Privacy and rate limiting

The tracking page is public, so the plugin is careful about what it reveals and how often someone can try.

What is shown and stored#

• Only data for the verified order is shown, and only the fields you enabled under WooCommerce → Order Tracking.
• The phone number is always masked to the last four digits.
• The plugin stores nothing about visitors except a short-lived counter of failed lookups, keyed by a hash of the visitor’s IP address and of the order number tried. These counters expire after 15 minutes.
• Nothing is sent to third parties during a lookup. The carrier link is a normal link the customer chooses to click.

How lookups are protected#

Protection	Details
Nonce	Every form submission carries a WordPress security token. Stale or forged submissions get “Your session has expired”.
Email verification	The email must match the order’s billing email (case-insensitive) unless the visitor is logged in and allowed to view that order.
Rate limit per visitor	After 10 failed lookups from one IP address within 15 minutes, further lookups from that address are refused for the rest of that window.
Rate limit per order number	After 10 failed lookups for the same order number within 15 minutes, further lookups for that number are refused, whichever address they come from. This stops an attacker from guessing emails for one order from many addresses.
Same message for all failures	“Order not found” is shown whether the number is wrong or the email is wrong.

A successful lookup does not reset the counters; they simply expire.

Sites behind a proxy or CDN#

By default the visitor’s address is the connection address (REMOTE_ADDR), which cannot be forged by a visitor. If your site sits behind a reverse proxy or CDN that forwards the real visitor address in a header such as X-Forwarded-For, all visitors share the proxy’s address and could be rate limited together. In that case, tell the plugin to trust the forwarded headers by adding this line to wp-config.php:

define( 'LEET_OT_TRUST_PROXY', true );

The plugin then uses WooCommerce’s own forwarded-header-aware address detection.

Changing the limit#

Developers can change the number of failed attempts with the leet_ot_max_failed_attempts filter; see the Developer reference.