About this plugin
Cash on Delivery (COD) is essential for e-commerce growth in many regions, but fraudulent orders, impulsive checkouts, and wrong delivery addresses cost merchants substantial fulfillment and return shipping fees.
SazCOD – COD Order Confirmation for WooCommerce is a lightweight, 100% self-hosted plugin that automatically intercepts COD orders containing physical goods and places them into a custom status: Awaiting Confirmation.
The buyer receives an actionable confirmation block in their order email. Clicking the link takes the customer to a secure verification screen where they explicitly confirm their order. Once confirmed, the order instantly transitions to Processing so your warehouse can safely begin packing.
Key Features
- Zero External Dependencies: 100% self-hosted. No external APIs, SMS gateways, or recurring subscriptions.
- WooCommerce HPOS Compatible: Fully compatible with High-Performance Order Storage ( custom_order_tables ).
- Block Checkout & Classic Checkout Support: Intercepts COD orders across both WooCommerce Checkout Block (Store API) and classic shortcode checkouts.
- Smart Physical Goods Detection: Only intercepts orders requiring physical shipping; virtual and digital orders pass through normally.
- Hardened Token Security Architecture:
- Cryptographically random, SHA-256 hashed tokens bound to the unique order.
- Encrypted at rest using AEAD AES-256-GCM with order-bound additional authenticated data ( v1:{order_id} ).
- Strict anti-cache headers ( Cache-Control: no-store, no-cache ) to prevent intermediate caching of confirmation screens.
- Synchronized 48-hour WordPress nonce lifetime matching the token TTL.
- Pre-commit business guards verifying COD payment method, awaiting-confirm status, and token hash.
- Sequential token revocation and native WooCommerce order state machine transitions to eliminate double-confirmation races.
- Post/Redirect/Get (PRG) flow with single-use opaque result tokens to eliminate order status enumeration.
- Strict Content Security Policy ( default-src 'none' ), Referrer-Policy, and anti-tampering checks.
- Responsive, Clean UI: Mobile-friendly confirmation screen rendered using native styles without heavy frontend libraries.
Privacy Policy
The plugin does not transmit customer order data to external services or third-party servers. It stores only confirmation-related metadata ( _qcoc_confirmed_at ) in the local WooCommerce order. Customer information displayed on the self-hosted confirmation screen is retrieved directly from the merchant’s local WordPress database.