=== Fraud Detector Connector ===
Contributors: getanddo
Plugin URI: https://getanddo.com/fraud-detector/
Tags: fraud, security, woocommerce, monitoring
Requires at least: 6.0
Tested up to: 6.8
Requires PHP: 7.4
Stable tag: 1.3.2
License: Proprietary

Learns your store's normal, shows the requests, logins and orders that stand apart, and lets you stop them. Free forever. No rule lists.

== Description ==
**Fraud Detector knows your store.** It learns what normal looks like on your WooCommerce site, shows you the first request, login,
coupon or order that stands apart, and lets you stop it. No rule lists to maintain. No examples of the fraud needed. Free forever for
one store, no card, and your first 30 days run on Pro.

**What it does**

* Learns your store's normal, not the world's: every page request, login attempt, registration, cart addition, coupon, checkout step, order, failed payment and refund is read against what your site usually does. Something new for your site is a finding even if nobody has seen it anywhere else.
* Findings with the receipts: each says what stood apart in plain words (a burst of requests, a run of failures, a client the site has never seen, an order unlike the store's orders), plus any known attack shape it matched (today: anomalous requests and brute-force login runs; new shapes reach every plan the day they are ready).
* Stop it from the dashboard: block a client for an hour, a day or until you lift it; optional automatic blocking after a run of findings. A logged-in site manager is never blocked.
* Allow what you know: allow-list any client, path, event, signal or shape with one click. Allowed findings stay visible but never count.
* See the learning: a countdown to the 500 events the service needs, the events it is learning from (busiest clients first), and the power to remove a bot flood from the learning set so it is never learned as normal.
* Live events every three seconds; every tile opens the events behind its count.
* Your events stay yours: sent events are kept on your own server in a compressed local log (about ten times smaller than the rows) with a roll by days and a size cap you set.
* Analytics with drill-downs on Pro and Business: counts by client, path, event, area, response, user agent or method over 24 hours, 7 or 30 days, every bar opening its events.
* Tell a friend: your link carries a referral code; when a store connects through it you and its owner each get a month of Pro.

**What it catches.** The detection engine behind the service was measured on public research corpora where the answers are known,
seeing only normal activity and never an example of the attack: about 97% of insider-threat activity at under 1% of normal flagged,
about 81% of account takeovers at 0.5%, about 97% of network intrusions at 1%, about 99% of brute-force login traffic at 0.15%,
about 91% of industrial process faults at 1%. These numbers are approximate, come from public corpora under a held-out protocol,
and are not results on any WooCommerce store; your results depend on your traffic, your history and your rules, and nothing here
is a guarantee of detection.

**Privacy.** What leaves your site: the request line, the response code, the client address, the user agent, the event kind, and
one-way hashes of the account, session, e-mail domain and payment method. Never a name, an e-mail address, a password, a card number,
an address or an order's contents. The service keeps three days of your events to know your normal; you can see and prune that set.

Run it alongside your firewall and malware scanner: it is neither, it is the part they do not do. Requires a Fraud Detector account
(service URL and API key). Sends data to the Fraud Detector service at the address you configure.

== Installation ==
1. Upload the plugin folder to wp-content/plugins and activate it.
2. Fraud Detector > Settings: enable, enter the service URL and your API key, save.
3. Fraud Detector > Dashboard > Test connection.

== Changelog ==
= 1.3.2 =
Plugin site is now getanddo.com/fraud-detector; author is GETandDO Corporation. No functional change.

= 1.3.1 =
Plan caps of record: local log Free 1 day / 2 MB, Pro 30 days / 50 MB, Business and Agency 365 days / 500 MB (default 1 day,
2 MB). Requests stopped by a block rule are written to the local log only: they are never sent to the service and never count
against the plan's events. The plan line states the Free plan's findings delay (findings arrive a day after the service saw
them; paid plans see them at once). Agency plan recognised.

= 1.3.0 =
Sent events are kept on the site's own server in a compressed local log (one block per minute; roll by days and by size under
Settings, defaults 1 day and 20 MB, capped by the plan: Free 1 day / 20 MB, Pro 30 days / 500 MB, Business 365 days / 5 GB).
Live events card refreshed every 3 seconds. Every tile opens the list of events or findings behind its count. Analytics card
(Pro and Business): counts by client, path, event, area, response, user agent or method over 24 h / 7 days / 30 days, each bar
opening the events behind it.
= 1.2.0 =
Learning countdown on the status line (events seen of the events the service needs, time to go at the current rate); the learning
set is shown (busiest clients, events newest first) and events can be removed from it, by selection or by client, never all at once. Allow rules (client, path, event, signal, known shape; findings that match are kept and marked allowed, never counted), block rules
(client address answered 403 until the rule expires; site managers who are logged in are never blocked), optional automatic blocking,
tiles for requests stopped and findings allowed, state filter, plan and monthly usage on the dashboard, tell-a-friend link with a referral code.
= 1.1.0 =
Registrations, coupons, refunds, admin actions and API auth failures are recorded; orders carry facts (size bucket, item
count, address mismatch, first order) and one-way hashes of account, session and payment method; findings show known shapes.
= 1.0.0 =
First release.
