=== SpoofLens Fraud Check ===
Contributors: spooflens
Tags: fraud, woocommerce, bot, antidetect, multi-account
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Risk score for sign-ups and WooCommerce orders: spoofed browsers, bots, VPNs and several accounts on one device.

== Description ==

SpoofLens Fraud Check asks the SpoofLens API one question when someone registers or places an order: does this visitor look like an honest person in a normal browser?

You get a score from 0 to 100, a verdict and the reasons in plain words, next to each user and order:

* browsers that lie about themselves (a user-agent switch, antidetect browsers, contradictions between the browser, its graphics card, fonts and time zone);
* bots and automated or headless browsers;
* data center, VPN and Tor networks, DNS and WebRTC leaks;
* how many accounts were created on the same device in the last 30 days, the classic sign of promo-code and free-trial abuse.

By default nothing is blocked: you see a "Risk" column in the Users and Orders lists and a note on each order. You can choose to block automated browsers and scores below a threshold. If the API is unavailable, nobody is blocked.

Works with WordPress registration, WooCommerce My Account registration, and both the classic and the block WooCommerce checkout. Compatible with High-Performance Order Storage.

A free key gives 1,000 checks a month during the beta: https://spooflens.com/en/app/api

== Installation ==

1. Install and activate the plugin.
2. Get a free API key at https://spooflens.com/en/app/api
3. Go to Settings > SpoofLens, paste the key, save and press "Test connection".
4. Watch the scores for a week before you turn on any blocking.

== Frequently Asked Questions ==

= Will it block real customers? =

Not unless you tell it to. Blocking is off by default, and the plugin always lets the visitor through when the API cannot be reached.

= What about ad blockers? =

If a blocker stops the collector script, the order or user is marked "not checked". That is not treated as fraud.

= Does it slow down checkout? =

The browser data is collected in the background while the visitor fills the form. The API call itself usually takes 50 to 300 ms and has a 5 second timeout.

= Is customer data sent to SpoofLens? =

See "External services" below. Email addresses are hashed on your server before they are sent.

== External services ==

This plugin relies on the SpoofLens service (https://spooflens.com), operated by SpoofLens.

* On the registration page and on the WooCommerce checkout and My Account pages, the visitor's browser loads https://spooflens.com/v1/sl.js. The script collects technical characteristics the browser reports to websites (system, screen, languages, time zone, fonts, graphics card, canvas, WebGL and audio fingerprints) and connects to edge.spooflens.com and a random name under l.spooflens.com to read the TLS handshake, the DNS resolver and the public WebRTC address.
* When a user registers or an order is placed, your server sends to https://spooflens.com/v1/assess: the collected data, the visitor's IP address and request headers (User-Agent, Accept-Language, Client Hints), and a SHA-256 hash of the email address. The answer (score, verdict, reasons) is stored with the user or order on your site.
* SpoofLens does not store the browser data, the result or the full IP address. It keeps a hash of the device identifier and of the account reference for 30 days to count accounts per device.

SpoofLens privacy policy: https://spooflens.com/en/privacy
Terms of use: https://spooflens.com/developers#terms

== Changelog ==

= 0.1.0 =
* First version: registration and checkout checks, Risk columns, order notes, optional blocking.
