From f9f70e544b4007510e4142740bcd2554b3625412 Mon Sep 17 00:00:00 2001 From: Chris Portscheller Date: Wed, 29 Jul 2026 17:42:53 -0500 Subject: [PATCH] docs(2.3.2): state the WooCommerce fix's limit and the gate coverage honestly The card-testing fix relies on an order being marked paid. Cash on Delivery, Bank Transfer and Cheque never mark an order paid, so on a store using only those gateways the old behaviour persists (issue #60). Monitor mode being the default means it cannot cost an order in this version, but the changelog claimed a fix that does not apply there. Also records the #56-#59 gate coverage and the #57 monitor_mode persistence, which shipped in f2e2a6a without changelog entries. --- changelog.txt | 6 ++++-- readme.txt | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/changelog.txt b/changelog.txt index 9b97d21..20cc3bc 100644 --- a/changelog.txt +++ b/changelog.txt @@ -9,8 +9,10 @@ Safety release. Please update. This version deliberately makes the plugin do LES * Fixed: block expiry was written in UTC and compared against site-local time, so on any site with a UTC offset of +1 or greater a short block was already expired the moment it was written — blocking silently did nothing. All timestamps in the block table are now UTC. * Fixed: a honeypot hit blocked the address permanently, because it was the one path that passed no duration. * Changed: default block duration is now 1 hour, was 24. 93% of hostile addresses are gone within the hour, so a longer default caught almost nothing and mostly risked blocking whoever inherited the address next. -* Fixed (WooCommerce): completed orders counted as card-testing attempts. Three successful sub-$5.00 orders from one address in an hour — the normal profile for digital downloads, donations, tips and add-ons — were classified as an attack. Successful orders no longer count toward card-testing patterns or the checkout velocity limit. -* Changed (WooCommerce): the checkout path now refuses the order and records the detection, and never writes a sitewide IP block. Refusing the checkout is the proportionate response; blocking the whole site from a checkout false positive is not. +* Fixed (WooCommerce): completed orders counted as card-testing attempts. Three successful sub-$5.00 orders from one address in an hour — the normal profile for digital downloads, donations, tips and add-ons — were classified as an attack. Successful orders no longer count toward card-testing patterns or the checkout velocity limit. KNOWN LIMITATION: this relies on an order being marked paid, and Cash on Delivery, Direct Bank Transfer and Cheque never mark an order paid, so on a store using only those gateways the old behaviour persists. Monitor mode means it cannot cost you an order in this version; the underlying fix is tracked as issue #60. +* Changed (WooCommerce): the checkout path now refuses the order and records the detection, and never writes a sitewide IP block. Refusing the checkout is the proportionate response; blocking the whole site from a checkout false positive is not. This covers both the classic checkout and the Blocks / Store API checkout. +* Fixed: monitor mode and the kill switch now apply at EVERY point the plugin can act on a request, not just the rule engine. Previously the WooCommerce checkout, the honeytoken coupon, the challenge interstitial, login, comments and registration all still refused traffic while the admin banner said nothing was blocked — and on a WooCommerce store that could stop orders with no working way to turn it off. +* Fixed: the monitor-mode setting is now stored rather than only defaulted, so the checkbox shows the real state on an upgraded site. Before this, saving any setting silently switched full enforcement on. * Changed: the cross-site actor feed no longer writes addresses into your block table. Measured across the network, only 2 of 4,866 addresses were ever seen at more than one site, 82% of feed entries were already a week stale and none were still active — so blocking on it mostly hit whoever holds the address now. The feed is kept as advisory intelligence. Rows it previously wrote are removed when you upgrade. * Added: `define('WEBDECOY_DISABLE', true);` in wp-config.php stops the plugin acting on the front end, so you can always recover over FTP without database access. * Added: admin notices that say plainly when the plugin is watching rather than acting, and why. diff --git a/readme.txt b/readme.txt index 1b36a2f..d73baff 100644 --- a/readme.txt +++ b/readme.txt @@ -203,8 +203,10 @@ Safety release — please update. This version deliberately makes the plugin do * Fixed: automatic blocks can no longer target loopback, private ranges, a trusted proxy, or your own CDN front door, and can no longer write a range wider than /24 (IPv4) or /48 (IPv6). * Fixed: block expiry was stored in UTC and compared against site-local time, so on sites at UTC+1 or further east a short block expired the instant it was written. * Fixed: a honeypot hit blocked the address permanently instead of for the configured duration. -* Fixed (WooCommerce): three successful sub-$5 orders in an hour were classified as card testing. Completed orders no longer count toward card-testing patterns or the checkout velocity limit. -* Changed (WooCommerce): a suspicious checkout is refused and recorded; it no longer blocks the address across your whole site. +* Fixed (WooCommerce): three successful sub-$5 orders in an hour were classified as card testing. Completed orders no longer count toward card-testing patterns or the checkout velocity limit. Note: stores using only Cash on Delivery, Bank Transfer or Cheque are not covered by this fix yet, because those gateways never mark an order paid — monitor mode means it cannot cost you an order in this version. +* Changed (WooCommerce): a suspicious checkout is refused and recorded; it no longer blocks the address across your whole site. Covers both the classic and the Blocks checkout. +* Fixed: monitor mode and the kill switch now apply everywhere the plugin can act — the checkout, the honeytoken coupon, the challenge page, login, comments and registration all previously kept refusing traffic while the admin said nothing was blocked. +* Fixed: the monitor-mode setting is stored rather than only defaulted, so the checkbox shows the real state and saving another setting no longer switches enforcement on by accident. * Changed: default block duration is 1 hour, was 24. * Changed: the cross-site actor feed is now advisory intelligence and no longer writes to your block list. Rows it previously wrote are removed on upgrade. * Added: `define('WEBDECOY_DISABLE', true);` in wp-config.php as an emergency off switch.