=== HULO Fraud Prevention Pro ===
Contributors: huloglobal
Tags: fraud prevention, review queue, payments, chargeback, risk score
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 0.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Pro add-on for HULO Fraud Prevention: refuses or holds risky payments for review, threat feeds, alerts. Holds shop orders too.

== Description ==

Needs the free HULO Fraud Prevention plugin. Works on any WordPress site with HULO Payments. With WooCommerce it also holds shop orders.

* Enforce mode. A payment at the block threshold is refused before it is charged. A payment at the review threshold waits in the Review queue.
* Review queue for payments. Approve captures an authorised (manual-capture) payment. Reject releases the authorisation, or refunds a captured payment through HULO Payments. Reject can also quietly blocklist the e-mail and IP.
* Review queue for shop orders (WooCommerce). Risky orders wait in a "Fraud review" order status. Approve sends the order on to the status it was heading for. Reject cancels it and refunds through the gateway when the gateway supports refunds; otherwise it tells you to refund by hand.
* Fulfilment gate (WooCommerce). Downloads stay locked while an order is held, and a virtual order waits at Processing until it has been scored. Other code can use `hulo_fraud_prevention_can_fulfil( $id, $source )` or `GET /wp-json/hulo-fraud-prevention-pro/v1/gate/<source>/<id>`.
* Auto-approval after a set number of hours unreviewed
* Threat feeds synced nightly at 03:00: FireHOL Level 1, Spamhaus DROP, Tor exit nodes and disposable e-mail domains, plus your own feed URLs and presets
* Alerts by e-mail, Slack, Discord, Microsoft Teams, Telegram or a signed webhook, including for payments refused before the charge
* Customer messages for held, approved and rejected payments and orders. They use your WooCommerce e-mail template when WooCommerce is active, and a simple template otherwise.
* Weekly report e-mail and a setup checklist

Every install starts with a 14-day evaluation with every feature on, no card. After that, subscribe or buy a lifetime licence from the plugin page. If the licence lapses, all settings, cases and feed entries are kept. Enforce mode, feed sync and alerts pause until a licence is installed, and cases already open can still be approved or rejected.

== Installation ==

1. Install and activate the free HULO Fraud Prevention plugin. To score payments, also install HULO Payments; WooCommerce is optional.
2. Upload this plugin's zip under Plugins → Add New → Upload, and activate it.
3. Open HULO → Fraud Prevention, pick Enforce under Rules, and set an alert e-mail under Alerts & messages.
4. To hold payments for review instead of charging them at once, set the HULO Payments form or pay link to manual capture (authorise only).

== External services ==

* HULO licence server (elite.charity): evaluation registration, licence check, revocation list and a daily heartbeat. These send this site's anonymous instance id, the plugin version and usage counts (numbers only, no customer data). Updates are checked against huloglobal.com.
* Threat feeds: daily downloads from raw.githubusercontent.com (FireHOL, disposable-email-domains), check.torproject.org and www.spamhaus.org, plus any custom feed URLs you add. Nothing is sent beyond the request itself.
* Chat alerts go to the Slack, Discord, Teams, Telegram or webhook URLs you enter. They carry the payment or order reference, the score and the signal names.

== Changelog ==

= 0.1.0 =
* First release. Enforce mode for HULO Payments payments: refused before the charge at the block threshold, held for review at the review threshold. Approve captures; reject releases or refunds. With WooCommerce: the "Fraud review" order status, cancel and refund on reject, and the fulfilment gate. Also auto-approve, threat feeds and custom feeds, e-mail and chat alerts, customer messages, weekly report and REST routes.
