Security & Fraud Prevention

Security & Fraud Prevention in Ultimate Spin Wheel

No single anti-fraud check is perfect on its own. Cookies can be cleared, IP addresses can change, and email addresses can be faked. Ultimate Spin Wheel therefore uses a layered model: each layer stops a different class of abuse, and together they make casual cheating far more trouble than it is worth. This guide explains which protections run in the free plugin, which are handled on the server, and which are Pro-only upgrades.

Key facts:

• The winner is drawn on the server, not in the browser. Every spin is validated (nonce, campaign published, required fields) and the winning slice is chosen server-side with WordPress’s cryptographically secure wp_rand() before the wheel animates. There is no client-side value a visitor can change to force a prize.
• Manual IP and device blocking is free. You can block any abusive visitor’s IP address and device ID; a blocked visitor is rejected on the server on every spin attempt.
• Disposable-email blocking is free. A bundled list of known throwaway email providers can be rejected before a spin is allowed.
• Per-user spin limits (cooldown / identity check) are a Pro feature, as is true device fingerprinting.

Layer 1: The Browser & Device

The first layer runs in the visitor’s browser and identifies the device they are using:

• Device ID cookie: The plugin stores a random device identifier in a uspw_device_id cookie so returning visitors can be recognised. This is a soft check — a determined user who clears cookies and storage will get a new ID — which is why it is backed by the server-side layers below.
• Per-user cooldown / identity check (Pro): Limiting each person to one spin per set number of hours or days — keyed by email, phone, or both — is a Pro capability. In the free plugin there is no automatic per-user spin limit.
• Device fingerprinting (Pro): Hardware/browser fingerprinting that survives incognito mode is a Pro feature. The free plugin’s device ID is a simple cookie value, useful mainly as a handle for manual blocking.

Layer 2: The Network (IP)

• IP blocking: Add an abusive visitor’s IP address to the blocklist and the server rejects every spin attempt from that address with an “access restricted” response. This is a manual blocklist you control — not an automatic per-hour request throttle. See the IP Blocking & Limits guide.
• WAF friendly: Because the block check happens inside WordPress, the plugin works alongside Cloudflare and other Web Application Firewalls rather than fighting them.

Layer 3: The Data (Email & Coupons)

• Server-side field validation: Required fields and email format are re-checked on the server, so editing the form in the browser cannot bypass them. See Email Validation.
• Disposable-domain block: When enabled in Settings → Security, spins from known burner-email providers are rejected with a message you can customise. This runs in the free plugin. See Disposable Email Blocking.
• Unique coupon pools (free): Give a prize a fixed list of single-use codes. Each winner gets a different code and, once the pool is exhausted, the slice is automatically dropped from the draw — a hard cap on how many times that prize can be handed out. Auto-generated and WooCommerce Dynamic coupons (with individual-use and expiry rules) are Pro features.

Layer 4: The Admin (Your Controls)

• Block from the leads dashboard: Each entry has a Block IP/Device action that adds both that visitor’s IP address and device ID to the blocklist in one click. Blocked entries are flagged with a “Blocked” indicator.
• Unblock at any time: Blocked IPs and device IDs are listed in Settings → Security, where you can remove any of them to restore access. See Manual Blocking.
• Secure server-side draw: Because the result is decided on the server before the animation and real coupon codes are never placed in the page source until a win is confirmed, there is no prize a visitor can “reach” by inspecting the page.

Best Practices Checklist

1. Enable Disposable Email Blocking in Settings → Security so throwaway addresses cannot harvest codes.
2. Use Unique Pool coupons with a limited number of codes so a valuable prize can only be won a fixed number of times.
3. Watch your leads dashboard and use Block IP/Device on any address that is clearly farming spins.
4. For automatic per-person spin limits (one spin per day/week keyed by email or phone), upgrade to Pro and enable the cooldown / identity check.

Frequently Asked Questions

Do I still need Google reCAPTCHA?

For most promotions the combination of server-side validation, disposable-email blocking, unique single-use coupon pools, and manual IP/device blocking removes the bulk of casual abuse without adding a CAPTCHA step that hurts conversion. If you run a very high-value promotion, add the Pro per-user cooldown for a hard per-person limit.

What if a legitimate visitor gets blocked?

A visitor is only blocked if their IP address or device ID is on your blocklist. Because several people can share one office or school IP, open Settings → Security, find the address or device ID, and remove it to let them play again.

Is this GDPR friendly?

Yes. Leads (including IP addresses) are stored in your own database, not sent to any external security service. You can require a GDPR consent checkbox before entry and set a data-retention period in the plugin’s settings.

Can a visitor hack the wheel to win the top prize?

No. The winner is chosen on the server with a secure random generator before the animation begins, and the browser only plays back the pre-decided result. Real coupon codes stay on the server until the win is confirmed.

Related Documentation

• IP Blocking & Limits: How the IP and device blocklist works.
• Disposable Email Blocking: Reject throwaway email providers.
• Email Validation: Server-side email and required-field checks.
• Manual Blocking: Block and unblock visitors from the leads dashboard.

Conclusion

Security in Ultimate Spin Wheel is layered: a secure server-side draw at the core, free disposable-email and manual IP/device blocking around it, and Pro cooldown and fingerprinting on top for high-value campaigns. Stack the protections that fit your risk level so your rewards reach real customers. If you need help, visit the wowDevs support center.