Security is treated as product functionality.
WG Competition Engine handles tickets, prizes and draw eligibility. The commercial build therefore treats permissions, race conditions, imports, exports and auditability as first-class concerns.
Sensitive competition management uses a dedicated capability. Administrators receive it by default; Shop Manager access can remain opt-in.
Per-competition MySQL advisory locks and allocation-time limit checks reduce the risk of simultaneous requests slipping past ticket limits.
CSV exports are hardened against spreadsheet formula injection. Instant-win imports validate upload errors, extension/type, file size, row count and field length.
Scratch-card reveal endpoints include per-user rate limiting alongside ownership and order/ticket checks.
Security-relevant events are logged without storing payment data. IP addresses are represented as keyed hashes rather than plain addresses.
The audit log has automatic retention rather than growing indefinitely; the default policy is 180 days with a minimum of 30 days.
Security is shared with the site owner.
For production use we recommend HTTPS, current WordPress/WooCommerce versions, strong administrator passwords, 2FA, minimal administrator accounts, a reputable WAF/security layer and staging tests before updates.
Staging first
Test plugin and WooCommerce updates away from the live ticket pool.
Least privilege
Give competition-management permissions only to staff who genuinely require them.
Backups & monitoring
Maintain tested backups and monitor unusual order, login or allocation activity.