README

Ask ProxyCheck.io whether an IP is a proxy, VPN or hosting provider, and whether an email address is disposable.

What it does

Most fraud on a small store arrives from a datacentre IP or a throwaway inbox. ProxyCheck.io answers both, and this wraps its API in something you can call from a checkout without thinking about HTTP: a response object with named methods, and a cache so the same visitor is not looked up on every page.

Features

Tell whether an IP is a proxy, VPN, Tor exit or hosting provider
Get a risk score, and the attack history behind it
Check several addresses in one request rather than one at a time
Tell whether an email address is disposable
Read the country, city and network the address belongs to
Cache answers for as long as you choose, and clear one address on demand

Installation

composer require arraypress/wp-proxycheck

Quick start

Refuse a datacentre IP at checkout, and let everything else through:

use ArrayPress\ProxyCheck\Client;

$client = new Client( $api_key );
$result = $client->check_ip( $ip );

if ( is_wp_error( $result ) ) {
	return; // An API failure is not a reason to lose the order.
}

if ( $result->is_proxy() || $result->is_vpn() ) {
	$order->flag_for_review( $result->get_risk_score() );
}

And the email, before the account is created:

if ( $client->check_email( $email )->is_disposable() ) {
	// ...
}

What it does not do

It does not tell you somebody is a fraudster. A VPN is a privacy tool as often as it is a red flag, and plenty of legitimate customers use one — the score belongs in a decision alongside other signals, not on its own.

Requirements

PHP 8.3 or later
WordPress 7.1 or later
A ProxyCheck.io API key (the free tier is generous)

License

GPL-2.0-or-later

arraypress / wp-proxycheck

Package info

Security

Statistics