Encadena SIF

Encadena SIF is an independent plugin. Veri*factu (Verifactu) is the invoice verification system of the Spanish Tax Agency (AEAT): this plugin is not affiliated with, endorsed by or sponsored by the AEAT. Encadena SIF turns every WooCommerce order into a Spanish billing record (registro de facturación) that follows Royal Decree 1007/2023 and Order HAC/1177/2024: it creates the record, chains it with its SHA-256 hash, prints the tax QR and either sends it to the Spanish tax agency (VERIFACTU mode) or keeps it chained locally (non VERIFACTU mode, with event records). It is a Verifactu plugin: Verifactu is how everyone writes it, and Veri*factu is the official name the AEAT uses. Both are the same regulation, and this plugin works either way: with a certificate it submits to the AEAT, and without one it keeps the chain in the shop. The free plugin is complete for one shop and one tax ID: issuing, voiding, corrective invoices, QR, PDF and submission with the shop's own certificate. Nothing is held back behind a licence. What it does, and why it is built this way

• The hash reproduces exactly the official AEAT examples (three cases from the technical specification v0.1.2), and the QR reproduces the four official URL variants.
• Records are immutable: they are only inserted, never updated or deleted. The submission state lives in a separate table, so the fiscal content of a record never changes.
• Independent chains per taxpayer and correlative numbering per series and tax ID.
• The certificate is stored outside the public directory, encrypted, in uploads/encadena-sif-certs/, and its password is encrypted too: it is read from the ENCASI_CERT_PASS constant in wp-config.php when you define it, or from the encrypted copy the plugin keeps next to the certificate.
• PDF invoice with the QR: with PDF Invoices & Packing Slips for WooCommerce active, the invoice carries the record number and date, the customer tax ID, the issuer's fiscal data and the verification QR.
• Compatible with WooCommerce High-Performance Order Storage (HPOS).

What the shop owner never has to fill in The system identifier, its version, the producer and the responsible declaration travel with the plugin. The shop only configures its own data: tax ID, legal name, series, when to invoice, and its certificate.

1. Upload the plugin folder to /wp-content/plugins/, or install it from the zip.
2. Go to Encadena SIF → Issuer and enter the tax ID, the legal name and the series.
3. In Certificate, add define('ENCASI_CERT_PASS', '…'); to wp-config.php and upload your .p12.
4. In Invoicing, choose the mode, the environment (start with AEAT test) and when an order is invoiced.
5. Place a test order and move it to the status that invoices: the record appears in Records.

The full guide ships inside the ZIP, in Spanish and English: guia/GUIA-DE-INSTALACION.pdf and guia/INSTALL-GUIDE.pdf. It covers the two modes, the two environments, the ten-minute check and what to do when something does not add up.

1.5.2

• New: Connect your shop to the console, a card in Settings. The shop shows up in the free console and, from there, Encadena warns by email (and by Telegram, if you link it) when the chain stops, when the AEAT rejects a record or when the certificate is about to expire. Free for one shop, and invoicing never depends on it.
• The shop sends a heartbeat every 15 minutes with the state of the engine only: version, chain, pending and rejected records and certificate expiry. No customer tax ID and no invoice line ever leaves the shop.
• The heartbeat is also sent the moment a retry leaves a record rejected or pending, so the warning does not wait for the next turn.
• Telegram notices are linked from the same card with a single-use link, and they arrive in private to the shop's own chat. Nothing is posted to a group.
• Translations to Spanish, Catalan and Galician are complete and checked screen by screen. A wrongly merged Spanish string that broke the Overview page when there were records waiting to be sent has been fixed.

1.5.1

• Fixed: the migration of the old "vf_" prefix no longer runs on a fresh installation, so it cannot touch other plugins' post metadata. On sites coming from the old version it only renames order and refund meta.

1.5.0

• New: Protection checks, a card in the panel and a single admin notice, that warn when something can make you declare wrongly: another plugin numbering invoices in the same shop, WP-Cron not running (automatic retries to the AEAT stopped), records pending or rejected, a certificate about to expire, and an incomplete or invalid issuer tax ID. They never block invoicing.
• Cancellations: an annulled invoice now shows CANCELLED INVOICE on its PDF (and REPLACED BY … when it was substituted), the order keeps the cancellation's own acceptance state and CSV, the records list labels the cancellation, and a cancellation no longer triggers the tax breakdown check (it carries no amounts).
• Credit notes cannot add up to more than the invoice, down to the last cent: a one-cent tolerance let a 0.01 € credit note slip through on an invoice that was already fully credited.
• The protection checks no longer hide a record rejected as a duplicate (code 3000): it is shown as a warning, because it may be the same document already declared or two different documents with the same number.
• One number per invoice: when an order already carries an invoice number from another plugin, the plugin writes its own number there, so the order and the other plugin's PDF show the same number. Existing orders are unified at once from the notice or from the panel, and the order keeps a note of what was replaced.
• The notice shows only the most serious problem, only to administrators, and can be silenced for 7 days; if the problem changes, it comes back.
• New: Quotes and invoices tab. You can now write a quote for a customer, download it as a PDF and send it by email, and turn it into an invoice when it is accepted.
• The quote is not a tax document: it carries no hash, is not chained and is not sent to the AEAT, and the PDF says so.
• Manual invoices are issued with the same engine as shop orders: chained hash, tax QR, PDF and submission to the AEAT.
• One single series: manual invoices take the next number of the same series as the WooCommerce invoices, so there are never two numbering chains or repeated numbers.
• Credit notes: an issued manual invoice can be credited with a difference credit note (R1, or R5 for simplified invoices) in the same series, with its own record and submission. The original is never deleted or edited.
• The quote PDF carries the site logo when one is set in the theme.

1.4.9

• New: getting-started wizard, in four steps, that opens by itself the first time the plugin is activated: tax details (with the check letter validated as you type), certificate, and how you invoice. It can be left halfway and picked up later, and it stays in the menu as "Getting started".
• New: a help note under every field of the wizard explaining what goes in it and what the AEAT does with it.
• Fix: the issuer tax ID is now checked against its control letter before saving. A wrong one was accepted and every record was rejected later by the AEAT (error 1239), with the invoice already numbered.
• Fix: a non-empty index.php left in the data folder by an earlier version is rewritten empty on upgrade, not only on a fresh install. The folder keeps its .htaccess with Require all denied.

1.4.8

• Fix (plugin review): the data folder in uploads no longer writes a non-empty index.php. It was the last place doing it (includes/class-encasi-remision.php): the directory protection file is now created empty (0 bytes), which is the only form the guidelines allow. The folder keeps its .htaccess with Require all denied, so nothing inside can be listed or fetched.
• Fix: the internal version constant ENCASI_VERSION was still 1.4.6, so the panel, the record header and the AEAT submission reported an older version than the release. It now follows the plugin version.

1.4.7

• Removed: the plugin's own update checker. In the directory the updates come from WordPress.org, and a plugin hosted here must not carry its own updater. The release is otherwise the same.
• Fix (plugin review): the certificate folder no longer writes an index.php with content. It is created empty, which is the only form the directory allows; the folder keeps its .htaccess (deny) and an empty index.html, so the certificate stays unreachable from the browser.
• Fix (plugin review): the two remaining defines without the plugin prefix, VFRUNTIME and VFRUNTIME_VERSION, are now ENCASI_RUNTIME and ENCASI_RUNTIME_VERSION. No behaviour changes: it is the same runtime marker, renamed as the review guidelines require.
• Translations: Spanish, Catalan and Galician for the new changelog lines.

1.4.6

• New: when the AEAT rejects a record, the reason now opens in a dialog on the order screen, with what happened and what to do, instead of being left only in the order notes at the bottom of the page. It opens by itself once per session; the "See what happened" button next to the status reopens it.
• New: the most recent rejected record in the Records tab also opens its explanation by itself.
• New: 3000 and 2007 added to the explanation dictionary, and 4104 corrected: it is "tax ID not identified", not an expired certificate.
• Translations: Spanish, Catalan and Galician for the new texts.

1.4.5

• Fix: a 3000 "duplicate" answer from the AEAT is no longer shown as accepted. The AEAT answers EstadoEnvio "Incorrecto" when a different invoice already uses that number and date, so the invoice never entered; the panel used to say "accepted" and the QR led nowhere.
• New: "Starting number" setting. When the counter restarts (fresh install, wiped data) the numbering began again at 1 and collided with the invoices the AEAT already had. Set the number to start above the last one used.
• New: the error hint for 3000 and 2007 explains what to do (same invoice already declared, or change the series).

1.4.4

• Every global identifier moved from the short "vf_" prefix to "encasi_" / "ENCASI_", as required by the plugin directory guidelines. Existing settings, invoices, submission log and order metadata are migrated once on upgrade, so no data is lost.
• The certificate folder is now resolved with wp_upload_dir() and lives in uploads/encadena-sif/certs; certificates saved in the previous locations are moved automatically.

1.4.3

• New version notices: the plugin checks farowp.com twice a day and, when there is a newer release, it shows up in Plugins → Updates and installs with the usual button. Until now a shop could keep the version it installed on day one for years, which in a billing program means issuing invoices with a system that no longer complies. Nothing is sent from your site: it is a plain read of a public file.
• If the plugin is ever published on WordPress.org, this notice steps aside on its own and updates come from the official repository.

1.4.2

• The declaration of responsibility (article 15 RRSIF) now arrives closed in the Help tab, behind a button that opens it in place: it does not reload the page and needs no JavaScript. The text, the PDF download and the missing-data warning are the same; only the initial state changes.

1.4.1

• New Report a problem box in the Help tab: it shows the details needed to reproduce a failure (plugin, core, WordPress, WooCommerce and PHP versions, mode, environment and certificate state), with a button to copy them and another to write the report by email. It never sends anything on its own, and it carries no tax ID, no customer data and no certificate path.
• The testers' channel can be added to that box from a filter, without touching the plugin.

1.4.0

• New name: the plugin is now Encadena SIF. Only the visible name, the slug and the text domain change; the settings, the billing records and the certificate stay where they were, so updating does not lose anything.
• The name shown inside the plugin (menu, screens, schedule label and notices) is the same as in the directory.
• The locale files are renamed to the new text domain.
• Scripts are enqueued with wp_enqueue_script() / wp_add_inline_script(): no raw <script> tags are printed.
• Every output is escaped (esc_html, esc_attr, esc_url, wp_kses_post).
• All functions, options, constants and tables carry the plugin prefix.
• Requests to the AEAT and to Telegram go through the WordPress HTTP API (wp_remote_post()); the client certificate is attached with the http_api_curl hook.
• The certificate is stored in uploads/encadena-sif-certs/, not in wp-content/; the file of an older installation is moved there automatically on the first upload or on the first request.
• The settings are sanitized with a callback of their own, and the certificate path is checked against the folder the plugin uses (realpath, no traversal).
• Secrets on disk (certificate password, Telegram token, SMTP password) are encrypted with AES-256-GCM and a local key file. No external process is started in any system.
• External services (AEAT and Telegram) are documented in the readme: what is sent, when, and their terms and privacy links.

1.3.2

• First public release. The readme also spells it "Verifactu", as most people write it, so the search finds it.

1.3.1

• Initial submission. The interface is in English and fully translatable (456 strings); the Spanish translation is published on translate.wordpress.org.

1.2.0

• Internal build. The plugin is free and complete for one shop and one tax ID; the paid edition (Encadena SIF SIF Pro) will add multi-shop management and support.
• Distribution and licence metadata prepared for the WordPress.org directory.

1.1.1

• Complete responsible declaration: address, contact email, legal representative, place of signature and availability come from the producer and travel with the plugin.
• The panel shows the whole document and warns about missing data.
• The declaration can be downloaded as a PDF from the Help tab.

1.1.0

• Step-by-step, collapsible guide in every panel tab.
• Warning when the tax ID and the name do not match (the AEAT 4104 error).
• Warning for a certificate saved on disk but not linked to the settings.
• Red warning while in Production, so nobody declares by accident.

1.0.2

• AEAT failures (SOAP <Fault>) are stored as rejections with their code and reason.
• Added the hint for error 4104.

1.0.1

• Fixed: the certificate was uploaded and encrypted but the panel kept saying "No certificate".
• Uploading a certificate removes the other extension (.p12 or .pfx).
• The panel shows the certificate holder and tax ID without the full distinguished name.

1.0.0

• Own tabbed panel (Summary, Issuer, Invoicing, Certificate, Records, Help) with status checks.
• Every invoicing option explained on screen.
• Producer data and the responsible declaration no longer asked from the shop.
• PDF invoice with the tax QR and the verification texts.

0.1.0

• First development version: record core (hash verified against the official AEAT examples), immutable store, settings, diagnostics panel and responsible declaration.