CheckoutOTP

1. Introduction

CheckoutOTP adds an email verification layer before customers reach the WooCommerce checkout. The buyer enters their email, receives a 6-digit code and confirms it. Only then can they complete the purchase.

With it you can:

• Block fake orders, spam and bots using made-up emails.
• Ensure the billing email is real and belongs to the buyer.
• Reduce refunds, chargebacks and fraud.
• Keep a clean email list for your marketing campaigns.

2. Requirements

• WooCommerce must be active. Without it, the plugin shows a notice and its logic is not enabled.
• A server able to send emails (ideally with an SMTP plugin configured; see Troubleshooting).

3. Installation

1. Download the checkoutotp.zip package.
2. In WordPress go to Plugins → Add New → Upload Plugin.
3. Select the .zip file, click Install Now, then Activate.
4. On activation, the plugin automatically creates its tables and default settings.

4. Initial Setup

Verification happens on a page of your site that contains a shortcode. You only need one page for this.

Step 1 — Create the verification page

1. Go to Pages → Add New.
2. Give it a title, for example Order Verification.
3. In the content, add this shortcode:

[checkoutotp_form]

4. Publish the page.

Step 2 — Set the basic values

In WooCommerce → CheckoutOTP → Settings review, at minimum:

• OTP Expiry Time: how many minutes the code is valid (15 by default).
• Admin Notification Recipients: emails that will receive security alerts.
• Notify When User is Blocked and Notify on Multiple Failed Attempts: enable them if you want alerts.

Step 3 — Test

1. In an incognito window, add a product to the cart and go to checkout.
2. You should be redirected to the verification page.
3. Enter your email, receive the code and confirm it.
4. Once verified, you return to checkout with the email locked and can complete the purchase.

5. How It Works

The customer journey

1. The customer adds products to the cart and tries to enter checkout.
2. The plugin redirects them to the verification page ([checkoutotp_form]).
3. They enter their email and click send → they receive a 6-digit code by email.
4. They enter the code. If correct, they are verified.
5. They return to checkout: their email appears fixed and read-only.
6. They complete the purchase.

When verification is remembered

Emergency mode

If email delivery fails, Emergency Mode temporarily disables verification so you do not lose sales. Use it only as a one-off fix and disable it as soon as possible.

6. The CheckoutOTP Panel

Everything is managed from WooCommerce → CheckoutOTP. The panel has these tabs:

7. Configuration Options

General OTP Settings

Express Checkout Protection

Hides express payment buttons (PayPal, Google Pay, Apple Pay, Stripe…) from customers who are not yet verified, so they cannot skip verification.

Security Notifications

REST API Security

Configurable Block Lists

Data Maintenance

Design & Colors

Customize the look of the verification form:

8. Emails & Customization

The OTP code is sent as a WooCommerce email, so it appears in WooCommerce → Settings → Emails under the name CheckoutOTP. From there you can change the subject, heading and footer, and even disable it.

Email templates

The plugin includes two templates:

• templates/emails/checkoutotp-otp.php — HTML version.
• templates/emails/plain/checkoutotp-otp.php — plain text version.

your-theme/woocommerce/emails/checkoutotp-otp.php

9. Compatibility

10. Troubleshooting

The code emails are not arriving

• Sending relies on WordPress wp_mail(). If your server is not properly configured, install an SMTP plugin (WP Mail SMTP, Post SMTP, etc.) and test it.
• Check the recipient's spam folder.
• Make sure the CheckoutOTP email template is active in WooCommerce → Settings → Emails.
• As a last resort, enable Emergency Mode so you do not block sales while you fix email.

The recorded IP is not the customer's (site behind Cloudflare)

Enable the 🌐 Site Behind Proxy/CDN option. Only if your site is actually behind Cloudflare or a proxy/CDN.

The customer still sees checkout without verifying (caching)

• The plugin sends "no-cache" headers, but some caching plugins ignore them.
• Exclude the checkout and verification pages from your cache.

The express payment buttons are not hidden

• Enable Strict Mode.
• If they still appear, add their CSS selector under Custom CSS Selectors.

A legitimate customer got blocked

Go to the 🚫 Blocked Emails tab and click Unblock on their row. Blocks also expire on their own according to the configured duration.

The "Verification" column shows "Not verified"

It means that order was created without a recorded verification (for example, a manual order created by the administrator, or created before installing the plugin). This is the correct behavior.

11. FAQ

Does it work with the block checkout?

Yes. Verification, email locking and server-side validation work on both classic and block checkout.

Can I use guest checkout (no account)?

Yes. Guests verify the same way, using a signed cookie.

Is the customer asked for the code on every purchase?

No. Everyone (administrators, existing customers, newly registered accounts) verifies only once on their next checkout. After that, they are remembered (account: permanently; guest: 7 or 30-day cookie). To force a new verification, a guest only needs to wait for the cookie to expire; on an account, you would need to remove the user's verification mark (advanced).

Can I change the verification page?

Yes, any page containing the [checkoutotp_form] shortcode. The plugin detects it automatically.

What happens if I have two or more pages with the shortcode?

The plugin always redirects to the most recent one. The others still show the form if visited directly, but they are not the redirect target. Recommendation: use a single active page with the shortcode and leave the others as draft or trash.

What happens if an attacker tries many codes?

Each code allows a limited number of attempts. In addition, the plugin counts failures per email and temporarily blocks the address once the configured threshold is exceeded.

Does the plugin slow down the store?

No. It only acts on the checkout and verification pages and adds no heavy queries to the rest of the site.

12. Changelog

1.3.0

• Express Checkout hiding CSS now only loads on checkout, cart, product and verification pages.
• New setting: Maximum OTP Sends Per Hour (configurable rate limit for code requests).
• Custom block-list regex patterns are validated on save with a clear admin warning; invalid patterns are discarded.
• Removed unused legacy OTP database methods and table (OTPs use transients).
• Blocks (Store API) checkout errors now return a proper 403 instead of a generic 500.
• Security block events (email mismatch, express bypass) are also listed in the History tab.
• Emergency Mode changes (activation and deactivation) are logged on state change.

1.2.2

• Included translations: Spanish, Portuguese (Brazil) and French, plus the .pot template to add more languages.

1.2.1

• Removed unused legacy code (an old email class and an old verifier).
• Documentation updated to the real state.

1.2.0

• Temporary email blocking after repeated failures, with configurable threshold and duration.
• "Blocked Emails" tab with manual unblock.
• Admin notifications with the full email address.
• "Verification" column with real per-order status (Verified / Not verified).
• Email field locking also on the block checkout.

1.1.0

• Security fixes (real IP, hardened cookies, PayPal protection, cache without PII).

1.0.0

• Initial version: pre-checkout OTP verification, bot blocking, logs and notifications.

13. Privacy & Data

CheckoutOTP keeps its data in your own WordPress database, so you stay in control of it. This is what it handles:

• Email address entered by the customer to receive the code, and the emails temporarily blocked after repeated failures (Blocked Emails tab).
• IP address, used for rate limits and security checks.
• OTP code, stored only as a SHA-256 hash and valid only for the configured expiry time (15 minutes by default).
• Verification status: for registered customers it is saved in their user metadata; for guests, in a signed cookie (7 days, or 30 if they choose "remember me").
• Security log (History tab): events such as sends, verifications, failures and blocks, which may include the email and IP address involved.

Retention and deletion

• With Auto Purge Logs enabled, old records are deleted automatically after the retention period (30 days by default, configurable from 7 to 365).
• Blocked emails are released automatically after the configured block duration, or manually from the Blocked Emails tab.
• If you delete the plugin from WordPress (not just deactivate it), all its data is removed: settings, tables, user metadata, session cookies and scheduled tasks.

14. Support

If you have questions or issues, open a ticket in our support center including the plugin version, the WordPress/WooCommerce version and a description of the problem.

• Support center: innovedia.pro/support
• Author: Innovedia Pro
• Website: innovedia.pro