Stackedboost Email Guard – Block Disposable & Fake Emails for WooCommerce

Bad email addresses cause failed deliveries, chargebacks, fake accounts, and support tickets. Email Guard checks the customer’s address at checkout and blocks disposable email before the order goes through, entirely on your own server, with no account required.

It ships with a bundled list of over 8,200 disposable email and temporary email domains, a map of the typos people actually make, and your own block and allow lists. Every check runs locally. The plugin makes no outbound request of any kind unless you deliberately activate a Pro licence key.

The problem, stated plainly

A disposable email address is a working inbox that is designed to stop working. Services like Mailinator, Guerrilla Mail, 10 Minute Mail and several thousand others hand out an address that receives mail for a few minutes or a few hours and then discards it, usually without asking anyone to register. Some of them publish hundreds of alternate domains precisely so that blocklists cannot keep up.

None of that is inherently sinister. People use throwaway email to avoid newsletters, to test something, or to sign up for a download they will never come back to. That is fine on a blog. It is a problem on a shop, because an order carries obligations that a ten-minute inbox cannot meet.

Here is what actually goes wrong when a disposable email address reaches an order:

• The order confirmation bounces. The address stops accepting mail before your transactional email arrives, or it accepts the mail and deletes it. The customer never receives an order number.
• The shipping notification never lands. The customer has no tracking link, so they either wait or they contact you.
• The support thread starts. You now handle by hand what your automation was supposed to handle, and you are answering somebody who cannot receive your reply.
• Your sender reputation erodes. Repeated hard bounces to dead domains tell mailbox providers that your list is poorly maintained. That affects delivery of every other email you send, including to customers whose addresses are perfectly good.
• Discount and trial abuse gets cheap. If a coupon is limited to one per customer, or a first-order discount exists, a supply of fresh throwaway addresses makes that limit meaningless.
• Chargeback risk rises. An order placed behind a disposable address is harder to trace and harder to defend, because the one contact channel you have is gone by the time the dispute arrives.

Not every disposable address is fraud. Most of it is friction. The point of Email Guard is to remove the friction at the one moment it is cheap to remove, which is before the order exists.

What Email Guard does

Email Guard hooks into WooCommerce checkout validation and account registration. When a shopper submits an address, the plugin runs four checks in a fixed order and either lets the order through or stops it with a message the shopper can act on.

1. Your allow list wins over everything.

If the domain is on your allow list, the address passes immediately and no further check runs. This is deliberate and it is checked first, before anything else, including the bundled list of 8,200 domains. At that size a false positive stops being hypothetical, and a shop owner needs a way to overrule the plugin that does not mean switching protection off for everybody. If a real customer is ever refused, you add their domain and they are through, permanently.

2. Your own blocklist.

Domains you have added yourself are refused next. This is for the addresses that are not disposable but that you do not want ordering: a competitor, a domain that has produced repeated fraud, a free provider your business does not serve. It is your list, it is checked on every order, and it takes precedence over the typo and disposable checks below.

3. Likely typos, with a correction offered.

If the domain looks like a near-certain mistake, the shopper is shown the corrected address rather than a flat refusal. “Did you mean bob@gmail.com?” recovers a sale that a plain error message loses. The bundled typo map covers 34 of the mistakes people make most often on the large providers. It handles the two distinct kinds. Misspelled names: gmial.com, gnail.com, gamil.com, hotmial.com, hotmali.com, yhaoo.com, outlok.com. And truncated or fumbled endings, which are just as common and easier to miss: gmail.con, gmail.co, yahoo.con, outlook.co, icloud.con, aol.co, live.con, protonmail.con.

The providers covered are Gmail, Hotmail, Yahoo, Outlook, iCloud, AOL, Live and Proton Mail, which between them account for the overwhelming majority of consumer addresses that reach a shop.

This check runs before the disposable check, which is not an accident. Several well-known typosquats are on the disposable list, because somebody registered them specifically to catch mistyped mail. Checking disposable first told a shopper who fat-fingered “gmail” that disposable addresses are not accepted. True of the domain, and completely useless to the person trying to buy something. The order is stopped either way. This way they can fix it.

4. The bundled disposable email list.

Finally, the address is checked against over 8,200 known disposable email and temporary email domains. The list is a file inside the plugin, not a service call, so it works whether or not your server can reach the internet, and no customer address is ever transmitted anywhere.

Subdomain matching, and why it matters

Throwaway providers hand out addresses on subdomains constantly. A service listed as example.com will happily issue you an address at mail.example.com, inbox.example.com or a random string in front of it. A blocklist that only compares the whole domain string misses every one of those.

Email Guard walks the labels of the address domain from the left and stops when two labels remain. An address at deep.sub.mailinator.com is tested as deep.sub.mailinator.com, then sub.mailinator.com, then mailinator.com, and is refused on the last one. The same walk applies to your own blocklist, so adding competitor.com also covers shop.competitor.com without you listing it.

Over-stripping is safe here. A candidate only has an effect if it is actually present in one of the lists, and real public suffixes are not. Testing “co.uk” against the list costs one array lookup and cannot produce a false positive, because “co.uk” is not a disposable domain and nobody would put it on a blocklist.

Where the checks run

Email Guard validates in three places, which between them cover how WooCommerce actually takes orders:

• Classic checkout (the shortcode checkout), through woocommerce_after_checkout_validation. A blocked address surfaces as a checkout notice and the order is not created.
• Block checkout (the Cart and Checkout blocks, via the Store API). A blocked address stops the order when “Place order” is pressed and the message appears in the block’s error state. Many email plugins only ever hooked the classic checkout and silently do nothing on a block-based store. This one handles both.
• Account registration, through woocommerce_registration_errors, which covers both the My Account registration form and the create-an-account option during checkout.

If WooCommerce is not active, the plugin does nothing to your site except show an admin notice explaining that it needs WooCommerce. It does not touch WordPress core registration, the comment form, or any contact form.

What this plugin deliberately does not do

Being specific about scope is more useful than claiming everything.

• It is WooCommerce-only. It protects checkout and WooCommerce account registration. It does not filter WordPress core registration, comments, or contact form submissions. If you want to block disposable email on a site that has no shop, this is the wrong plugin.
• It does not verify that a mailbox exists. Checking whether a specific inbox is real requires talking to the receiving mail server at the moment of the order. The free version makes no outbound requests, so it cannot do that, and it does not claim to. Domain-level checking catches disposable providers and typos, which is the overwhelming majority of what goes wrong.
• It does not score orders for fraud. It makes a yes or no decision on an address at checkout. It does not analyse payment method, address mismatch, order velocity or device.
• It does not send anything anywhere. No telemetry, no analytics, no phone-home licence check on the free version. This is a promise about the code, and it is easy to verify: search the plugin directory for wp_remote_ and you will find outbound calls only in the Pro licence activation path, which runs only if you enter a key.

Privacy, and what is stored

The plugin’s whole pitch is that it makes no outbound requests and keeps no customer data, so it is worth being exact about the small amount it does record.

What is stored: counters in your site’s own options table. How many blocks fired, split by reason. Which domains were refused and how many times. Which typo corrections were offered. A daily count for the last 30 days so the dashboard can draw a line. That is it.

What is not stored: no email addresses. The local part of the address is discarded before anything is written. No names, no order IDs, no IP addresses, no user agents. A domain is not personal data: “mailinator.com” identifies a mail provider, not a person.

Where it is stored: the sbeg_stats option on your own site, written with autoload set to false so it is not loaded on front-end requests. It is never transmitted.

When it is written: only when a block actually fires, which on a typical shop is a few times a week rather than once per checkout. Nothing is written on a normal order.

Growth is capped. The daily series keeps 30 days. The domain and typo tables keep the 12 most frequent rows. A shop hit by many distinct throwaway domains cannot grow the option without bound.

On uninstall, the plugin deletes sbeg_settings, sbeg_stats, sbeg_review_dismissed and sbeg_license. Removing the licence record does not release the activation slot on your account; that stays with you to manage.

Performance

The bundled domain list is a plain newline-delimited text file of about 116 KB. It is read on the first check that actually needs it and not before.

That laziness is the point. The plugin is loaded on requests that never validate an address, and holding 8,201 domains permanently in memory to answer a question that only arises at checkout is waste. Shipped as a PHP array it would have been roughly a quarter of a megabyte held in opcache on every single request. Read from a file on demand it costs nothing until it is needed, and once per request after that.

Lookups are array key hits, not string scanning, so a single check is a handful of hash lookups regardless of whether the list holds 50 domains or 8,201.

The dashboard

Under WooCommerce > Email Guard you get a screen that answers one question: is this thing doing anything?

• Total addresses refused, split into disposable, typo and your own blocklist.
• A 30-day line so you can see whether it is a steady trickle or a spike.
• The domains that were refused most often, so you can see who is actually hitting you.
• The typo corrections that were offered, and to what.
• A live tester: type any address and see exactly what checkout would do with it. It runs the same validator the checkout uses and does not touch your counters.
• An example view, if you have no data yet, that shows what the screen looks like on an active shop. It is clearly labelled, it is generated on the spot, and nothing is saved to your database.

Email Guard Pro (optional)

Pro is not a bigger list. The free list is not limited in any way and Pro does not extend it.

Pro is the set of checks that a bundled file cannot perform at all, because they need a live lookup at the moment the order arrives:

• DNS and MX deep scan, to catch domains that resolve but cannot receive mail at all. A bundled list cannot know this; it changes.
• Post-order risk scoring and automatic order tagging, so risky orders are flagged in your order list before you pick and ship.
• Instant alerts when a risky order lands.
• A hosted risk dashboard across your orders.

Pro is a separate add-on from Stackedboost and is not required to use the free version. Everything listed above under the free version keeps working whether or not you ever buy it, and keeps working if a Pro licence lapses.

Available at https://stackedboost.com/woocommerce/stackedboost-email-guard/

Credits

The bundled domain list is derived from the disposable-email-domains project, dedicated to the public domain under CC0 1.0. Attribution is not required by that licence; it is given because the work deserves it.