=== OrderProof – OTP Order Verification for WooCommerce ===
Contributors: medsalemkhattat
Tags: whatsapp otp, cash on delivery, fake orders, order verification, cod
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
Requires Plugins: woocommerce
Stable tag: 1.2.6
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Verify Cash on Delivery orders with a WhatsApp OTP code (no SMS). Block fake COD orders, duplicate orders and blacklisted customers in WooCommerce.

== Description ==

Fake Cash on Delivery orders cost you shipping, return-to-origin (RTO) fees and stock that sits in a courier van. **OrderProof** adds COD verification to WooCommerce: every COD customer verifies their phone number before you ship. They receive a one-time code (OTP) on **WhatsApp** and type it to confirm the order.

No SMS gateway, no per-SMS bills: codes are sent from **your own WhatsApp Business number** through Meta's official WhatsApp Cloud API. It works for customers in any country.

= How WhatsApp OTP verification works =

1. A customer places a Cash on Delivery order.
2. The order waits in **"Awaiting WhatsApp verification"**. It holds no stock and no "New order" email is sent yet.
3. The customer gets a 6-digit code on WhatsApp and types it on the verification page (with a copy-code button in WhatsApp).
4. The order becomes a real order: stock is reserved and your usual emails go out.
5. Orders that are never verified are cancelled automatically after a few hours.

Test mode lets you try the whole flow before you connect WhatsApp: the code is shown on the verification page instead of being sent.

= Free features =

* **WhatsApp OTP verification** for Cash on Delivery orders (WhatsApp Cloud API, no SMS)
* **Worldwide phone validation**: numbers are read with the calling code of the customer's billing country
* **Duplicate order limit**: max X orders per phone number in Y hours
* **Blacklist** phone numbers, emails and IP addresses, one click from the order page
* **Order statuses**: "Awaiting WhatsApp verification", "Awaiting confirmation" and "Delivery refused" (which restocks products)
* **One-click WhatsApp confirmation** message from the order page ({name}, {items}, {total}, {address}…)
* **Customer history** on every order: delivered vs refused orders
* Classic checkout **and** the Checkout block, with or without HPOS
* Translation-ready (French and Arabic translations coming to translate.wordpress.org)

= OrderProof Pro =

* **Smart OTP**: skip the WhatsApp code for trusted repeat customers
* **Risk score (0–100)** on every order, and automatic blocking of high-risk customers
* **Auto-blacklist** after X refused deliveries
* **More WhatsApp templates**: shipped, out for delivery…
* **Delivery success-rate report**

Pricing and a 7-day free trial (no card needed): [dssarl.com/orderproof](https://dssarl.com/orderproof/)

Questions or problems? Open a thread in the [support forum](https://wordpress.org/support/plugin/orderproof/). If OrderProof is useful to your store, an honest review helps other store owners find it.

== Installation ==

1. Install and activate the plugin.
2. Go to **WooCommerce → Settings → OrderProof**.
3. Turn on **WhatsApp OTP** and **Test mode** to try the flow on your store.
4. To send real codes, follow the guide on the settings page: create a WhatsApp Business app in Meta for Developers, create an approved message template of the **Authentication** category (with a copy-code button), and enter your Phone number ID, access token and template name. Then turn Test mode off and use "Send test code" to check the setup.

== Frequently Asked Questions ==

= Does OrderProof send SMS? =
No. Codes are only sent on WhatsApp, from your own WhatsApp Business number.

= Can I confirm COD orders on WhatsApp without the OTP code? =
Yes. Every order page has a one-click WhatsApp confirmation message ({name}, {items}, {total}, {address}…) and an "Awaiting confirmation" status, so you can confirm orders yourself. The WhatsApp OTP goes further: the customer confirms before you get the "New order" email.

= What do I need to send real WhatsApp codes? =
Your own WhatsApp Business number on Meta's WhatsApp Cloud API (an app you create in Meta for Developers) and an approved message template of the Authentication category. The settings page guides you step by step, and "Send test code" tells you which setting is missing or shows Meta's exact error. Test mode lets you try the whole flow first.

= Does it work with the WooCommerce Checkout block? =
Yes. OrderProof works with the classic checkout and the Checkout block, with or without HPOS.

= Does it reduce RTO (return to origin) on COD orders? =
With WhatsApp OTP on, OrderProof stops orders from unverified phone numbers before they reach your courier. It also limits repeat orders per phone and lets you blacklist customers who refused deliveries. We do not publish a reduction figure: results depend on your store and customers.

= What does WhatsApp verification cost? =
OrderProof does not charge per message. Meta bills your WhatsApp Business account for each authentication message; prices depend on the customer's country and are listed on Meta's pricing page.

= Which countries are supported? =
All of them. Each phone number is read with the calling code of the customer's billing country, so a store in France can verify customers in Belgium, Morocco or Canada.

= What happens if a customer never enters the code? =
The order stays in "Awaiting WhatsApp verification" without holding stock, and is cancelled after the number of hours you choose (2 by default).

= Does it work with other payment methods? =
Phone rules, limits and the blacklist can protect every payment method (uncheck "Only Cash on Delivery orders"). WhatsApp OTP applies to Cash on Delivery orders.

== External services ==

This plugin connects to the **WhatsApp Business Platform (Cloud API)**, operated by Meta Platforms, Inc., to deliver one-time verification codes.

* **When:** only if you turn on WhatsApp OTP, turn Test mode off and enter your own Cloud API credentials; then each time a Cash on Delivery order needs verification or the customer asks for a new code.
* **What is sent:** the customer's phone number, the one-time code, and the name and language of your message template, to `https://graph.facebook.com/` with your access token.
* **Terms:** https://www.whatsapp.com/legal/business-terms
* **Privacy policy:** https://www.whatsapp.com/legal/privacy-policy

No other data leaves your site, and nothing is sent while WhatsApp OTP is off or in Test mode.

== Screenshots ==

1. The WhatsApp verification page customers see after a Cash on Delivery order.
2. Order page: verification status, customer history and the WhatsApp confirmation button.
3. Settings: WhatsApp OTP verification with your own WhatsApp Business number, test code button and code limits.
4. Orders list: OrderProof statuses (Awaiting WhatsApp verification, Awaiting confirmation, Delivery refused) and the WhatsApp button and customer badge on each order.
5. Settings: limit duplicate orders per phone number and blacklist phone numbers, emails and IP addresses.
6. Checkout (block): an invalid phone number is refused before the order is created.

== Changelog ==

= 1.2.6 =
* A small "rate OrderProof" box on the OrderProof settings page only, after 14 days of use or 3 blocked orders. "Maybe later" hides it for 30 days; "Don't ask again" hides it for good. No notice on other screens.

= 1.2.5 =
* New setting "Require phone" (on by default): the phone field is required at checkout, in the classic checkout and the Checkout block, because OrderProof needs a phone number to verify the order. Before, the Checkout block could show "Phone (optional)".

= 1.2.4 =
* Plugin URI now points to the product page at https://dssarl.com/orderproof/.
* No functional changes.

= 1.2.3 =
* Plugin author is now Digital Services SARL (https://dssarl.com/).
* Screenshots retaken from the WordPress.org version; captions match the images.
* No functional changes.

= 1.2.2 =
* Admin and verification-page CSS and JavaScript are now loaded with wp_enqueue_style / wp_enqueue_script.
* Translations are delivered by translate.wordpress.org.

= 1.2.1 =
* Faster orders list: each customer's order history is looked up once per page load.
* Plugin name in readme.txt now matches the plugin header.

= 1.2.0 =
* New: step-by-step guide on the settings page for connecting your own WhatsApp Business number.
* New: "Send test code" button that sends a real code to your WhatsApp and shows Meta's exact error if the setup is wrong.

= 1.1.0 =
* New name: OrderProof (formerly COD Guard).
* New: WhatsApp OTP verification for Cash on Delivery orders through the WhatsApp Cloud API. No SMS.
* New: worldwide phone numbers, read with each customer's billing country calling code.
* New: "Awaiting WhatsApp verification" order status; unverified orders hold no stock and are cancelled automatically.
* Fix: the store's "New order" email and the customer's "Processing" email are now sent for orders that use OrderProof statuses.

= 1.0.1 =
* Fix: on stores using the classic order storage, the per-phone order limit and customer history counted every order in the store instead of only that customer's orders.

= 1.0.0 =
* First release.

== Upgrade Notice ==

= 1.2.6 =
Small, dismissible review request on the OrderProof settings page.

= 1.2.5 =
The phone field is now required at checkout (new setting, on by default).

= 1.2.4 =
Plugin website link updated. No functional changes.

= 1.2.3 =
Author details and listing screenshots updated. No functional changes.
