PD Shield for WHMCS

PD Shield stops fake signups and fraudulent orders before WHMCS provisions anything. Disposable email addresses are refused, too many orders from one IP are held, repeat offenders can be blocked from ordering, and per-client purchase limits are enforced at checkout. Anything suspicious goes into WHMCS's own Pending/Fraud review state, so you can approve a genuine order and keep the sale. PD Shield Pro adds a transparent 0 to 100 risk score on every order, proxy, VPN and Tor detection, a review queue and reporting.

It is built for hosts who sell instantly provisioned products such as hosting, VPS and licences, and who are tired of cleaning up after bots, throwaway accounts and cancel-and-reorder trial abuse.

Why hosts choose PD Shield

Stop the fake before it provisions. Checks run when the signup or order is placed, before WHMCS sets anything up, so a bad order does not cost you a server or a licence.

Hold, do not lose, the sale. By default a suspicious order is held for review rather than refused. A held order sits in WHMCS's native Pending/Fraud state and follows the normal order workflow: approve it, the customer pays and it provisions.

No CAPTCHA for your customers. A hidden honeypot field catches bots that fill in every field. Real customers never see it, and it is built so password managers do not fill it. Out of the box it only watches and records; you decide when it starts blocking.

You can always see why. Every held order has its reason spelled out, and the Pro score lists each contributing signal beside the outcome.

It cannot break your checkout. A fault inside PD Shield never breaks a customer's checkout or registration, and genuine customers see nothing of it: it adds no client-area pages.

Works beside WHMCS's own fraud tools. PD Shield complements tools such as MaxMind and leaves their settings alone.

How it works

1. Install PD Shield from PD Modules. The free front-door checks start with sensible defaults.
2. Choose what happens to a risky order. The default action is hold. You can switch the velocity limit to block or flag instead.
3. Add the rules you want. Turn on Order Guard, purchase limits, free-email blocking or email-verification holds.
4. Review and release. Held orders appear for review. Approve the genuine ones; reject the rest.

What you get in WHMCS

Free front-door gates

• Disposable email blocking: on by default. A signup with a throwaway address (mailinator, guerrillamail and similar) is refused and the customer is told once. An existing customer whose account uses one is refused at checkout. A built-in list covers the most common throwaway domains, and the placeholder domains example.com and test.com
• Free-email blocking: off by default. When on, a signup with free webmail such as gmail or outlook is refused
• Velocity limit: on by default at 5 orders and signups per IP per 60 minutes. Action hold (default), block or flag. Customers with a paid invoice and a live service are not caught; new signups still are. Forwarded IP headers are trusted only from Cloudflare or ranges you list, so a forged header cannot walk past it
• Email-verification hold: off by default. When on, an order from a customer whose email is not verified is placed and held, then released automatically when they verify. Checkout itself is never refused, and it does nothing if WHMCS's own email verification is off
• Honeypot: hidden field on the order and registration forms. Watches first; "Block honeypot hits" makes it refuse at registration and checkout. A script that posts a form directly never sees the field
• Alerts: you are emailed whenever an order is held. Leave the address blank and every active admin is told

Order Guard and purchase limits

• Find a client by name, company or email, block new orders in one click, and unblock any time. The block applies at checkout with a neutral message, also when the buyer checks out signed out with the same email. Their existing services and renewals are never affected. The reason is internal and never shown
• Purchase limits cap a specific product, a whole product group or all services per client. An order that would take a client over the cap, counting what they hold plus what is in the cart, is refused with your own message per rule
• Exempt client groups, chosen with a searchable picker, bypass every limit
• Both are off by default, and their tabs say rules are not enforced until you turn them on
• If two checkouts land at once and a cap is breached anyway, the order is held for review

What the customer is told

• A held order sends the customer one short email saying it is being checked, quoting their order number, saying nothing has been charged and that they will hear as soon as the check is done. It never names the check. It is a WHMCS email template you can edit and translate

Pro: score, detect, review

• Fraud Risk Scoring: every order gets a 0 to 100 score from weighted signals with each factor shown. At or above the review score (default 40) it is held; at or above the block score (default 70) it is refused at checkout. A blank threshold uses the default, and the panel shows the same number the gate uses
• Signals include: unverified email, velocity, disposable email, high-risk country as a weak signal, and impossible travel when one email appears from a different country within your window
• Proxy, VPN and Tor detection: flags Tor exit nodes, datacentre ranges, known VPNs and threat-intelligence blocklists. Only the visitor IP and the email's domain are checked, never the address, and nothing is kept. If detection is unavailable, scoring carries on with local signals and nobody is blocked because of it
• Optional provider: connect your own IPQualityScore key if you wish. A wrong key, an exhausted allowance or an outage never blocks an order
• Review queue and trusted customers: see every held order with client, amount, reason and time; approve to provision or reject to cancel. Trusted customers skip scoring
• Order Guard auto-block: a client whose automatic payments fail a set number of times within your window is added to the list, and admins are told
• Lifetime purchase limits: count cancelled and terminated services too, so a free or promo product cannot be cancelled and re-ordered past the limit
• Reporting: blocks and holds over time, by reason, action and country; larger disposable-domain feed

Security built in

• Without Pro, PD Shield sends nothing about your customers anywhere. With Pro scoring, the only data sent is the visitor IP and the email's domain, and you can switch it off in Settings while the rest keeps working.
• A provider API key you add is stored encrypted on your own server and sent only to the provider.
• Pro scoring has no per-check credits and no metered cost.

Free and Pro

PD Shield is free and never expires. PD Shield Pro is £12 per month, added to the same licence in place with no reinstall. If Pro lapses, a 14-day grace period keeps Pro features working, then PD Shield carries on as the free version. Your settings and data are kept, and re-adding Pro restores everything. Uninstalling removes the module's tables, settings, files and scheduled jobs.

Requirements

• WHMCS 9 or later on PHP 8.2 or later, with the ionCube Loader
• PD Modules, the free control panel every PD module installs into