Download

WordPress / WooCommerce

Plugin slug: trivla-account-security. Requires WordPress 5.8+; WooCommerce is optional for customer cleanup features.

Country lookup (ipwhois.io)

When Look up countries online is enabled on the Geo-gate & review tab, and the country is not already known from Cloudflare or the local cache:

• ✓ What is sent: the visitor IP address. The request asks for success and country_code only.
• ✓ Signups: looked up during registration when the country gate is on, so the plugin can decide whether to hold the account.
• ✓ Logins: not looked up during sign-in. A scheduled task fills the login log later.
• ✓ Storage: a successful code is cached for 30 days. A failed lookup is remembered for 6 hours, then retried.
• ✓ Service terms: ipwhois.io/docs

Turn the lookup off on the Geo-gate & review tab to stop these requests. With the Cloudflare option enabled, the plugin can use the CF-IPCountry header instead.

Installation

1. Download the zip above, or upload the trivla-account-security folder to /wp-content/plugins/, or use Plugins → Add New → Upload Plugin.
2. Activate Trivla Account Security on the Plugins screen.
3. Open Account Security in the admin menu. If WooCommerce is active, the same screen is linked under WooCommerce. The old customer-cleanup address redirects here.
4. If you were running the earlier single-file plugin, deactivate that copy first so each login is not recorded twice. Your existing login log and settings are kept.

Frequently asked questions

Does this require WooCommerce?

No. Login logging, failed-login blocking, and the country review queue work without WooCommerce. The Customers tab needs WooCommerce.

Will it delete customers by itself?

Not on a new install. Daily deletion stays off until you turn it on under Customers → Scheduled auto-delete. A manual Run cleanup now button uses the same rules and asks you to confirm.

Sites upgrading from version 1.x keep daily deletion turned on, because that version always ran it.

Which customers can the cleanup delete?

Only users with the Customer role, and never your own account or an account that also has Administrator, Shop manager, Editor, or Author. Choose either 0 orders or the stricter 0 orders, email not verified, and never logged in, plus a minimum account age.

How does email verification get detected?

The plugin reads a user meta key, account_verified by default. Values 1, yes, true, verified, or active count as verified. Anything else present counts as not verified. No meta at all shows as No record. Change the key on the Customers tab to match your verification plugin. Developers can use the tas_verified_meta_key and tas_customer_verified_state filters.

I blocked my own IP. How do I get back in?

Sign in from another network and clear the address under Geo-gate & review. The list is the ccd_blocked_ips option in the WordPress options table. The Block button refuses the address you are currently using; automatic blocking after failed logins can still block a shared address.

Why are all the IP addresses the same?

WordPress is probably behind Cloudflare or another proxy. On Geo-gate & review, enable This site is behind Cloudflare or Trust X-Forwarded-For / X-Real-IP. Leave both off if you are not behind a proxy, so visitors cannot forge an address. Upgrades from version 1.x keep the old behavior of trusting those headers.

What happens to orders when a customer is deleted?

The WordPress account is removed. WooCommerce keeps the orders and detaches them from that account.

Where is the data stored?

Login events are in the {prefix}ccd_login_log table. Settings, the block list, and short notes are WordPress options whose names start with ccd_ or tas_. Uninstalling the plugin from the Plugins screen deletes the table, those options, the pending role, and the signup/login meta this plugin added. It does not delete user accounts.