Security for WooCommerce

Security for WooCommerce helps store owners control access to their WooCommerce store, restrict selected products and downloads, strengthen administrator login security, and review suspicious file activity. This guide explains how to configure version 2.1.0, test each protection, and troubleshoot common problems without unintentionally blocking legitimate customers.

The extension provides application-level access controls and security tools. It does not replace your hosting provider’s security controls, a dedicated web application firewall, or a service that removes confirmed malware.

Before you begin

↑ Back to top

• Use an active WooCommerce store with Security for WooCommerce version 2.1.0 installed.
• Sign in with a WordPress account that can manage WooCommerce and security settings.
• Back up your website and database before changing access controls, file permissions, or login security.
• Have a separate administrator account or a hosting-level recovery method available before testing login restrictions.
• Use a staging site to test country rules, checkout restrictions, file access, and administrator logins before enabling them on a live store.

1. Install the extension

↑ Back to top

1. Download the Security for WooCommerce ZIP file from your WooCommerce account.
2. In WordPress, go to Plugins > Add New Plugin > Upload Plugin.
3. Choose the ZIP file, select Install Now, and then select Activate Plugin.
4. Open WooCommerce > Security to access the extension’s dashboard.

If WooCommerce is not active, activate it before configuring Security for WooCommerce. The extension also provides access to its settings through WooCommerce’s Integrations area on supported admin screens, but WooCommerce > Security is the main interface for version 2.1.0.

2. Get to know the Security dashboard

↑ Back to top

The Security screen has four main tabs:

• Dashboard: View enabled protections, configuration warnings, recent blocked activity when available, and shortcuts to security tools.
• Malware scan: Run a manual signature scan and review its latest report.
• Settings: Configure traffic, store, download, file, login, scan, and logging controls.
• Activity log: Review recorded rule decisions, filter events, and export results.

On a site that still needs initial configuration, the Dashboard may offer Recommended, Domestic-only checkout, and High security setup presets. A preset changes multiple settings at once; it does not replace reviewing the saved configuration.

3. Configure traffic and country rules

↑ Back to top

Go to WooCommerce > Security > Settings > Traffic & countries.

Enable traffic protection

↑ Back to top

1. Review Store country and select the country where your business is based.
2. Under Blocked countries, select only the countries you intend to restrict.
3. Optionally enter a short Message for blocked visitors. Leave the field blank to use the default message.
4. Review your trusted addresses under Settings > IP rules before turning on restrictions.
5. Enable Traffic protection and select Save changes.
6. Test the store as a logged-out visitor, including product pages, the cart, and checkout.

Traffic protection is the main switch for the extension’s country and traffic IP rules. Saving a country list alone does not enable those rules. The configured store country is excluded from the blocked-country selections as a safeguard against blocking your own business region.

Server IP (detected) is informational. It identifies an address associated with your server, not necessarily the public IP address seen for your own browser. Do not copy it into your trusted IP list unless you have verified what address needs an exception.

Choose a message for blocked visitors

↑ Back to top

Use Message for blocked visitors to explain that the requested store area is unavailable. Keep the message neutral and include an appropriate way to contact your store if necessary. Avoid implying that every blocked visitor is fraudulent; country restrictions can also affect travelers and legitimate customers using VPNs.

4. Restrict cart, checkout, products, and categories

↑ Back to top

Go to WooCommerce > Security > Settings > Store restrictions. These controls are intended for visitors matching your blocked-country rules. Configure countries first, then select the parts of the store you want to restrict.

Limit cart and checkout

↑ Back to top

1. Enable Limit cart and checkout.
2. Confirm the desired countries are selected under Traffic & countries and Traffic protection is enabled.
3. Select Save changes.
4. Test adding a product to the cart and opening checkout from a permitted and a restricted region.

This option is useful when customers may browse your catalog but should not place orders from particular countries. It does not replace WooCommerce shipping zones or payment gateway country restrictions.

Limit product pages by country

↑ Back to top

Enable Limit product pages to restrict single-product pages for visitors from blocked countries. Visitors may still encounter catalog or shop archive listings, depending on the other rules in use. Test the relevant product URLs directly.

Restrict selected product categories

↑ Back to top

1. Enable Category restrictions.
2. Use Categories to restrict to find and select the appropriate WooCommerce product categories.
3. Review the selected categories, then save.
4. Open a restricted category as a logged-out test visitor and confirm that a permitted visitor can still browse it.

Category selections are stored using category IDs, so renaming a category does not normally require choosing it again. This setting differs from blocking a specific individual product.

Block an individual product

↑ Back to top

1. In WordPress, go to Products > All Products and edit the product.
2. Find the Security for WooCommerce product box and its Single Product Blocked control.
3. Choose Blocked and update the product.
4. To restore access, choose Visible and update the product.

The product list also includes a Security Blocked column and bulk actions for blocking or unblocking products. The individual product setting is separate from country-based product restrictions. Administrators and shop managers can continue to view blocked products while managing the store.

Set a daily restricted window

↑ Back to top

Enable Limit orders by time of day, enter Restricted window starts and Restricted window ends, then save. This control applies to visitors matching the relevant blocked-country rules. Confirm the result using a test visitor in the intended country during and outside the restricted period. Use particular caution with windows that cross midnight.

5. Allow or block exact IP addresses

↑ Back to top

Go to WooCommerce > Security > Settings > IP rules.

• Always allow these IPs: Trusted addresses that should bypass country and traffic block rules while Traffic protection is enabled.
• Always block these IPs: Addresses that should be denied while Traffic protection is enabled.

1. Enter one complete IPv4 or IPv6 address per line in the appropriate field.
2. Check for accidental duplicates or an address included in both lists.
3. Select Save changes and test from a network whose public IP you know.

The allow list takes priority when the same address appears on both lists. Only exact IP matches are supported. CIDR ranges, subnet notation, country codes, and hostnames are not valid entries.

6. Protect guest downloads and selected media files

↑ Back to top

Control guest download links by IP

↑ Back to top

Go to WooCommerce > Security > Settings > Downloads. The Guest download IP mode setting has three options:

• No guest download IP restriction: Do not apply the extension’s additional guest download IP filtering.
• Allow all guest downloads except listed IPs: Deny addresses entered in IPs blocked from guest downloads.
• Only allow listed IPs: Permit addresses entered in IPs allowed for guest downloads.

These rules apply to WooCommerce guest download links when the WooCommerce Require login to download option is off. They do not replace an order’s download permissions, expiry dates, or download limits. Both saved IP lists remain available when you change modes, but only the list for the selected mode is enforced.

1. Check the WooCommerce downloadable product settings and whether customers must sign in to download.
2. Select the guest download IP mode appropriate to your store.
3. Enter exact addresses in the field used by that mode.
4. Save and test a valid guest download link from an allowed and a denied connection.

Protect a Media Library attachment from direct access

↑ Back to top

The extension also provides a Prevent Direct Access control for individual attachments in the WordPress Media Library. This is separate from the guest download IP modes above.

1. Go to Media > Library and open the file you want to protect.
2. Find its Prevent Direct Access control and enable protection.
3. Allow the file operation to complete, then reopen the attachment to verify its protection status.
4. Test the file’s direct URL in a private browser window, while logged out of WordPress.

The extension moves selected protected files into a dedicated protected uploads directory and adds rewrite rules intended to limit direct access to supported file types. The behavior depends on the hosting environment, web server, and rewrite configuration. Protecting a file may also affect previously shared URLs or links in page content.

Disable directory listing and discourage indexing

↑ Back to top

Under Settings > Downloads, you can enable Disable directory listing to attempt to prevent a server from displaying bare folder contents. You can also enable Discourage indexing of download URLs to add search-engine signals for protected download locations.

These options depend on the server and search engine behavior. A robots.txt rule or other indexing signal is not an access-control mechanism and cannot guarantee that a previously indexed URL disappears from search results.

7. Configure site hardening and administrator login protection

↑ Back to top

Go to WooCommerce > Security > Settings > Site hardening.

Review file permissions

↑ Back to top

Select File permission report to compare important WordPress files and directories with the permissions recommended by the extension. This report is read-only. If you enable Harden file permissions and save, the extension attempts to apply recommended permissions to the listed paths.

Some hosting providers prevent PHP from changing file permissions. A mismatch in the report does not always mean the site is insecure, and applying permissions without understanding your host’s requirements can interrupt updates or file operations.

Hide WordPress version metadata

↑ Back to top

Enable Hide WordPress version to remove supported WordPress version references from public asset and feed output. Continue updating WordPress, WooCommerce, themes, and plugins; hiding version metadata is not a substitute for installing security updates.

Set up two-factor authentication for administrators

↑ Back to top

1. For each administrator account, open Users > Profile (or edit the administrator’s user profile).
2. Find Two-Factor Authentication Options and select View QR Code & Secret Key.
3. Use a compatible authenticator app to scan the QR code or enter the secret manually.
4. Enter the current code in Authentication Code and select Verify.
5. Confirm the method shows Configured, enable it for the user if needed, and save the profile.
6. After administrator accounts are configured, enable Two-factor authentication (admin) under Security settings and save.
7. Test a new administrator login in a private browser window before ending your original session.

Generating a new secret invalidates codes from the old authenticator configuration once the new secret is verified. Treat the QR code and secret key as sensitive credentials; never include them in screenshots or support tickets.

Add an extra login gate

↑ Back to top

Extra login gate displays a separate username-and-password screen at wp-login.php before the normal WordPress login form. The gate credentials are not your WordPress username or password.

1. Enter a distinct Gate username and a strong Gate password.
2. Save settings to store the gate credentials.
3. Enable Extra login gate and save again.
4. From a private browser window, open your site’s wp-login.php, complete the gate, and confirm the normal WordPress login appears.

If you lose the gate credentials, you may need hosting, SFTP, or database access to recover. An administrator can temporarily disable the plugin by renaming its directory through SFTP, or a qualified administrator can set sfw_passcode_settings to no in the woocommerce_sfw_integrations_settings database option. Ask your host for help rather than making unfamiliar database changes.

8. Run and schedule malware scans

↑ Back to top

Run a manual scan

↑ Back to top

1. Go to WooCommerce > Security > Malware scan.
2. Select Run malware scan now.
3. Review the completed report, including the files scanned and any suspicious indicators.
4. Investigate reported paths and line numbers before changing or deleting anything.

The scanner looks for suspicious code patterns in accessible site files. A match is an indicator for review, not proof of a malware infection. The scanner does not automatically repair infected files or remove malware.

Schedule daily scans

↑ Back to top

1. Go to WooCommerce > Security > Settings > Scans & monitoring.
2. Enable Scheduled malware scans and save.
3. Return to Malware scan to review results after a scheduled run.

Automatic scans use WordPress cron. On sites with little traffic or a disabled or unreliable WP-Cron setup, a scheduled task may run late or not run at all. Ask your host to check scheduled task execution if the latest report does not update.

9. Review security activity and logs

↑ Back to top

Use the Activity log

↑ Back to top

Go to WooCommerce > Security > Activity log to investigate a reported block or see how rules have behaved. The log includes supported events such as country and IP restrictions, product and category access decisions, guest download blocks, and certain configuration actions.

1. Use Date from and Date to to narrow the period.
2. Filter by Event type, Outcome, Target area, country, IP address, reason code, or request path.
3. Review the event outcome and reason before changing a rule.
4. Use Export CSV when you need to share the filtered data with a developer or support agent. Check the file for customer or visitor information before sharing it.

The Activity log also provides retention and cleanup options. Choose a retention period appropriate for your store’s investigation and privacy requirements. Dashboard counts are based on recorded outcomes, not a guarantee that every unwanted request was detected or blocked.

Enable diagnostic logging temporarily

↑ Back to top

For more detailed diagnostics, go to WooCommerce > Security > Settings > Advanced, turn on Debug logging, and save. Reproduce the problem, then inspect the WooCommerce logs for the security-for-woocommerce source under WooCommerce > Status > Logs. Turn Debug logging off when troubleshooting is complete.

10. Test your settings before going live

↑ Back to top

1. Check that an administrator can still sign in and reach WooCommerce > Security.
2. Confirm permitted visitors can browse products, add items to the cart, and complete checkout.
3. Confirm country and product restrictions affect the intended visitors and pages only.
4. Test a known allowed IP and a known blocked IP where practical.
5. Test guest download links and protected file URLs while signed out.
6. Run a manual malware scan and verify its report appears.
7. Review the Activity log for the test events you expect to see.

Troubleshooting

↑ Back to top

A legitimate customer is blocked from the store

↑ Back to top

1. Check Activity log for the customer’s IP, country, request path, and recorded reason.
2. Review Traffic & countries to confirm that the intended country is not blocked.
3. Review IP rules. If an address appears in the block list, remove it when appropriate; add an exact trusted IP only after verifying ownership.
4. Check whether the visitor is using a VPN, corporate proxy, mobile connection, or CDN whose IP or country may differ from their actual location.
5. Temporarily disable Traffic protection only if you need to isolate a traffic-rule problem and can safely make that change.

If an individual product remains blocked after Traffic protection is disabled, check that product’s Single Product Blocked setting. Individual product blocks are managed separately.

A blocked-country visitor can still browse or order

↑ Back to top

Make sure Traffic protection is enabled and saved. Country selection and the Limit cart and checkout, Limit product pages, and Category restrictions settings control different parts of the shopping experience. Check the rule relevant to the action being tested. If the extension cannot reliably identify the visitor’s country, review the Activity log and the Proxycheck notice described below.

My IP rules will not save

↑ Back to top

Enter complete, exact IPv4 or IPv6 addresses with one address per line. Remove CIDR ranges such as 192.0.2.0/24, hostnames, incomplete addresses, and invalid characters. The settings screen can refuse to save until invalid entries are corrected. Check both allow and block lists for overlaps.

Customers cannot access downloadable products

↑ Back to top

Check whether WooCommerce requires login for downloads. The extension’s Guest download IP mode controls guest download links only. Check the selected mode, the list that applies to it, and the visitor’s actual IP. Also review the WooCommerce order’s normal download permissions, expiry, and download limit. If an attachment is separately protected in the Media Library, test that file’s direct-access behavior as well.

A protected Media Library file is still publicly accessible

↑ Back to top

Confirm the file shows as protected, then test its direct URL while logged out. Clear relevant caches and verify that the server honors the extension’s rewrite rules. If you use nginx, a CDN, or custom file delivery, ask your host to review server-level access rules. Do not assume a checkbox alone secures an already-public file URL.

Scheduled scans are missing or a scan fails

↑ Back to top

Confirm Scheduled malware scans is enabled. Run a manual scan to check whether the scanner can execute and save a report. If manual scanning works but scheduled scanning does not, ask your host to verify WP-Cron. For failures, check the scanner report and temporarily enable Debug logging to capture diagnostics. Hosting time and memory limits, inaccessible files, or database write problems can affect scanning.

The dashboard is empty or the Activity log is not ready

↑ Back to top

After installation, open Settings and save once, then reload the Dashboard or Activity log. The log database table may need to finish initialization. If it remains unavailable, check for database permissions or activation errors and contact support with the relevant logs.

I cannot sign in after enabling two-factor authentication

↑ Back to top

Make sure the code comes from the authenticator linked to that administrator’s user profile. Check that the phone’s date and time are correct, because time-based codes depend on accurate clocks. If the authenticator is lost, contact another authorized site administrator or your host to arrange a safe account recovery. Do not send your authenticator secret or working code to support.

I cannot get past the extra login gate

↑ Back to top

Use the separate gate username and password, not your normal WordPress credentials. If they are unavailable, recover access through your hosting provider or SFTP by temporarily disabling the plugin, or have a qualified administrator change the sfw_passcode_settings option to no. Re-enable the gate only after storing and testing the credentials.

I see “Proxycheck API limit exceeded”

↑ Back to top

Version 2.1.0 still uses proxycheck.io lookups to identify visitor countries, with a code-enforced limit of 500 lookup requests per UTC day. The plugin may display an administrator notice and send an email when this limit is reached. It also stores results for previously seen IP addresses.

When the daily cap is reached, the country lookup path does not continue normal restriction processing for that request. Review the extension’s Activity log and verify that country-dependent restrictions are behaving as expected. There is no merchant-facing Proxycheck API key field in the 2.1.0 Security settings. Contact WooCommerce support for assistance rather than assuming that purchasing an external API plan or changing a hidden setting will resolve the issue.

Frequently asked questions

↑ Back to top

Does this extension replace a firewall or malware removal service?

↑ Back to top

No. It provides configurable WooCommerce access controls, administrator login protections, file-related tools, monitoring, and signature scans. It is not a replacement for a host-level firewall, security updates, malware remediation, or secure backups.

Can I allow some countries to browse but prevent checkout?

↑ Back to top

Yes. Select the relevant countries under Blocked countries, then enable Limit cart and checkout instead of applying broader product restrictions. Test the entire checkout flow for the countries you serve and restrict.

Can I block just one product?

↑ Back to top

Yes. Open the product editor and set Single Product Blocked to Blocked. The product list also offers a Security Blocked status column and bulk actions.

Does the IP allow list support IP ranges?

↑ Back to top

No. Enter exact IPv4 or IPv6 addresses. CIDR and subnet ranges are not supported.

Will the Malware scan remove suspicious files?

↑ Back to top

No. Scan results identify possible code indicators for manual investigation. They do not prove an infection or automatically remove files.

Will guest download IP rules affect customers who are required to sign in?

↑ Back to top

These rules target WooCommerce guest download links when login is not required. WooCommerce’s normal download entitlement and login settings continue to apply.

Where can I get support?

↑ Back to top

Visit the Security for WooCommerce Marketplace product page and use its Get support option. Include the plugin version, steps to reproduce the issue, the relevant settings, and sanitized Activity log or WooCommerce diagnostic information. Remove passwords, 2FA secrets, API credentials, and customer personal information before sharing screenshots or logs.