The problem

WooCommerce Order Attribution captures origin and device data at checkout by writing hidden fields during the checkout flow. Anything that does not go through that flow writes nothing, which includes orders placed directly against the Store API. So you end up with a reporting hole and a fraud signal at the same time, and neither is visible in the admin, because a missing field does not look like anything.

What this plugin does

It treats attribution as a checkout requirement rather than optional telemetry. Checks for origin and device data, blocks Store API orders that arrive without it, and logs every check with enough context to tell a card testing script apart from a legitimate manual order. Run it in log-only mode for a week before you turn on blocking.

Installing it

TODO download from the repo, upload, activate, and note where the settings live.

Hooks and filters

Every public filter, with a signature and a worked example. This section is what earns the long-tail rankings, because developers search filter names verbatim.

/**
 * Example filter. Replace with the real ones.
 */
add_filter( 'brs_example_filter', function ( $value ) {
    return $value;
}, 10, 1 );

Requirements and support

This is free software published under the GPL and it comes with no support obligation. Bugs go in GitHub issues. If you need it modified for your site, that is paid work.