Managing the Blocklist
The blocklist lets you flag specific emails, account usernames, IP addresses, phone numbers, cards, or device fingerprints. Each match contributes a fixed number of points to the Blocklist Match rule — email and username 100, device 90, IP 80, phone 60, card 50 — and multiple matches on the same order stack, capped at 100. At the default rule weight of 1.0, a single email or username hit is enough on its own to push an order past the Cancel threshold.
Blocklist entry types
| Type | Example value | Notes |
|---|---|---|
fraudster@example.com |
Exact match against the billing email (case-insensitive). | |
| ip | 192.0.2.1 |
IPv4 or IPv6 address recorded at checkout. |
| phone | +447911123456 |
Billing phone; non-digits stripped before comparison. |
| username | carder99 |
WordPress account username on the order. Skipped for guest checkouts. |
| bin | 4111114242 |
Card BIN (first 6 digits) followed by the last 4 — not the BIN alone. |
| device | a3f8… |
Device fingerprint hash. Copy from the Score detail modal (premium). |
Adding an entry manually
- Go to WooFraudGuard → Blocklist.
- Click Add entry.
- Choose the type, enter the value, and optionally add a reason note for your own records.
- Choose a duration — 1 hour, 1 day, 7 days, 30 days, or permanent. A custom-seconds field is there if you need something in between.
- Click Save.
Automatic blocklisting (premium)
When the Chargeback feedback loop is enabled, an arriving dispute automatically blocklists the buyer’s email and device fingerprint. IP, phone and card (BIN + last 4) are off by default — IPs are shared by ISPs and a BIN covers tens of thousands of cards, so blocklisting them causes false positives — and are opt-in toggles under Settings → Privacy & API keys → Chargeback auto-blocklist. The same panel holds a strike threshold: how many chargebacks must hit the same atom before it is blocklisted (default 1). Auto-created entries are marked source = chargeback_auto so you can distinguish them from manual ones.
Searching and removing entries
- Use the Type dropdown and Search value field to filter down to a specific entry.
- Click the delete icon on any row to remove the entry immediately.
- Expired entries remain visible but do not match new orders — you can delete them to keep the list tidy.
Tips
- After a confirmed chargeback, manually add the billing email and IP before the chargeback feedback loop is enabled — you get immediate protection without waiting for the next webhook event.
- Card entries store the BIN plus the last 4 digits, so they target one card rather than a whole issuing bank — but a BIN typed without the last 4 will never match. Use a short duration either way.
- Device fingerprint blocks are precise and low-risk to add. They target the browser/device profile, not the identity, so a fraudster switching emails is still caught.