Proteside for WooCommerce
| 开发者 | proteside |
|---|---|
| 更新时间 | 2026年10月28日 23:16 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Adds a settings screen under WooCommerce where you paste your public SDK key (
pk_live_…). - Validates the key against Proteside server-side and shows the connection status: Active, Grace period, Suspended, Inactive, Invalid key or Connection error.
- Prints the Proteside bootstrapper (bundled, version 1.1.3) inline and first in the page head, then loads
shield.jsasynchronously from the Proteside CDN — exactly the two tags the dashboard gives you, in the right order. - Optionally embeds your active blocking rules and allowed Google Tag Manager containers in the page (inline config) so blocking starts from the first byte, before the SDK fetches its remote configuration.
- Follows the release channel chosen in your dashboard (stable/latest), with a manual override.
- Detects pages with WooCommerce conditional tags, so it works with translated or custom slugs and with the classic or block-based checkout.
- Stops loading the protection when your subscription is no longer active; keeps the last known status for up to 48 hours if Proteside cannot be reached.
- Re-checks status and rules periodically (WP-Cron, every 6/12/24 h) and on demand, caching everything locally: there is never a network call on a normal page load.
- Advanced "strict first position" mode that buffers the page and inserts the tags right after
<head>when a theme or plugin prints scripts beforewp_head.
安装:
- Install and activate WooCommerce.
- Install and activate Proteside for WooCommerce.
- Go to WooCommerce → Proteside.
- Paste your SDK key (Proteside dashboard → Settings → Pages and Domains) and save.
- Keep the default pages (checkout, order payment page, order confirmation) or add more. Done.
- Open your checkout and run
Proteside.getStatus()in the browser console:installationOrderValidmust betrue.
常见问题:
Do I need a paid Proteside account?
Yes. The plugin activates an existing Proteside subscription. You can create one at proteside.com.
Is my SDK key a secret?
No. The pk_ key is public by design — it already appears in your store's HTML. Keep your account credentials safe; the SDK key itself is not sensitive.
Does it work with the block-based checkout?
Yes. Page detection uses WooCommerce conditional tags plus block detection, so both classic and block cart/checkout are supported.
Where is the trust badge?
The Proteside SDK no longer renders a badge. The badge is a static HTML snippet you copy from your dashboard (Settings → Store) and paste wherever you want it in your theme; the plugin does not add it for you.
What is "Embed blocking rules in the page"?
The plugin copies your active rules and allowed GTM containers from the dashboard into the inline bootstrapper (same <script> tag). Blocking then starts before the SDK downloads its remote configuration. It is refreshed on every status check and is on by default.
What does "installation order" mean?
The bootstrapper must be the first script in <head>. If another script runs before it, the SDK reports INSTALLATION_ORDER_WARNING and Proteside.getStatus().installationOrderValid is false (protection continues, with partial coverage). The default wp_head priority 1 is enough for most themes; if a theme or plugin prints scripts earlier, enable Advanced → "Strict first position (output buffering)".
What happens if my subscription lapses?
The plugin detects the change on its next status check and stops loading the script. During the billing grace period the script keeps loading and you'll see a reminder in the admin.
What if Proteside is unreachable?
Only a definitive answer (HTTP 200 or 401) changes the decision. On timeouts or server errors the plugin keeps the last known status for up to 48 hours, then fails closed.
Does it slow down my store?
No network call happens on normal page loads — everything is cached locally and refreshed by WP-Cron. shield.js is loaded asynchronously; the inline bootstrapper is about 4 KB.
My site has a Content-Security-Policy. What do I allow?
script-src: the inline bootstrapper (hash shown in Diagnostics, or a nonce/'unsafe-inline') plus https://cdn.proteside.com; connect-src: https://app.proteside.com and https://cdn.proteside.com. Use the hash from Diagnostics: it is computed from the exact tag WordPress prints on your site and changes when your inline rules change.
更新日志:
- Changed: bundled bootstrapper updated to 1.1.3. On Pix pages in block mode, Proteside can now put the legitimate Pix code back before a malicious clipboard write happens.
- Fixed: an SDK key with a trailing line break is no longer accepted.
- Changed: translation files are no longer bundled; translations come from translate.wordpress.org.
- Changed: admin notices are shown only on the Proteside settings screen.
- Changed: the External services section lists every call the Proteside SDK makes from the browser.
- Changed: the inline bootstrapper and shield.js tags are now printed with the WordPress script tag API (
wp_print_inline_script_tag()/wp_get_script_tag()), so thewp_inline_script_attributesandwp_script_attributesfilters apply (e.g. CSP nonces). - Changed: the CSP hash in Diagnostics is computed from the exact tag WordPress prints.
- Security: the CDN address returned by the Proteside API is only accepted on
https://Proteside domains. - Changed: requires WordPress 6.7+, which loads translations by itself (no
load_plugin_textdomain()). - Fixed: the plugin name is no longer translated (it stays "Proteside for WooCommerce" in every language).
- Tested with WordPress 7.1 and WooCommerce 11.2.
- Bundled bootstrapper updated to 1.1.2 (pre-insertion script blocking, inline config support), with its TypeScript sources.
- New: inline config — active blocking rules and allowed GTM containers from
GET /api/sdk/configare embedded aswindow.__PROTE_INLINE__in the same tag as the bootstrapper (default on). - New: release channel setting — follow the dashboard (default), stable or latest.
- New: "Order payment page" target (
order-pay). Defaults are now checkout + order payment page + order confirmation; cart is off by default. - New: advanced "Strict first position (output buffering)" mode that inserts the tags right after
<head>. - New:
inactivestatus, domain-mismatch advisory notice, connection-error notice. - Changed: the 48-hour tolerance for API outages is now applied properly (fail-closed when never validated or after 48 h).
- Changed: diagnostics show bundled bootstrapper version, inline rules/GTM count, channel in use, injection mode, CSP hash and a verification hint.
- Changed: admin wording aligned with the Proteside glossary; pt_BR, es_ES and en_US translations completed.
- Removed: the trust badge option and
data-safe-url(the SDK no longer renders a badge; it is a static snippet from the dashboard). - Removed: the option to disable the inline bootstrapper (it is mandatory for the protection to work).
- Uninstall now also removes the revalidation lock transient.
- Initial release: SDK key activation, real-time status, page targeting via WooCommerce conditional tags, bootstrapper + async shield.js injection, WP-Cron revalidation, HPOS and Cart/Checkout Blocks compatibility.