Wrong codes and security

A gift card is as good as cash to whoever has its code, so Giftline makes codes hard to guess and slows down anyone who tries.

Codes

Every new code is 16 random letters and digits, shown in groups of four (NKMC-FZSS-9Y5Z-7KAH). Letters and digits that look alike, such as O and 0, aren't used. Customers can type a code in any case, with or without the dashes.

Where the whole code shouldn't show, such as in the order totals and on order notes, a card is named by its last four characters: "Gift card •••• 7KAH".

The wrong-code limit

Each visitor can type a limited number of wrong gift card codes an hour: at checkout, on the cart, in the balance check and in My Account alike. Codes that are right don't count. Once the limit is reached, the visitor sees "Too many gift card codes were tried. Please wait an hour and try again." and no code is looked up until the hour has passed.

Set the limit under WooCommerce → Giftline → Wrong codes per hour. The default, 10, is plenty for a customer with a typo and far too few to guess a code.

The limit counts per IP address, and per account for logged-in customers.

Behind a proxy or CDN

If your site sits behind a reverse proxy, a load balancer or a CDN such as Cloudflare, every visitor may reach WordPress from the proxy's address. Giftline would then count all your customers' wrong codes together, and a few typos could block everyone for an hour.

Giftline doesn't trust the "real visitor address" headers a proxy adds on its own, because a browser can send them too. If every request reaches your site through the proxy, tell Giftline which address to use with the giftline_client_ip filter, in a small custom plugin or your child theme's functions.php:

// Every request comes through Cloudflare: count wrong codes by the visitor's address it passes on.
add_filter( 'giftline_client_ip', function ( $ip ) {
	if ( ! empty( $_SERVER['HTTP_CF_CONNECTING_IP'] ) ) {
		$ip = sanitize_text_field( wp_unslash( $_SERVER['HTTP_CF_CONNECTING_IP'] ) );
	}
	return $ip;
} );

Use the header your proxy sets (X-Forwarded-For, X-Real-IP, CF-Connecting-IP…), and only when the site can't be reached around the proxy. Your host can tell you which one applies. A CAPTCHA plugin can also hold back lookups until its challenge is passed, with the giftline_lookup_allowed filter: see Hooks.

Other safeguards

• Hold emailed cards for (settings) waits a number of hours after payment before a bought card's code is emailed, so you can cancel a suspicious order first. Cancelling or refunding the order cancels the cards it bought, as long as nobody has spent from them.
• Cards are made only when the order is paid: an order waiting for payment has no codes yet.
• Disable a card on its screen the moment it's reported lost or stolen: it can't be used until you enable it.
• Balances can't be spent twice: a balance is taken when the order is placed, and two orders can never spend the same money.
• Store credit belongs to an account: it's used only by the logged-in customer, and credit kept for a guest's email is added to an account only from a link sent to that address.
• Every change is in the history with who made it, and staff changes need a reason.