Order risk
Order risk scoring and the review queue
Every ChargeWarden scoring rule with its default points, the score bands and actions (tag, review, hold, cancel), and how to approve or reject orders in one click.
Last updated by the PluginLoom team
ChargeWarden scores each order once, when payment completes or the order first reaches On hold or Processing. The score is the sum of the points of every rule that fired, from 0 to 100, and every point is listed with its reason on the order, in the review queue and in the order note.
Which rules are there?#
| Rule | Fires when | Default points |
|---|---|---|
| Billing and shipping countries differ | The order has a shipping address in another country | 10 |
| IP country differs from billing country | Needs an IP country source (see below) | 15 |
| Disposable email | The email domain is on the bundled disposable-domain list | 20 |
| First order, high value | No earlier paid order with this email, and the total is at or above your high-value amount (default 500) | 15 |
| Many cards tried | 3 or more different cards from this shopper's email, browser or session in 24 hours | 25 |
| Failed attempts before | 2 or more failed payments from this shopper in 24 hours | 10 |
| Tor exit node | IP on the Tor Project exit list (free lists turned on) | 30 |
| Cloud hosting network | IP in a published AWS, Google Cloud, DigitalOcean or Oracle Cloud range (free lists turned on) | 15 |
| Proxy headers | The request carried Via, Forwarded or similar headers | 5 |
| Gateway: elevated risk | The gateway rated the payment elevated | 20 |
| Gateway: highest risk | The gateway rated the payment highest | 40 |
| Gateway: review | The gateway's own rules asked for a review | 25 |
| ACH Signal score high | BankBridge saved a Plaid Signal score at or above your threshold (default 70) | 20 |
| Prior fraud match | Same email, browser or IP as an order you rejected as fraud | 40 |
| Many emails from one IP | 3 or more different emails on orders from one IP in 24 hours | 15 |
| Attack mode | The store was in attack mode when the order was placed | 10 |
Set any rule to 0 points to turn it off (Settings > Order risk > Rule points).
Where does the IP country come from?#
Only from free, local sources. WooCommerce geolocation uses the MaxMind GeoLite2 database when you have added a MaxMind licence key in WooCommerce; ChargeWarden calls it with the outside-API fallback switched off, so no shopper IP leaves your site. CDN country header reads CF-IPCountry and similar headers and is only right when the site really sits behind that CDN.
What are the free IP lists?#
Opt-in (Settings > Order risk). Once a week ChargeWarden downloads the Tor Project exit list (opens in a new tab) and the published ranges of AWS (opens in a new tab), Google Cloud (opens in a new tab), DigitalOcean (opens in a new tab) and Oracle Cloud (opens in a new tab). Checks run on your server. A hosting range is a weak signal (some VPNs and offices use cloud hosting), so it only adds points.
What happens at each score?#
| Band | Default score | Default action |
|---|---|---|
| Low | below 40 | Nothing |
| Review | 40 or more | Add to the review queue with a note |
| Hold | 60 or more | Put a Processing order On hold and add it to the queue |
| Very high | off (0) | Cancel the order, when you set a score |
Actions you can pick for each band: add a note only, add to the review queue, put on hold, or cancel. Cancelling does not refund a captured payment: refund it from the order.
How do I review an order?#
Open ChargeWarden > Review queue. Each row shows the order, its score, every reason and the order status.
- Approve puts a held order back to the status it had before the hold (usually Processing) and adds a note with your name.
- Reject as fraud cancels the order. Tick "block this email, browser and IP" to stop the same shopper next time. A rejected order also feeds the "Prior fraud match" rule.
Shop managers can review by default (capability chargewarden_review_orders). From WP-CLI: wp chargewarden review 123 reject --blocklist.
Can I re-score an order?#
Yes: wp chargewarden score 123 prints the score and reasons and saves them without changing the order. Add --apply to run the band's action too. A decided order keeps its decision.
Can I add my own rule?#
Use the chargewarden_risk_result filter to change the score, band or reasons before they are saved, or chargewarden_gateway_risk to add data from a gateway ChargeWarden does not read yet. See WP-CLI and developer hooks.
Was this page helpful?