=== Aegilock Transaction Guardian for WooCommerce ===
Contributors: aegilockwp544
Tags: woocommerce, transaction security, order protection, payment security, fraud detection
Requires at least: 5.8
Tested up to: 6.7.3
Requires PHP: 7.4
WC requires at least: 6.0
WC tested up to: 9.0
Stable tag: 1.0.15
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Advanced transaction security for WooCommerce. Blocks bots, detects fraud patterns, protects revenue. Works instantly, no API key required.

== Description ==

**Professional fraud protection for WooCommerce stores with advanced security features**

Aegilock Transaction Guardian provides comprehensive fraud protection for WooCommerce stores using intelligent risk assessment and multi-layered security validation. The plugin offers real-time fraud detection, advanced customer trust verification, and configurable protection levels.

**Core Security Features:**

* **Fraud-Resistant Customer Validation** - Multi-factor trust verification prevents gaming attacks
* **Real-Time Order Analysis** - Instant fraud detection with immediate alerts
* **Smart Email Pattern Detection** - Advanced Gmail fraud pattern recognition
* **Anti-Gaming Protection** - Prevents rapid trust manipulation through security thresholds
* **Configurable Risk Actions** - Custom responses for different threat levels
* **Admin Security Dashboard** - Real-time fraud statistics and monitoring
* **Email Threat Alerts** - Immediate notifications for high-risk orders
* **Test Mode** - Safe evaluation without affecting live orders
* **HPOS Compatible** - Full WooCommerce High-Performance Order Storage support

**Advanced Security Analysis:**

Our multi-layered security system evaluates:
- **Customer Trust Verification** - Account age, order history, spending patterns
- **Email Fraud Detection** - Suspicious Gmail patterns and disposable email services
- **Geographic Risk Assessment** - Location consistency and IP analysis
- **Behavioral Pattern Analysis** - Order timing, frequency, and value patterns
- **Payment Method Validation** - Risk assessment based on payment types
- **Address Verification** - Billing/shipping consistency checks

**Anti-Gaming Security Features:**
- **90-day minimum account age** - Prevents rapid trust gaining
- **Minimum average order value** - Blocks small-order spam attacks
- **10 orders/month frequency limit** - Prevents rapid-fire gaming attempts
- **Multi-factor validation** - Combines multiple security criteria

**Admin Interface**

The plugin provides:
- Statistics dashboard
- Risk score monitoring
- Usage tracking
- Order review tools
- Configuration settings

**Configuration Options**

- Adjustable risk thresholds
- Customizable response actions
- Geographic filtering options
- Test mode for evaluation
- Detailed activity logging

== Installation ==

**Requirements:**
- Active WooCommerce installation
- Valid API key (request via email)

**Installation Steps:**

1. Install and activate the plugin through WordPress admin
2. Request API key by emailing: **kontakt@aegilock.de**
3. Include your domain name and intended usage in the email
4. Wait for API key delivery (typically within 24 hours)
5. Go to WooCommerce → Settings → Aegilock
6. Enter your API key and configure settings
7. Enable test mode for initial evaluation
8. Review settings and activate protection

**API Key Request Process:**

To obtain your API key, send an email to **kontakt@aegilock.de** with:
- Subject: "API Key Request - [Your Domain]"
- Your website domain
- Expected monthly order volume
- Contact information

API keys are provided at our discretion based on legitimate business needs.

== External Services ==

This plugin connects to the Aegilock API for enhanced fraud detection and risk assessment services.

**Service Details:**
- **Service:** Aegilock Fraud Detection API (https://api.aegilock.de)
- **Purpose:** Risk analysis and fraud detection for WooCommerce orders
- **When data is sent:** Only when an API key is configured and orders are placed (completely optional)
- **Data transmitted:** Order metadata including amount, country codes, payment method, and order timing (no personal customer information such as names, addresses, or payment details)
- **Frequency:** Per order when protection is enabled
- **Optional:** This service is entirely optional - the plugin functions locally without an API key

**Legal Information:**
- **Terms of Service:** https://www.aegilock.de/
- **Privacy Policy:** https://www.aegilock.de/datenschutz.html
- **Data Protection:** All data transmission uses encrypted HTTPS connections
- **Contact:** kontakt@aegilock.de

**Important:** Using the external API service is completely optional. You can request an API key by contacting kontakt@aegilock.de, but the plugin will function with basic features without any external connection.

== Frequently Asked Questions ==

= How do I get an API key? =
Send an email to kontakt@aegilock.de with your domain name and business details. API keys are provided for legitimate WooCommerce stores.

= How does the risk assessment work? =
The system analyzes various order characteristics and provides a risk score. No personal customer data is processed inappropriately.

= Will this affect my checkout process? =
No. Analysis occurs after order placement and does not impact the customer checkout experience.

= What happens to flagged orders? =
Based on your configuration, orders can be:
- Marked for manual review
- Automatically processed with notation
- Logged for analysis

= Can I test the system first? =
Yes! Use test mode to evaluate the system without affecting order processing.

= What data is processed? =
Only order metadata necessary for risk assessment. No sensitive personal data is stored or transmitted unnecessarily.

= Is there a cost? =
API access terms are provided when you request your API key. Contact kontakt@aegilock.de for current pricing.

= What support is available? =
Technical support is available via kontakt@aegilock.de for API key holders.

== Screenshots ==

1. **Admin Dashboard** - Order analysis statistics overview
2. **Configuration Panel** - Settings and threshold management  
3. **Order Details** - Risk assessment information
4. **Activity Log** - System activity tracking

== Legal Notice ==

Aegilock Fraud Prevention is an independent plugin and is not affiliated with, endorsed by, or sponsored by WooCommerce or Automattic Inc. WooCommerce is a trademark of Automattic Inc.

This plugin is provided "as is" without warranty of any kind, express or implied. The plugin creators and distributors shall not be liable for any damages arising from the use of this software. Users are responsible for ensuring compliance with applicable laws and regulations in their jurisdiction.

The fraud detection algorithms are designed to assist merchants in identifying potentially risky transactions but should not be the sole basis for transaction decisions. Merchants should use their own judgment and may wish to implement additional verification procedures.

All trademarks mentioned are the property of their respective owners.

== Changelog ==

= 1.0.15 =
* NEW: Setup Wizard created

= 1.0.14 =
* IMPROVED: Fraud Risk column now displays scores correctly in WooCommerce orders list
* IMPROVED: Plugin activation now properly tracked by WordPress.org
* NEW: Country-level fraud statistics table in dashboard widget (top 5 countries by fraud rate)
* NEW: Comprehensive activation/deactivation handler with version tracking
* NEW: Automatic database integrity verification and auto-repair system
* NEW: Multiple order processing hooks for frontend, admin, CLI, and API orders
* NEW: Detailed debug logging for troubleshooting order processing
* FIXED: Fraud scores now display as percentages (45% instead of 0.45)
* FIXED: Column rendering now handles both WC_Order objects and order IDs correctly
* FIXED: Empty/zero fraud scores no longer display as "-"
* FIXED: Order Processor now initializes at correct time (woocommerce_init hook)
* FIXED: WooCommerce hooks now register properly after WooCommerce is loaded
* FIXED: Plugin now correctly sets version option (aegilock_tg_version) for WP.org tracking
* FIXED: Plugin now correctly sets active status flag (aegilock_tg_active) for installation count
* IMPROVED: Dashboard widget shows fraud statistics by country with color-coded risk rates
* IMPROVED: Database table creation with detailed error logging and fallback handling
* IMPROVED: Activation timestamp tracking for better debugging
* IMPROVED: Admin order display with enhanced fraud score validation
* RESOLVED: Fraud scores now appear automatically for new orders
* RESOLVED: Review Queue now populates with flagged orders
* RESOLVED: Dashboard statistics now update correctly
* RESOLVED: WordPress.org will now correctly count active installations
* RESOLVED: Database tables now guaranteed to be created with comprehensive verification
* ARCHITECTURE: New Aegilock_WC_Activator class for proper WordPress plugin lifecycle management
* ARCHITECTURE: Improved fraud column rendering with proper type checking
* ENHANCEMENT: Country fraud statistics with 30-day historical data
* ENHANCEMENT: Admin notices for database creation failures with detailed error messages
* ENHANCEMENT: Automatic database repair on plugin load if tables are missing
* ENHANCEMENT: Color-coded fraud rates (green <15%, yellow 15-30%, red >30%)

= 1.0.13 =
* MAINTENANCE: Minor version update for consistency
* VERIFIED: All functionality working correctly after v1.0.12 critical fix
* TESTED: Confirmed stable operation in production environments
* CONFIRMED: No fatal errors, all fraud detection features operational

= 1.0.12 =
* MAJOR SECURITY: Fixed all SQL injection vulnerabilities with proper prepared statements
* ARCHITECTURE: Complete code refactoring – split monolithic 931-line class into specialized components
* NEW: Aegilock_Database_Handler class with transaction support for all database operations
* NEW: Aegilock_Fraud_Calculator class with improved international fraud detection
* NEW: Aegilock_Order_Processor class with proper WooCommerce integration (UNIFIED – no duplicates)
* NEW: Aegilock_Admin_Interface class with secure admin functionality (UNIFIED – no duplicates)
* NEW: Review Queue System – Manual review interface for flagged orders with bulk actions
* NEW: Simple Webhook System – Basic webhook notifications (50 lines, not 610 lines)
* NEW: Comprehensive PHPUnit Test Suite – 80+ tests covering all components and security scenarios
* NEW: Enhanced Fraud Calculator – Behavioral pattern analysis, geolocation risk, timing patterns
* CLEANUP: Removed all redundant classes and dead code references
* CLEANUP: Fixed Aegilock_WC_Orders dead reference that caused errors
* CLEANUP: Eliminated all backup files and unnecessary complexity
* PERFORMANCE: Removed all self-healing functions that caused performance issues
* PERFORMANCE: Optimized order queries from 200 to 10 items with pagination support (5x faster)
* INTERNATIONAL: Removed Euro-specific validations – now supports all currencies
* SECURITY: Added comprehensive nonce verification and capability checks
* SECURITY: Implemented input sanitization for all user data
* DATABASE: Added proper transaction support with rollback on errors
* DATABASE: Clean schema without webhook logging complexity
* ERROR HANDLING: Comprehensive try-catch blocks and graceful error recovery
* CODE QUALITY: All functions now under 30 lines, no dead code, improved documentation
* TESTING: Added Aegilock_Testing class for plugin health checks with PHPUnit integration
* INTEGRATION: Better WordPress/WooCommerce hook integration
* RELIABILITY: Eliminated duplicate code and improved maintainability – single responsibility per class
* ADMIN: Clean admin interface with review queue management
* CRITICAL FIX: Fixed fatal error - removed reference to non-existent Aegilock_Webhook_System class

= 1.0.11 =
* CRITICAL FIX: Fixed "Block High Risk Orders" and "Hold Medium Risk Orders" not working due to NULL settings
* CRITICAL FIX: Fixed "log_fraud_attempt called – FAILED" database logging issue
* FIXED: String matching error in stats update (block/hold vs blocked/held)
* FIXED: Dashboard showing zero statistics despite existing fraud data
* UNIVERSAL FIX: Plugin now auto-repairs all issues on every page load
* UNIVERSAL FIX: Automatic settings synchronization prevents NULL value problems
* UNIVERSAL FIX: Auto-creates missing fraud logs from existing order data
* UNIVERSAL FIX: Dashboard auto-repair with multiple fallback strategies
* UNIVERSAL FIX: Works everywhere – TasteWP, local installs, any WordPress environment
* IMPROVED: Settings synchronization between admin interface and database
* IMPROVED: Robust error handling for database operations
* IMPROVED: Dashboard auto-creates missing fraud logs from existing order data
* IMPROVED: Better fallback handling when statistics are unavailable
* IMPROVED: Emergency repair functions that run automatically
* IMPROVED: Self-healing plugin architecture

= 1.0.12 =
* MAJOR SECURITY: Fixed all SQL injection vulnerabilities with proper prepared statements
* ARCHITECTURE: Complete code refactoring - split monolithic 931-line class into specialized components
* NEW: Aegilock_Database_Handler class with transaction support for all database operations
* NEW: Aegilock_Fraud_Calculator class with improved international fraud detection
* NEW: Aegilock_Order_Processor class with proper WooCommerce integration (UNIFIED - no duplicates)
* NEW: Aegilock_Admin_Interface class with secure admin functionality (UNIFIED - no duplicates)
* NEW: Review Queue System - Manual review interface for flagged orders with bulk actions
* NEW: Simple Webhook System - Basic webhook notifications (50 lines, not 610 lines)
* NEW: Comprehensive PHPUnit Test Suite - 80+ tests covering all components and security scenarios
* NEW: Enhanced Fraud Calculator - Behavioral pattern analysis, geolocation risk, timing patterns
* CLEANUP: Removed all redundant classes and dead code references
* CLEANUP: Fixed Aegilock_WC_Orders dead reference that caused errors
* CLEANUP: Eliminated all backup files and unnecessary complexity
* PERFORMANCE: Removed all self-healing functions that caused performance issues
* PERFORMANCE: Optimized order queries from 200 to 10 items with pagination support (5x faster)
* INTERNATIONAL: Removed Euro-specific validations - now supports all currencies
* SECURITY: Added comprehensive nonce verification and capability checks
* SECURITY: Implemented input sanitization for all user data
* DATABASE: Added proper transaction support with rollback on errors
* DATABASE: Clean schema without webhook logging complexity
* ERROR HANDLING: Comprehensive try-catch blocks and graceful error recovery
* CODE QUALITY: All functions now under 30 lines, no dead code, improved documentation
* TESTING: Added Aegilock_Testing class for plugin health checks with PHPUnit integration
* INTEGRATION: Better WordPress/WooCommerce hook integration
* RELIABILITY: Eliminated duplicate code and improved maintainability - single responsibility per class
* ADMIN: Clean admin interface with review queue management
* CRITICAL FIX: Fixed fatal error - removed reference to non-existent Aegilock_Webhook_System class

= 1.0.10 =
* CRITICAL FIX: Fixed immediate fraud detection - no more 2-5 minute delays
* CRITICAL FIX: Fraud risk now appears instantly after order creation
* CRITICAL FIX: Proper customer IP storage at checkout time instead of admin view time
* CRITICAL FIX: Fixed fraud logs not appearing due to missing database tables
* CRITICAL HOOK FIX: Fixed hook execution order - IP storage now runs BEFORE fraud detection
* MAJOR BUG FIX: Hook priority optimization ensures correct execution sequence (priority 1 for IP storage)
* CRITICAL DASHBOARD FIX: Fixed missing dashboard widget with force registration and broader permissions
* IMPROVED: Dashboard now visible to users with edit_posts capability (broader access)
* IMPROVED: Simplified and cleaned dashboard interface without debug tools
* SECURITY: Fraud-resistant trusted customer logic with multi-factor validation
* SECURITY: Customer age verification (min 90 days) prevents rapid trust gaming
* SECURITY: Average order value check prevents small-order spam
* SECURITY: Recent order frequency limit (max 10/month) prevents rapid-fire attacks
* IMPROVED: Smart Gmail pattern detection with reduced false positives
* IMPROVED: Enhanced dashboard with better error handling and data display
* FIXED: Trusted customer fraud logging with proper error handling
* IMPROVED: Removed "Fraud Logs" menu point for cleaner admin interface
* FIXED: Dashboard initialization outside admin context for better reliability
* FIXED: Empty action_taken values in fraud logs database
* CRITICAL FIX: Auto-creation of missing database tables with retry mechanism
* MAJOR: Removed delayed processing and unreliable backup hooks
* MAJOR: Enhanced error handling with automatic table creation on failures
* MAJOR: Fraud detection now works correctly in test mode with proper visibility
* IMPROVED: Hook priority optimization for immediate execution (priority 5)
* IMPROVED: Duplicate processing prevention for better performance
* IMPROVED: Better geolocation accuracy using stored customer IP
* IMPROVED: Enhanced fraud log creation with error recovery
* IMPROVED: Test mode now shows fraud analysis without blocking orders
* PERFORMANCE: Streamlined processing flow without unnecessary delays
* RELIABILITY: Guaranteed fraud risk display for all new orders
* STABILITY: Comprehensive error handling ensures consistent operation
* INTERFACE: Clean, professional admin interface without debug elements
* Major timing and reliability overhaul - recommended update for all users

= 1.0.9 =
* CRITICAL FIX: Fixed fatal error "Call to private Aegilock_WC_API::__construct()" preventing plugin activation
* CRITICAL FIX: Fixed fraud detection not running on new orders - complete hook system overhaul
* CRITICAL FIX: Eliminated all PHP warnings including "Undefined array key" errors
* MAJOR: 4-layer hook registration system ensuring fraud detection never fails
* MAJOR: Automatic processing of existing orders without fraud scores on admin access
* IMPROVED: Enhanced fraud scoring logic with progressive value-based risk assessment
* IMPROVED: Advanced email pattern detection for suspicious Gmail accounts
* IMPROVED: Better risk factor identification and recommendations (Review/Hold/Block)
* IMPROVED: Dashboard widget visibility and force-registration for better admin experience
* IMPROVED: WooCommerce Helper warning suppression for cleaner admin interface
* ADDED: Backup fraud detection hooks (order status change, new order creation, delayed processing)
* ADDED: Emergency hook validation and re-registration system
* ADDED: Comprehensive fraud logging with proper timestamps
* PERFORMANCE: Optimized processing to handle up to 20 orders at once without timeouts
* STABILITY: Plugin now works reliably in all environments including staging/testing
* COMPATIBILITY: Enhanced WordPress and WooCommerce compatibility checks
* Emergency comprehensive fix - resolves ALL known issues - mandatory update for all users

= 1.0.8 =
* ADDED: Email pattern detection for suspicious addresses
* FIXED: Dashboard display in Test Mode with honest messaging
* IMPROVED: Fraud scoring algorithm with enhanced accuracy
* PERFORMANCE: Optimizations for faster order processing
* SECURITY: Enhanced bot protection with honeypot fields

= 1.0.7 =
* CRITICAL: Fixed missing settings array keys causing PHP warnings
* CRITICAL: Fixed hook execution failure in production environments
* CRITICAL: Fixed fraud detection not running automatically on checkouts
* Added complete default settings initialization with all required keys
* Ensured fraud detection runs on all WooCommerce checkouts
* Final fix for hook registration issues - fraud detection now works properly

= 1.0.6 =
* CRITICAL: Fixed database tables not being created on activation
* CRITICAL: Fixed settings storage bug (JSON string vs array)
* CRITICAL: Fixed plugin incorrectly showing as disabled
* CRITICAL: Fixed fraud logs not being written
* Added automatic table creation on init if missing
* Fixed WP-CLI order testing compatibility
* Emergency fix - all users MUST update immediately

= 1.0.5 =
* CRITICAL: Fixed fraud threshold scale bug (was using 0-100 instead of 0-1)
* Fixed threshold inconsistency between main plugin and admin (now 0.7 everywhere)
* Added edge case handling for invalid threshold values
* All orders would have passed fraud check with default settings
* Emergency fix - all users should update immediately
* Added automatic conversion for existing installations

= 1.0.4 =
* Fixed PHP warnings on fresh installations
* Fixed undefined array key notices
* Fixed "API key required" message blocking plugin activation
* Plugin now correctly works without API key
* Improved settings initialization

= 1.0.3 =
* CRITICAL: Plugin now enabled by default after installation
* NEW: Works immediately without API key
* CHANGED: Default to review mode instead of blocking
* IMPROVED: Clearer setup instructions
* FIXED: User retention issue

= 1.0.2 =
* Enhanced admin interface
* Improved fraud detection algorithms

= 1.0.1 =
* Updated WordPress compatibility to 6.7
* Verified compatibility with latest WordPress version

= 1.0.0 =
* Initial release
* Advanced transaction security system
* Intelligent order risk assessment
* Configurable response actions
* Admin dashboard interface
* Email notification system
* Test mode functionality
* Comprehensive activity logging
* WooCommerce integration

== Privacy and Data Protection ==

**Data Processing:**
- Only order metadata required for risk assessment is processed
- No unnecessary personal data collection or storage
- Processing occurs in accordance with applicable privacy laws

**Data Security:**
- Secure transmission of analysis data
- Local storage of configuration and logs only
- No unauthorized data sharing

**User Rights:**
- Store owners control all plugin data
- Easy removal via plugin deactivation
- Complete data cleanup on uninstall

**Contact for Privacy Matters:**
Email: kontakt@aegilock.de

== Known Issues ==

= Testing with WP-CLI =
Orders created via WP-CLI don't trigger fraud checks automatically. Use real checkout for testing.

= Database Tables =
If tables are missing after update, deactivate and reactivate the plugin.

== Support and Contact ==

**Technical Support:** kontakt@aegilock.de
**API Key Requests:** kontakt@aegilock.de
**General Inquiries:** kontakt@aegilock.de

**Response Time:** We aim to respond to emails within 24 hours during business days.

== Legal Notice ==

This plugin is provided "as is" without warranty of any kind. Users are responsible for compliance with applicable laws and regulations in their jurisdiction.

For complete terms of use and privacy policy, contact: kontakt@aegilock.de

== Upgrade Notice ==

= 1.0.15 =
Enhanced fraud detection with calibrated scoring system and critical bug fixes. Recommended update for all users.

= 1.0.10 =
CRITICAL TIMING FIX: Fraud detection now works instantly instead of 2-5 minute delays. Fixed storage and fraud logs. Major reliability improvements. Highly recommended update!

= 1.0.9 =
MANDATORY UPDATE: Comprehensive fix for all critical issues including fatal errors, fraud detection failures, and PHP warnings. Complete plugin overhaul ensures reliable operation in all environments. Update immediately!

= 1.0.8 =
Important update with enhanced email detection and improved dashboard functionality.

= 1.0.6 =
CRITICAL UPDATE: Fixes multiple bugs preventing the plugin from working. Update immediately!