WordPress Security for Travel Sites: Protecting Bookings and Customer Data

Travel websites handle sensitive customer information including passport details, payment data, and travel itineraries. Protecting this data requires robust security measures tailored to the travel industry.

Travel Site Security Challenges

Travel websites face unique threats:

• Booking fraud and fake reservations
• Payment card theft and fraud
• Identity theft through passport data
• Account takeover for loyalty points
• Competitive scraping of prices

Sensitive Data Types

Travel sites typically collect:

• Full legal names matching ID documents
• Passport numbers and expiration dates
• Date of birth and nationality
• Payment card information
• Travel dates and destinations
• Loyalty program numbers and points

Secure Booking Form Processing

Handle booking data securely:

function process_travel_booking($booking_data) {
    // Verify nonce
    if (!wp_verify_nonce($booking_data['nonce'], 'travel_booking')) {
        return new WP_Error('invalid_nonce', 'Security verification failed');
    }

    // Sanitize passenger details
    $passengers = array();
    foreach ($booking_data['passengers'] as $passenger) {
        $passengers[] = array(
            'first_name' => sanitize_text_field($passenger['first_name']),
            'last_name' => sanitize_text_field($passenger['last_name']),
            'dob' => sanitize_text_field($passenger['dob']),
            'passport' => preg_replace('/[^A-Z0-9]/i', '', $passenger['passport']),
            'nationality' => sanitize_text_field($passenger['nationality']),
        );
    }

    // Encrypt sensitive data before storage
    $encrypted_passengers = encrypt_booking_data($passengers);

    return save_booking($encrypted_passengers);
}

Encrypting Passport Information

Always encrypt passport and ID data:

function encrypt_booking_data($data) {
    $key = defined('TRAVEL_ENCRYPTION_KEY') ? TRAVEL_ENCRYPTION_KEY : wp_salt('auth');
    $iv = random_bytes(16);

    $encrypted = openssl_encrypt(
        json_encode($data),
        'AES-256-CBC',
        $key,
        0,
        $iv
    );

    return base64_encode($iv . $encrypted);
}

function decrypt_booking_data($encrypted_data) {
    $key = defined('TRAVEL_ENCRYPTION_KEY') ? TRAVEL_ENCRYPTION_KEY : wp_salt('auth');
    $data = base64_decode($encrypted_data);

    $iv = substr($data, 0, 16);
    $ciphertext = substr($data, 16);

    $decrypted = openssl_decrypt(
        $ciphertext,
        'AES-256-CBC',
        $key,
        0,
        $iv
    );

    return json_decode($decrypted, true);
}

Fraud Detection

Implement booking fraud checks:

function check_booking_fraud($booking) {
    $risk_score = 0;
    $flags = array();

    // Check for velocity - multiple bookings from same IP
    $recent_bookings = get_bookings_by_ip($_SERVER['REMOTE_ADDR'], '-1 hour');
    if (count($recent_bookings) > 3) {
        $risk_score += 30;
        $flags[] = 'Multiple bookings from same IP';
    }

    // Check email domain
    $email_domain = substr(strrchr($booking['email'], "@"), 1);
    $disposable_domains = array('tempmail.com', 'throwaway.com', 'mailinator.com');
    if (in_array($email_domain, $disposable_domains)) {
        $risk_score += 40;
        $flags[] = 'Disposable email address';
    }

    // Check departure date (last-minute bookings higher risk)
    $days_until_travel = (strtotime($booking['departure_date']) - time()) / 86400;
    if ($days_until_travel < 2) {
        $risk_score += 20;
        $flags[] = 'Last-minute booking';
    }

    // Geographic mismatch
    $ip_country = get_country_from_ip($_SERVER['REMOTE_ADDR']);
    if ($ip_country !== $booking['billing_country']) {
        $risk_score += 15;
        $flags[] = 'IP country mismatch';
    }

    return array(
        'score' => $risk_score,
        'flags' => $flags,
        'action' => $risk_score > 50 ? 'review' : 'approve',
    );
}

Loyalty Program Security

Protect loyalty points and accounts:

// Require re-authentication for point redemption
function require_reauth_for_redemption() {
    $last_auth = get_user_meta(get_current_user_id(), 'last_password_confirm', true);

    if (!$last_auth || (time() - $last_auth) > 300) { // 5 minutes
        return new WP_Error('reauth_required', 'Please confirm your password');
    }

    return true;
}

// Log all point transactions
function log_points_transaction($user_id, $points, $type, $description) {
    global $wpdb;

    $wpdb->insert('points_audit_log', array(
        'user_id' => $user_id,
        'points' => $points,
        'type' => $type,
        'description' => $description,
        'ip_address' => $_SERVER['REMOTE_ADDR'],
        'user_agent' => $_SERVER['HTTP_USER_AGENT'],
        'created_at' => current_time('mysql'),
    ));
}

// Alert on suspicious point activity
function monitor_points_activity($user_id, $points_redeemed) {
    $daily_redemptions = get_user_daily_redemptions($user_id);

    if ($daily_redemptions > 10000) {
        wp_mail(
            get_option('admin_email'),
            'High points redemption alert',
            sprintf('User %d redeemed %d points today', $user_id, $daily_redemptions)
        );
    }
}

Price Scraping Protection

Prevent competitors from scraping prices:

function protect_price_data() {
    // Rate limit price API calls
    $ip = $_SERVER['REMOTE_ADDR'];
    $key = 'price_requests_' . md5($ip);
    $requests = get_transient($key) ?: 0;

    if ($requests > 50) { // 50 requests per minute
        wp_die('Rate limit exceeded', 'Too Many Requests', 429);
    }

    set_transient($key, $requests + 1, MINUTE_IN_SECONDS);

    // Block known scraper user agents
    $scrapers = array('Scrapy', 'HTTrack', 'curl', 'wget', 'python-requests');
    $ua = $_SERVER['HTTP_USER_AGENT'] ?? '';

    foreach ($scrapers as $scraper) {
        if (stripos($ua, $scraper) !== false) {
            wp_die('Access denied', 'Forbidden', 403);
        }
    }
}

Data Retention

Implement compliant data retention:

function cleanup_old_booking_data() {
    global $wpdb;

    // Remove detailed passport data after travel completion + 30 days
    $wpdb->query("
        UPDATE bookings
        SET passport_data = NULL
        WHERE travel_date < DATE_SUB(NOW(), INTERVAL 30 DAY)
        AND passport_data IS NOT NULL
    ");

    // Archive bookings older than 2 years
    $wpdb->query("
        INSERT INTO bookings_archive
        SELECT * FROM bookings
        WHERE created_at < DATE_SUB(NOW(), INTERVAL 2 YEAR)
    ");

    $wpdb->query("
        DELETE FROM bookings
        WHERE created_at < DATE_SUB(NOW(), INTERVAL 2 YEAR)
    ");
}

Conclusion

Travel site security requires encrypting sensitive passport data, implementing fraud detection, protecting loyalty programs, and maintaining compliant data retention. Regular security audits ensure ongoing protection.