommended) |
| WooCommerce | 8.0 or newer, classic checkout or Checkout block, HPOS or legacy order storage |
| Paid services | None. Cloudflare Turnstile or hCaptcha keys are optional |
| ACH monitoring | BankBridge with Plaid Transfer |
How do I install it?#
- In WordPress, go to Plugins > Add New > Upload Plugin and upload the ChargeWarden zip.
- Click Activate. You are taken to the setup wizard.
- Activate your license key in ChargeWarden > Tools > License to get updates and support. The plugin works without one.
What does the setup wizard ask?#
| Step | What you choose |
|---|---|
| 1. Protection level | Balanced (recommended), Strict or Relaxed limits; whether to also turn on WooCommerce's own "Rate limit Checkout" feature; where to read the shopper IP |
| 2. Challenge | Optional Cloudflare Turnstile or hCaptcha keys |
| 3. Risky orders | What happens at the review and hold scores, the high-value amount, and the optional free IP lists |
| 4. ACH and scripts | Company and bank names for the ACH report; payment page script monitoring on or off |
| 5. Alerts | The email address for alerts |
You can change every answer later in ChargeWarden > Settings.
Where does the shopper IP come from?#
Keep Direct connection unless your site really sits behind Cloudflare or another proxy you control. Proxy headers such as X-Forwarded-For can be typed by anyone, so trusting them on a site that is not behind that proxy lets an attacker dodge every per-IP limit. The wizard tells you if it saw a Cloudflare or proxy header on your own request.
How do I check it works?#
- Open ChargeWarden > Dashboard. "Card-testing defence on" and "Order scoring on" should be green.
- Run ChargeWarden > Tools > Run self-test, or
wp chargewarden selftest. Every line should say PASS. - Visit your checkout with something in the cart. Payment page scripts fills in with the scripts it found.
- Place a test order. It appears in the orders list with a score in the Risk column.
What next?#
Was this page helpful?