WebEquipe Passwordless Checkout for WooCommerce
| 开发者 | webequipe |
|---|---|
| 更新时间 | 2026年10月2日 19:08 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Auto order linking — guest orders linked to the matching account by billing email.
- Auto registration — new accounts created silently; no password prompt, no credentials email.
- Duplicate prevention — one email always maps to one customer account.
- Magic link login — single-use, expiring links (default 30 min); rate-limited to prevent abuse.
- Guest order view — expiring token links in order emails let guests view their order without logging in.
- Invoice / payment link access — customers can pay custom orders without logging in (within a configurable window from order creation).
- Passwordless login UI — choose how customers log in: passwordless only (email-only "Send Login Link" form), both (standard password form plus the login link), or password only.
- Admin merge tool — WooCommerce → Passwordless Checkout → Merge Customer Accounts: find duplicates, preview, merge.
- WooCommerce Blocks support — works with both classic shortcode and Block-based checkout.
- HPOS compatible — fully supports High-Performance Order Storage.
- Logging — optional, via the built-in WooCommerce logger (WooCommerce → Status → Logs).
- Activate the plugin (WooCommerce must already be active).
- Open WooCommerce → Passwordless Checkout.
- Review the General tab (defaults are already enabled) and click Save Changes.
- Optionally adjust Magic Link expiry / rate limits and the email template.
- Place a test guest order — it should appear linked to a customer account under WooCommerce → Orders.
- Open My Account while logged out and request a login link to verify email delivery.
- No external requests, tracking, or data sharing — everything runs on your own server.
- Tokens use
random_bytes()(CSPRNG), are stored hashed withwp_hash(), are single-use, and expire automatically. - Constant-time comparison (
hash_equals()) prevents timing attacks. - Nonces and capability checks protect every form and admin action.
- Magic link requests return a neutral response to prevent account enumeration.
- Optional logs mask email addresses and focus on order/user IDs.
- A privacy-policy suggestion is registered under Settings → Privacy for store owners.
wp_mail()).
安装:
- Go to Plugins → Add New.
- Search for "WebEquipe Passwordless Checkout".
- Click Install Now, then Activate.
- Go to WooCommerce → Passwordless Checkout and click Save Changes.
- Download the plugin zip.
- Go to Plugins → Add New → Upload Plugin.
- Upload the zip and activate.
- Go to WooCommerce → Passwordless Checkout and click Save Changes.
屏幕截图:
常见问题:
Does this require WooCommerce?
Yes. WooCommerce must be installed and active. The plugin will not activate without it.
Will it interfere with my existing customers or orders?
No. Activating the plugin does not rewrite existing orders, customers, or settings. It acts at checkout, on My Account login, in order emails (guest order view and payment links), and via the admin merge tool.
Are passwords ever sent to customers?
Never. The plugin does not generate, display, or email passwords or credential setup links. Customers log in only via magic links (when enabled).
Does it work with the block-based checkout?
Yes. Both the classic (shortcode) checkout and the WooCommerce Blocks (Store API) checkout are fully supported.
What happens if a customer uses a different email address?
The plugin matches by billing email only. If a customer uses a different email at checkout, a new account is created for that email. You can merge accounts later using WooCommerce → Passwordless Checkout → Merge Customer Accounts.
How long do magic links last?
By default, 30 minutes. You can change this under WooCommerce → Passwordless Checkout → Magic Link. Links are single-use — clicking them a second time will show an expired message.
What is the rate limit on magic link requests?
By default, a maximum of 3 requests per 15-minute window per email address. Both values are configurable in the settings.
Where do I find the logs?
Enable logging under WooCommerce → Passwordless Checkout → General, then find entries under WooCommerce → Status → Logs with the source webequipe-passwordless-checkout.
Does the guest order-view link expire?
Yes. By default, the "View your order" link included in order emails expires after 7 days. After expiry, the page shows an expired message and a link to My Account. The expiry duration is configurable.
Is it HPOS compatible?
Yes. The plugin declares High-Performance Order Storage compatibility and stores order meta through the WooCommerce order APIs (HPOS-aware).
Will this cause issues with caching plugins?
Magic link URLs and order-view URLs use query parameters, which most page caching plugins bypass by default. If you experience issues, exclude URLs containing weplc_magic_login and weplc_order_view from your cache.
How does the admin merge tool work?
Go to WooCommerce → Passwordless Checkout → Merge Customer Accounts. Search two email addresses, preview both accounts (name, order count, registration date), confirm, and the plugin moves all orders from the secondary account to the primary, backfills any missing address data, and deletes the secondary user. The action requires manage_woocommerce capability and a nonce confirmation.
Does this plugin use shortcodes or blocks?
No shortcodes are registered. The plugin integrates with WooCommerce checkout (classic and Blocks) and the My Account login form automatically.
更新日志:
- Magic-link confirmation: the single-use token is consumed only when the customer confirms login, so an inbox scanner opening the link leaves it valid.
- Magic-link form notices stay visible for guests who do not have a WooCommerce session cookie.
- Order-pay / invoice links no longer log the visitor into a WordPress account. Access is the WooCommerce order key plus the configured expiry window only.
- Settings save capability matches the WooCommerce menu (
manage_woocommerce). - Uninstall description matches the code: hashed rate-limit transients expire on their own.
- Directory identity: display name is now WebEquipe Passwordless Checkout for WooCommerce (slug / text domain
webequipe-passwordless-checkout).
- Initial public release.
- Email-based customer detection at checkout (case-insensitive, classic + Blocks).
- Auto order linking to existing customer accounts by billing email.
- Auto registration of new customers — no password shown, no credentials emailed.
- Duplicate account prevention — one email always maps to one account.
- WooCommerce Blocks (Store API) support via
woocommerce_store_api_checkout_order_processed. - HPOS (High-Performance Order Storage) compatibility declared.
- Passwordless magic link login — single-use, expiring tokens (default 30 min), CSPRNG + hashed storage.
- Rate limiting for magic link requests — configurable per-email window and max count.
- Guest order-view tokens in order emails — read-only order page, no login required.
- Password-free access for custom order / invoice payment links (order key authorization).
- Passwordless login UI — selectable login experience (passwordless only, both, or password only) on the My Account login form.
- Customizable magic link email — subject, body, and placeholders (
{magic_link},{site_name},{customer_name}). - Admin merge accounts tool — search, preview, confirm, merge, with nonce and capability protection.
- Admin tabbed settings — General / Magic Link / Merge Customer Accounts / Email Template.
- Logging via the WooCommerce logger — activity log for detection, linking, registration, and magic link lifecycle.
- Daily cron cleanup of expired tokens.
- Full uninstall cleanup — all plugin options, user meta, and order meta removed on uninstall.