v1.0.4 — Fix REST API bypass, catch failed orders

rafael-minuesa released this 09 Mar 19:03

· 41 commits to main since this release

92c7be6

Fixed

REST API nonce verification restored — Bots were sending fake nonce values to bypass the presence-only check from v1.0.1. Nonces are now properly verified with wp_verify_nonce().
Failed/cancelled orders now analyzed for fraud — Bot card-testing orders always fail at payment, so woocommerce_thankyou never fired. Now hooks into woocommerce_order_status_failed and woocommerce_order_status_cancelled to catch these.

Added

REST API hardening setting — New toggle in Detection Rules tab (defaults to enabled). Previously was always-on with no UI visibility.

Full Changelog: v1.0.3...v1.0.4

Assets 3