feat: WooCommerce honeytoken coupons (#14)#30
Merged
Conversation
Extends the WooCommerce carding defense with a deterministic deception signal. - honeytoken_coupon(): a per-site fake promo code (WD + 8 hex, deterministic from a stored secret, optional daily rotation with grace). - render_coupon_bait(): plants the code on cart/checkout in an HTML comment + an offscreen aria-hidden node — where coupon-scraping bots look, invisible to humans and the accessibility tree. - catch_coupon(): hooks woocommerce_get_shop_coupon_data, so it fires for both classic checkout and the Store API / Blocks (both load coupons via WC_Coupon). Applying the canary (case-insensitive, incl. yesterday's during rotation) records a detection, optionally blocks the IP per block_action, and returns it as a non-existent coupon. Real coupons pass through untouched. - Existing velocity / card-testing detection is unchanged; this is additive. New WooCommerce settings toggle (on by default). Verified: code determinism, hidden bait markup, catch+record+block on the canary, case-insensitivity, rotation grace, log-mode (record no block), disabled passthrough, and real-coupon passthrough (16 checks). Closes #14. Part of #16. Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds deception to the WooCommerce carding defense: a honeytoken coupon — a fake promo code no human ever sees, whose application is a zero-false-positive bot signal.
How it works
honeytoken_coupon()— a per-site fake code (WD+ 8 hex), deterministic from a stored secret, with optional daily rotation.render_coupon_bait()— plants the code on cart and checkout pages in an HTML comment plus an offscreenaria-hiddennode: exactly where coupon-scraping bots and browser coupon extensions look, invisible to human shoppers and the accessibility tree.catch_coupon()— hookswoocommerce_get_shop_coupon_data, which fires for both classic checkout and the Store API / Blocks (both load coupons throughWC_Coupon). Applying the canary (case-insensitive, and yesterday's code during rotation grace) records a detection, blocks the IP per yourblock_action, and returns it as a non-existent coupon — indistinguishable from a typo.Existing velocity / card-testing detection is unchanged; this is purely additive. On by default (new WooCommerce settings toggle).
Zero false positives
A human can't apply a code they can never see. Real coupons pass straight through — verified.
Tests
16 checks: code determinism, hidden bait markup (offscreen + aria-hidden + HTML comment), catch→record→block on the canary, case-insensitivity, rotation grace window, log-mode (record without block), disabled passthrough, and real-coupon passthrough (not recorded, data preserved). SDK suite still green (41).
Closes #14. Part of #16.