Customer Blocklist for WooCommerce

Some customers you do not want to serve again. PluginCity Customer Blocklist for WooCommerce lets you block an email address, a whole email domain, a phone number, a postal address, an IP address or a customer account, and refuses their order at the classic checkout, at the Checkout block, and on PayPal's express buttons. The pay page for an existing order is refused too.

You write the message they see. Add a customer to the blocklist from their order with one click, and keep a log of blocked attempts for as many days as you choose, up to a year. It turns away repeat problem customers. It does not detect fraud for you.

A blocklist entry can be an email address, a whole email domain, a wildcard pattern such as bot-*@example.com, a phone number, a postal address, an IP address, a range of IP addresses or a customer account. A domain such as mailinator.com can be blocked. A mail service used by millions, such as gmail.com, cannot, because that would turn away far more than one customer: block that customer's address instead.

The list is matched the way a person would match it, not the way a computer compares text. Dots and plus tags in a Gmail address, capital letters, stray spaces, hidden characters, brackets in a phone number and "St." for "Street" all come out the same, so the easy ways round a list do not work. A genuinely different address is still a different address, so block the phone number, the postal address or the IP address as well to catch someone who changes one detail.

A blocked customer is refused at the classic checkout and at the Checkout block, whether they are a guest or signed in, and on the pay page for an order that already exists. Where a payment method builds its order through WooCommerce's checkout or the Store API, it is refused there like any other. PayPal's express buttons are refused when pressed by someone the shop already knows, such as a signed-in customer. For a guest the shop learns who is paying only when PayPal says so, and the order is refused then, before any payment is taken. Any other code that builds an order for a customer is stopped before a payment can be taken, and the order is removed. Orders you or your staff create in wp-admin, through the REST API with a staff key or from the command line are never blocked.

The customer reads one neutral sentence that you write, the same whichever detail matched. It never says which detail matched, so it never tells anyone which of their details to change. Blocked email addresses and IP addresses can also be stopped from registering an account, and you can add a customer to the blocklist from their order with one click. Blocked attempts are logged, and the log is deleted after the number of days you choose. The whole blocklist can be imported and exported as a CSV file.

An IP address can be shared by a whole office or a mobile network, so it starts unticked when you add from an order. Whether it sees the right address depends on how your shop reads IP addresses: behind a proxy or content delivery network, leave IP reading on WooCommerce's setting, and on a shop with neither, choose the connection only, because the other setting trusts headers a visitor can write.

A blocklist is personal data: it holds email addresses, phone numbers, postal addresses and IP addresses of named people. It stays on your own website and is sent nowhere. The plugin adds wording for your privacy policy and joins the WordPress export and erasure tools. Erasing someone removes them from the log and leaves their blocklist entry, which you may be entitled to keep to protect your shop, and which you can remove yourself.

Pro lets a match do less than refuse. For each kind of entry you choose whether to turn the customer away, hold the order for review, or let it through with a note. A held order is put On hold with a note saying why, and stays on hold, whatever a payment gateway does afterwards, until you release it from the order screen or from the Held orders list with one click. The customer is let through to pay, so payment is taken or not as your gateway decides, so if you would rather not take the money at all, leave that kind of entry on turn them away. On hold is the only status offered. Awaiting payment is not, because a gateway would still take the money.

Pro can also score customers on risk. You give each sign of trouble a number of points (refunded and cancelled orders, chargebacks you record, failed payments, disposable email addresses, billing and shipping in different countries, and large orders) and set three lines: the points at which an order is flagged, held, or the customer is turned away. A sign worth nought is not looked for. Counts come from the customer's earlier orders with the same email address or account. These are points you set yourself and nothing is asked of any outside service, and the list of disposable email domains ships with the plugin. WooCommerce has no chargeback status of its own, so a chargeback is an order you mark with Record a chargeback, and nothing is guessed from a gateway's notes. Risk scoring and automatic blocking both start switched off.

Automatic blocking adds a customer to the blocklist after a full refund, a recorded chargeback or too many cancellations. If you use Order Cancellation for WooCommerce, it can count only the cancellations made through that plugin. If you do not, it counts every cancelled order except unpaid orders that WooCommerce cancelled on its own clock. It does not need Order Cancellation.

A block can end by itself. Choose how long when you add an entry, or set a number of days for automatic blocks, and the entry stops counting the moment its time is up. Each entry can carry a reason. An audit log records every addition, removal, hold and release and who did it, and the shop manager can be emailed about them. Entries can be imported, listed and removed over the REST API, up to 500 entries in a request, and a CSV file can be imported with WP-CLI. Pro's own settings travel with the settings export.

If a Pro licence lapses, nothing is deleted and nothing breaks. Pro's settings, reasons and audit log stay saved and on screen, where you can read them but not change them, and anyone on the blocklist goes back to being turned away. Orders already on hold stay on hold until you release them, and you can release them while the licence is lapsed. Temporary blocks stop ending by themselves, so an entry set to expire stays on the list until you remove it. Renewing switches it all back on exactly as you left it.