wp-woocommerce — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited wp-woocommerce (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Model note: Complex — payment gateways, HPOS compatibility, and block cart/checkout require multi-file reasoning. Usesonnetoropus.haikufor isolated CRUD or hook lookups only.
Guide for building WooCommerce extensions: custom product types, payment gateways, hooks, CRUD, REST, and admin UI. Assumes the host plugin passes the wp-plugin-audit baseline and the official wp-plugin-development security conventions.
Not for: General WordPress plugin architecture — use wp-plugin-development. PHPStan types for WC — use wp-phpstan-stubs to scaffold WC stubs.
Determine which WC subsystem applies before writing code:
| Goal | Subsystem |
|---|---|
| Custom product type | WC_Product subclass + product_type_query filter |
| Payment gateway | WC_Payment_Gateway subclass + woocommerce_payment_gateways filter |
| Shipping method | WC_Shipping_Method subclass + woocommerce_shipping_methods filter |
| Custom order status | wc_register_order_status + wc_order_statuses filter |
| Cart/checkout field | woocommerce_checkout_fields filter or block integration API |
| Admin product tab | woocommerce_product_data_tabs + woocommerce_product_data_panels |
| Order list column | manage_edit-shop_order_columns + manage_shop_order_posts_custom_column |
| REST API extension | woocommerce_rest_* hooks or custom endpoint on WC_REST_Controller |
$wpdbAlways use WC CRUD methods; they fire the correct hooks and invalidate caches.
// Orders
$order = wc_create_order( [ 'status' => 'pending', 'customer_id' => $user_id ] );
$order->add_product( wc_get_product( $product_id ), 1 );
$order->calculate_totals();
$order->save();
// Products
$product = new WC_Product_Simple();
$product->set_name( 'My Product' );
$product->set_regular_price( '19.99' );
$product->set_status( 'publish' );
$product->save();
// Reading
$order = wc_get_order( $order_id ); // returns WC_Order or false
$product = wc_get_product( $product_id ); // returns WC_Product subclass or falseFor meta, use $order->get_meta() / $order->update_meta_data() + $order->save() — never update_post_meta() on orders (breaks HPOS).
WooCommerce 8.2+ ships High-Performance Order Storage (HPOS). Extensions must declare compatibility or they're disabled in HPOS stores.
add_action( 'before_woocommerce_init', function() {
if ( class_exists( \Automattic\WooCommerce\Utilities\FeaturesUtil::class ) ) {
\Automattic\WooCommerce\Utilities\FeaturesUtil::declare_compatibility(
'custom_order_tables', __FILE__, true
);
}
} );Rules under HPOS:
get_post_meta() / update_post_meta() — use WC_Order getters/setters.WP_Query with post_type=shop_order — use wc_get_orders().$wpdb queries directly on {prefix}posts for order data.class My_Payment_Gateway extends WC_Payment_Gateway {
public function __construct() {
$this->id = 'my_gateway';
$this->method_title = __( 'My Gateway', 'my-plugin' );
$this->method_description = __( 'Pay via My Gateway.', 'my-plugin' );
$this->supports = [ 'products', 'refunds' ];
$this->init_form_fields();
$this->init_settings();
$this->title = $this->get_option( 'title' );
$this->enabled = $this->get_option( 'enabled' );
add_action( 'woocommerce_update_options_payment_gateways_' . $this->id,
[ $this, 'process_settings' ] );
}
public function process_payment( $order_id ) {
$order = wc_get_order( $order_id );
// ... call payment API ...
$order->payment_complete( $transaction_id );
return [ 'result' => 'success', 'redirect' => $this->get_return_url( $order ) ];
}
public function process_refund( $order_id, $amount = null, $reason = '' ) {
// return true on success, WP_Error on failure
}
}
add_filter( 'woocommerce_payment_gateways', fn( $gateways ) => [ ...$gateways, My_Payment_Gateway::class ] );Extend existing WC REST endpoints via woocommerce_rest_prepare_* hooks, or register a custom controller:
// Add field to products REST response
add_filter( 'woocommerce_rest_prepare_product_object', function( $response, $product, $request ) {
$response->data['my_custom_field'] = $product->get_meta( '_my_field' );
return $response;
}, 10, 3 );
// Accept field on write
add_filter( 'woocommerce_rest_pre_insert_product_object', function( $product, $request ) {
if ( isset( $request['my_custom_field'] ) ) {
$product->update_meta_data( '_my_field', sanitize_text_field( $request['my_custom_field'] ) );
}
return $product;
}, 10, 2 );// Cart
add_action( 'woocommerce_cart_calculate_fees', [ $this, 'add_fee' ] );
add_filter( 'woocommerce_cart_item_price', [ $this, 'modify_price' ], 10, 3 );
// Checkout
add_filter( 'woocommerce_checkout_fields', [ $this, 'add_field' ] );
add_action( 'woocommerce_checkout_update_order_meta', [ $this, 'save_field' ] );
// Orders
add_action( 'woocommerce_order_status_changed', [ $this, 'on_status_change' ], 10, 4 );
add_filter( 'wc_order_statuses', [ $this, 'register_status' ] );
// Products
add_filter( 'woocommerce_product_data_tabs', [ $this, 'add_tab' ] );
add_action( 'woocommerce_product_data_panels', [ $this, 'render_panel' ] );
add_action( 'woocommerce_process_product_meta', [ $this, 'save_meta' ] );Classic shortcode hooks (woocommerce_checkout_fields) do not fire for the block-based checkout. Use the Store API extension registry:
add_action( 'woocommerce_blocks_loaded', function() {
if ( ! function_exists( 'woocommerce_store_api_register_endpoint_data' ) ) return;
woocommerce_store_api_register_endpoint_data( [
'endpoint' => Automattic\WooCommerce\StoreApi\Schemas\V1\CartSchema::IDENTIFIER,
'namespace' => 'my-plugin',
'schema_callback' => fn() => [ 'my_field' => [ 'type' => 'string' ] ],
'data_callback' => fn() => [ 'my_field' => get_user_meta( get_current_user_id(), '_my_field', true ) ],
] );
} );Declare blocks compatibility alongside HPOS:
\Automattic\WooCommerce\Utilities\FeaturesUtil::declare_compatibility( 'cart_checkout_blocks', __FILE__, true );class_exists( 'WooCommerce' ) before any WC code; gate with woocommerce_loaded action.wc_get_logger() for debug logging — writes to WooCommerce → Status → Logs, not the WP debug log.woocommerce/tests/legacy/includes/ — use WC_Helper_Product::create_simple_product() etc. in PHPUnit tests.references/wc-hooks.md — categorised hook list (cart, checkout, orders, products, admin) with signatures and since versions.references/hpos-migration.md — HPOS compatibility checklist and query migration patterns.references/product-crud.md — WC_Product factory, meta CRUD, product type registration, variation patterns.references/rest-api.md — WC REST API auth, endpoints, batch operations, extending product/order responses via filters.references/block-cart-checkout.md — SlotFills, registerCheckoutFilters, extensionCartUpdate, woocommerce_store_api_register_update_callback, enqueue pattern.references/payment-methods.md — registerPaymentMethod(), registerExpressPaymentMethod(), AbstractPaymentMethodType PHP class, block payment registration.references/payment-gateway.md — WC_Payment_Gateway scaffold, process_payment(), process_refund(), webhook handler, settings fields.references/shipping.md — WC_Shipping_Method scaffold, calculate_shipping(), woocommerce_package_rates filter, zone handling, split packages.references/orders.md — wc_get_orders(), getter list, line item iteration, status hooks, custom status registration, wc_create_refund(), HPOS admin columns.references/coupons-tax-webhooks.md — WC_Coupon CRUD, wc_order_statuses filter, WC_Tax::calc_tax(), WC_Webhook programmatic creation, HMAC-SHA256 verification.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.