WooCommerce extension · coupon defense
Your codes. Your customers. Nobody else.
Auto-apply tools try every code they've ever seen at your checkout. Influencer codes hit coupon sites within hours. “First order” discounts get farmed with throwaway inboxes. Coupon Fence is a firewall in front of coupon redemption: five guards, leak-proof share-links, and an alarm that quarantines a leaked code before it eats your weekend margin.
GPL-2.0 · WordPress 6.0+ · WooCommerce 7.0+ · PHP 7.4+ · Classic + block checkout · No external services, no per-check fees.
- Log-only by default
- Rides WC's own validation
- Staff never blocked
- Reversible quarantine
- Self-pruning logs
- HPOS compatible
The problem
Coupon abuse is quiet, constant, and paid for out of your margin.
Nobody disputes a chargeback over it and nothing crashes. It's a newsletter code appearing on every aggregator, a browser extension applying it to strangers' carts, and “10% off your first order” running on its ninth alias inbox.
Native WooCommerce restrictions, usage limits, email restrictions, can't see behavior. That's the layer Coupon Fence adds.
Starts safe
Log-only by default
Activation never blocks a shopper or sends an email until you explicitly switch to Enforce. The Activity tab shows would-block verdicts in Log-only, a week of receipts before you enforce anything.
What it does
Coupon Fence, feature by feature.
Invalid-attempt rate limit
Coupon brute-forcing and enumeration die at N invalid attempts per IP in a sliding window. Attempt-level logging shows you exactly which codes are being guessed.
Try-every-code burst guard
A human types one code. Auto-apply tools submit several distinct codes in seconds. That behavior is detected server-side and blocked for 24h, honestly: we detect the behavior, not any particular extension.
Protected coupons & signed share-links
A protected coupon only applies for visitors who arrived through its signed share-link. The raw code leaking to a coupon site becomes worthless, your links keep working until expiry.
Disposable-email guard
Coupons (only the coupon, never the whole order) are refused for known throwaway-inbox domains. A curated bundled list of 466 disposable domains, plus your own additions.
Alias-reuse guard
jane.doe+2@gmail.com is janedoe@gmail.com. For coupons with a per-customer limit, aliases stop counting as new customers, using only transformations the providers themselves document.
Leak velocity alarm
Hourly: any coupon spiking past N uses triggers an alert email, and, if you allow it, a reversible auto-quarantine that caps the usage limit at its current count. Nothing deleted, restore in one click.
Leak-proof influencer links
Mark a coupon protected, generate a signed link, and hand out the link, never the raw code. When a partnership ends, regenerate the signing secret and every link ever issued dies instantly.
| Property | Ordinary URL coupon | Coupon Fence share-link |
|---|---|---|
| What's shared | The raw code (works for anyone) | A signed, expiring token |
| Code leaks to a coupon site | Every visitor redeems it | The bare code is refused |
| Partnership ends | Rotate the code, break everyone's | Regenerate the secret, links die instantly |
| Forgeable | Trivially | HMAC-signed under a per-site secret |
| Customer data in the URL | Sometimes | None, code + expiry + signature only |
| Works with UTM tracking | Yes | Yes, one extra query parameter |
See it in wp-admin
Real screens, no mockup gloss.
Rendered straight from the plugin's own admin UI in a local environment, what you install is what you see.
Inside wp-admin
Activity
Every verdict logged with IP, email and reason, would-block in Log-only, blocked in Enforce.
Inside wp-admin
Coupons
Share-link generator, protected coupons, quarantine and restore.
Where it fits
Honest comparisons, category by category.
No named-competitor trash talk, just what each category of tool is good at, and where this plugin earns its keep.
vs. coupon feature suites
Two jobs: building coupons (BOGO, gift cards, bulk generation, success = more redemptions) versus defending them (success = fewer wrong redemptions). The more you use a feature suite, the larger the attack surface Fence covers.
- Feature-suite “URL coupons” are unsigned convenience, a leaked URL works for everyone.
- Fence's share-links are HMAC-signed restrictions, same-shaped URL, opposite security property.
- Complementary by design: keep your coupon builder, add the firewall.
vs. manual coupon hygiene
Native WooCommerce already does usage limits, allowed emails, expiry and spend scopes well, Fence assumes you use them. Where manual runs out: brute-force counting, burst patterns, leak detection, alias folding.
- Rotating a leaked code punishes everyone you gave it to; signed links make leaking stop mattering.
- Quarantine works through the native usage limit, nothing invented, nothing deleted.
- The 3 a.m. problem, coupon edition: the leak alarm doesn't sleep.
vs. checkout extension-blockers
Client-side blockers run in the shopper's browser: early, but an arms race, JS-dependent and blind to headless or API posts. Coupon Fence concedes the browser and works at the server-side chokepoint: coupon validation.
- Behavior detection catches what extension fingerprinting misses.
- Signed links make leaked codes validate for no one, regardless of how they leaked.
- This is why our claims say “detects the behavior”, never “blocks extension X.”
Pricing
One price, everything included.
No tiers of crippled features, the single-site license is the whole plugin.
Coupon Fence, single site
One year of updates and support. Keeps working if you don't renew.
- Invalid-attempt rate limit
- Try-every-code burst guard
- Protected coupons & signed share-links
- Disposable-email guard
- Log-only by default
- Manual + help tab inside wp-admin
The Storm Kit
Pulse + IP Shield + Coupon Fence, save $38 vs. buying separately.
- All three paid plugins, one license
- Every WooCommerce plugin we ship next, included
- Same 60-day no-quibble guarantee
- Priority answers from the developers
How buying works today: secure online checkout is coming soon. Until it lands, click Buy and tell us which plugin you want, we deliver the plugin zip and an invoice by email within one business day, covered by the same 60-day guarantee.
60-day money-back guarantee
Full refund within 60 days of purchase. No questions, no forms, no hard feelings. If a plugin isn’t the right fit for your store, you shouldn’t pay for it.
The manual lives inside the plugin.
Every install ships a full Help tab in wp-admin, plus these guides in the package:
- Install
- Configuration
- Usage
- The five guards
- Share-links
- Troubleshooting
- FAQ
- Changelog
- Version
- 1.0.0
- Requires
- WordPress 6.0+ · WooCommerce 7.0+ · PHP 7.4+
- Tested up to
- WooCommerce 8.2 · HPOS compatible
- License
- GPL-2.0-or-later · your data stays on your site
Security posture: we build defensive tools, so we hold ourselves to the same bar, no external calls, capability and nonce checks on every admin action, and a direct line for reports at security@lightningbyrd.com. Reports get a human answer within one business day.
FAQ
Straight answers.
Do you detect Honey, Rakuten, and other extensions by name?
No, and be wary of any plugin that claims to. The server sees behavior: several distinct codes submitted in seconds. Fence blocks the behavior, and signed links make leaked codes worthless regardless of the tool.
Can a real customer get blocked?
The guards are tuned so ordinary behavior never trips them, and Log-only mode lets you verify that against your own traffic before enforcing. Blocks expire on cooldown, the order itself is never blocked, and staff are exempt.
What happens to a quarantined coupon?
Its usage limit is capped at the current count, shoppers see WooCommerce's native “usage limit reached.” Nothing is deleted, and the original limit is restored in one click.
Does it work with the block (Store API) checkout?
Yes. The guards ride WooCommerce's own coupon-validation pipeline, which both checkouts share.
What does the share-link actually contain?
A signed token: coupon code + expiry + HMAC under a per-site secret. No customer data, unforgeable, and it dies on expiry or secret rotation.
GDPR, what do you store?
Coupon code, IP, billing email, and the verdict, in your own database, pruned on a retention window (default 30 days). Nothing is sent anywhere.
Will it slow checkout?
No measurable effect: a few transient reads and two indexed queries. No external calls, no front-end JavaScript.
Does it play nice with fraud-scoring plugins and IP Shield?
Yes, different layers. Scoring judges orders, Fence acts at coupon validation, and IP Shield bans hostile IPs storewide. Coupon abusers who also card-test are exactly why Fence and Shield share a customer.
More from the flock
The rest of the suite.
Each plugin stands alone, together they cover detection, response, prevention, and upkeep.
$59/yrPulse
Store monitoring
Know the minute your store stops selling. Order-flow anomaly alerts, checkout and Store API health probes, gateway, cron, and mail watchdogs, inside WordPress, no external service.
Learn more →
$49/yrIP Shield
Fraud & abuse defense
Ban abusive customer IPs before they burn out your payment gateway, one-click bans from the order screen, automatic velocity bans, and a full audit trail.
Learn more →
FreeFeatherweight
Performance & maintenance
The WooCommerce-aware database janitor. Scans and safely cleans what generic optimizers miss, Action Scheduler bloat, expired sessions, autoload weight. Free.
Download free →Coupon Fence
Sleep better by tonight.
Install Coupon Fence, watch it in log-only by default against your real traffic, and arm it when you've seen the receipts.