EU Withdrawal Button for WooCommerce
| 开发者 | riinagency |
|---|---|
| 更新时间 | 2026年4月24日 15:00 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 6.9 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
EU Directive 2023/2673 introduces new requirements for online stores regarding consumer withdrawal rights, taking effect on June 19, 2026.
EU Withdrawal Button for WooCommerce helps you implement a clear, accessible withdrawal flow for your customers:
The 4-Step Flow
- Visible Button — Sticky bar with a withdrawal button on every page
- Withdrawal Form — Customer enters order number + email for verification
- Confirmation Step — Order summary with a separate "Confirm withdrawal" button
- Notifications — Confirmation email to customer + notification to merchant
- Sticky bar with configurable text and button
- Modal popup or dedicated page mode
- Order validation (order number + email + 14-day window check)
- Custom WooCommerce order status: "Withdrawal Requested"
- WooCommerce email integration (shows in WooCommerce → Settings → Emails)
- Support for custom order number plugins (Sequential Order Numbers, etc.)
- WCAG 2.1 AA accessible (keyboard navigation, focus trap, ARIA labels)
- Rate limiting for abuse prevention
- Translation-ready with .pot file
- HPOS (High-Performance Order Storage) compatible
安装:
- Upload the
eu-withdrawal-button-for-woocommercefolder to/wp-content/plugins/ - Activate the plugin through the 'Plugins' menu in WordPress
- Go to WooCommerce → Settings → Withdrawal Button to configure
- The withdrawal button will appear on your storefront
屏幕截图:
常见问题:
What does this plugin do?
It adds a visible withdrawal button to your store, along with a form where customers can submit withdrawal requests. The plugin validates the order, notifies both parties via email, and tracks the request.
What happens when a customer submits a withdrawal?
The customer receives a confirmation email, the merchant receives a notification, an order note is added, and the order status changes to "Withdrawal Requested" (configurable).
Can I exclude certain products?
Product category exclusions and per-product exceptions are available in the paid version.
Does it work with custom order number plugins?
Yes, the plugin searches by WooCommerce order ID, custom order number meta fields, and order number output — compatible with Sequential Order Numbers and similar plugins.
Is my data sent to third parties?
The plugin stores withdrawal data in your own WordPress database. The Freemius SDK is used for license management and asks for your opt-in consent on activation.
更新日志:
2.0.0
- WordPress.org edition. First release published on the WordPress.org plugin directory. Feature parity with 1.5.x, Lite tier only. Paid upgrades continue to be distributed via riin.eu.
- Code: Full prefix refactor to
ra_euwb_/RA_EUWB_/ra-euwb-across options, hooks, CSS classes, JS globals, nonces and admin menu slugs, to comply with the WordPress.org guidelines on unique prefixes. Existing WC order status slugs (wc-ewb-withdrawn,wc-ewb-completed), the database table ({prefix}ewb_withdrawals) and the_ra_euwb_deactivated_withdrawalorder meta key are preserved so existing installations continue to work without data migration. - Code: Removed all inline
<style>and<script>output. Admin order-status colours and the frontendra-euwb-hiddenutility class are now part of the enqueued stylesheets. Frontend button colours are static (overridable via theme CSS) instead of dynamic option-backed inline styles. - Code: Custom CSS setting removed from the free build (WordPress.org guideline: plugins must not execute arbitrary user-supplied CSS from options).
- Code: Text domain updated from
eu-withdrawal-buttontoeu-withdrawal-button-for-woocommerceto match the WordPress.org plugin slug. - Misc: Removed the now-unused
class-ewb-i18n.phphelper (text domain is loaded directly viaload_plugin_textdomain()oninit).
- Compliance Update — EU Directive 2023/2673. All compliance-critical features are available in the free version.
- Guest-friendly direct link in order emails: The WooCommerce customer "processing" and "completed" order emails now include a "Withdraw from this order" button. The link opens the withdrawal form pre-verified against the order — no login required. Solves the guest-checkout compliance gap (the directive explicitly requires that withdrawal must not depend on having a customer account).
- Dismissible sticky bar: Visitors can close the sticky bar with an X button. Dismissal is remembered for a configurable number of days (default 7, configurable 0–30) via
localStorage. My Account pages ignore the dismissal and always show the bar (EU compliance — customer must be able to request a withdrawal there). - Partial withdrawal support: Customers can now select specific items and quantities to withdraw instead of the whole order. The confirmation step shows per-item checkboxes and quantity inputs, pre-filled with the full order.
- Optional IBAN field: Customers can provide a bank account for the refund (useful when they paid by card or want the refund sent to a different account). Leaving it empty tells the merchant to refund to the original payment method. The IBAN is shown prominently in the merchant notification email and in the admin withdrawals list.
- Configurable sticky bar display: New "Show sticky bar on" multiselect under Withdrawal Button → General lets merchants pick which page types show the sticky bar (Homepage, Shop & product pages, Cart & checkout, Other). The My Account pages always show the sticky bar (EU compliance — customer must be able to request a withdrawal there). Existing installations default to My Account pages only after the upgrade, so update your settings if you want the sticky bar elsewhere.
- Discreet footer link: Optional small "Right of withdrawal" link can be shown in the footer (useful when the sticky bar is disabled on most pages).
- Admin: Withdrawals list now shows a Full / Partial badge and a hoverable list of the selected items per request, plus a dedicated IBAN column.
- Emails: Customer confirmation and merchant notification emails now list only the selected withdrawn items (with a partial-withdrawal notice when applicable) and show the IBAN. Legacy rows from pre-1.5.0 fall back to the full-order view.
- Database: New
withdrawn_items(JSON) andibancolumns on{prefix}ewb_withdrawals. The upgrade runs automatically on plugin load viadbDelta()— no manual action required. - Security: Submitted item selections are re-validated server-side against the actual order (quantities clamped, unknown items rejected) to prevent tampering.
- Security hardening (CIA audit pass): (a) CSV export now escapes spreadsheet formula injection (leading
=,+,-,@, tab, CR) and includes theWithdrawn Items+IBANcolumns that were previously silently misaligned. (b) Client IP detection no longer trustsHTTP_X_FORWARDED_FOR/HTTP_CLIENT_IPby default — sites behind a trusted reverse proxy (e.g. Cloudflare) can opt in via theewb_trust_forwarded_ipfilter. (c) Submission now holds a MySQL advisory lock per order around the duplicate check + insert, closing the race window that allowed two simultaneous clicks to create duplicate withdrawal rows. (d) The publicewb_validate_orderandewb_lookup_by_keyendpoints are now rate-limited (30 requests per 5 minutes per IP). (e) "Order not found" and "email does not match the order" are collapsed into a single generic verification error to prevent order enumeration. (f) Support form Reply-To header explicitly strips CR/LF defending against header injection.
- IMPORTANT: Clarified "Withdrawal Completed" semantics. Renamed the user-facing label to "Withdrawal Closed" everywhere it appeared (order status, emails, order notes, My Account box, admin). The status no longer implies that an automatic refund has been issued — merchants must refund manually via WooCommerce → Orders. Automatic
wc_create_refund()integration is planned for a future Pro release. Internal status slug (wc-ewb-completed) is unchanged so existing orders continue to work. - IMPORTANT FIX: The sticky bar, withdrawal form, confirmation email, "closed" email and admin information guide previously hardcoded "14 days" even when merchants configured a different
ewb_withdrawal_daysvalue. All texts now reflect the configured value dynamically with proper single/plural handling. Merchants can also use the{days}placeholder in the custom Bar text field. - Updated customer closed-request email to clearly state that the merchant will issue the refund manually, instead of claiming the refund has already been processed.
- Added a "Heads up" admin notice on every plugin settings tab explaining the manual refund workflow.
- Performance & reliability: Order number lookup fallback (step 3) now filters by the configured withdrawal window (days + 2 buffer) instead of the arbitrary "last 500 orders" limit, and is capped at 1000 orders scanned. Both bounds are adjustable via the
ewb_order_lookup_cutoff_dateandewb_order_lookup_max_scanfilters. A warning is logged if the fallback triggers — this helps merchants spot custom order number plugins that don't use the standard_order_numbermeta key. - Code quality: Custom CSS (Basic+) now uses
wp_add_inline_style()attached to the mainewb-frontendstylesheet handle instead of printing a raw<style>tag onwp_head. This integrates with minify/cache plugins and follows WordPress standards.
- Fix: Removed the
parent => woocommercemenu setting so the Freemius SDK can properly register its own admin pages (connect/opt-in, account, pricing). Previously the activation flow tried to redirect users toadmin.php?page=ewb-withdrawalwhich WordPress rejected with "Sorry, you are not allowed to access this page." because the submenu was never registered. Plugin Settings link still opens WooCommerce → Settings → Withdrawal Button viafirst-path.
- Fix: Freemius "Opt In" and Account/Pricing pages now work correctly. Previously the menu used an embedded WooCommerce settings URL as its slug, which prevented the Freemius SDK from rendering its own admin pages (opt-in form, account, pricing, checkout)
- Added a dedicated
ewb-withdrawalplugin page for Freemius SDK, withfirst-pathredirecting Settings link to the WooCommerce → Settings → Withdrawal Button tab (existing UX preserved)
- Fix: "Get Basic" and "Get Pro" buttons in the Upgrade tab now open the Freemius in-admin checkout (iframe) instead of redirecting to the marketing site
- Fix: Restored the "License" / "Activate License" link on the Plugins page by registering the Freemius account page (
ewb-account) - Added dedicated Freemius pricing page (
ewb-pricing) for in-admin checkout flow - Updated Upgrade tab FAQ to reflect the new in-admin checkout experience
- Freemius: Premium code is now properly marked with
is__premium_only()gates so Freemius can auto-generate a clean free build without premium features - Renamed
class-ewb-rest-api.phptoclass-ewb-rest-api__premium_only.phpso Freemius excludes it from the free build - Added
Requires Plugins: woocommerceheader (WordPress 6.5+ plugin dependencies) - readme.txt: added
nalutto contributors
- Fix: Plugin text domain is now properly loaded, enabling translations via WPML / Loco Translate / .mo files
- Add wpml-config.xml for admin text translation support
- Switched to Freemius-only distribution (independent of WordPress.org)
- Disabled WordPress.org compliance mode in Freemius SDK
- Added tier system (Lite / Basic / Pro)
- Freemius integration for license management
- Support tab with contact info
- Upgrade tab with plan comparison
- Improved custom order number compatibility
- Various bug fixes and improvements
- Initial release
- 4-step withdrawal flow
- Sticky bar with configurable text
- Modal popup and page display modes
- WooCommerce email integration
- Custom order status: Withdrawal Requested
- Rate limiting
- HPOS compatibility
- WCAG 2.1 AA accessibility
- Translation-ready