Why This Exists
Signifyd supports Magento 2, Salesforce Commerce Cloud, and BigCommerce, and leaves WooCommerce out. Stores running WooCommerce with a Signifyd contract have to write their own client against the REST API or screen orders by hand. We hit that gap running a WooCommerce store that was taking chargebacks, wrote the integration, ran it in production, and released it under GPL rather than leaving it in one client's site.
What It Does
- Creates a Signifyd case automatically when an eligible order is paid, built from the order server-side.
- Verifies inbound webhooks with HMAC-SHA256 before trusting them, then stores the risk score and guarantee disposition on the order.
- Adds an order-screen panel for staff: view the case, refresh it, close it, or purchase Signifyd's financial guarantee.
- Maps payment-gateway meta through a filter, so it is not locked to one gateway.
- Works with High-Performance Order Storage and with legacy post storage.
- Ships no vendor SDK. The API client is a few hundred lines on top of the WordPress HTTP API.
- Reads the API key from
wp-config.phpwhen you would rather it never touch the database.
What It Deliberately Does Not Do
It never handles card numbers or CVV values. The only payment fields it reads are the risk signals your gateway has already stored: AVS and CVV match results, card BIN, last four digits, and expiry.
It never writes request or response bodies to logs. Logging goes through the WooCommerce logger and records order IDs, case IDs, and status codes.
It never changes order status on its own. A declined guarantee stores the disposition and fires an action hook so each store applies its own policy. Cancelling orders behind an operator's back is not a default anyone should inherit.
What Gets Sent to Signifyd
Screening happens on Signifyd's servers, so creating a case transmits the order, its line items, the customer's name, email, phone, billing and shipping addresses, the IP recorded on the order, and the gateway's risk signals. Customer personal data leaving your site for a third party is a privacy decision, not just a technical one. Review your privacy policy and your obligations under GDPR, CCPA, PIPEDA, or whichever regime applies before enabling it on a live store.
Requirements
WordPress 6.0 or newer, PHP 7.4 or newer, WooCommerce 6.0 or newer, and a Signifyd account with a team API key. The plugin targets Signifyd's V2 Cases API. Signifyd promotes the V3 Decisions API for new integrations and keeps V2 available to existing teams, so confirm with your account team which version your credentials are provisioned for.
Who Maintains It
Choice OMG maintains this plugin. We are a digital marketing and web agency in Edmonton, Alberta, running SEO, Google Ads, and web work on flat monthly fees since 2010. This plugin came out of client work, which is where most of our tooling comes from.
If you are running WooCommerce and fighting chargebacks, or you want the tracking and attribution around your store to be as solid as the fraud screening, talk to us.