內容簡介
CacheSafe for WooCommerce 是一款專為 WooCommerce 設計的外掛，旨在檢查購物車快取和客戶會話隔離，確保不同會話之間的購物車響應不會混合。它提供手動掃描、報告生成及指導，幫助開發者或主機提供商解決快取問題。
【主要功能】
• 檢查 WooCommerce 頁面及 API 可達性
• 手動掃描購物車令牌 A/B 隔離
• 提供 16 項安全檢查
• 生成無 Cookie 值的清理報告
• 提供針對常見快取/CDN 插件的指導
• 支援 WP-CLI 指令操作
外掛標籤
開發者團隊
原文外掛簡介
CacheSafe for WooCommerce checks cart caching and customer session isolation using controlled anonymous cart sessions. Use it to investigate whether caching could mix cart responses between sessions.
Run a manual scan, review the findings, and share a sanitized report with your developer or hosting provider. Results describe the tested requests and scan conditions; a passing scan is not a guarantee for every customer or cache path.
Scans create temporary anonymous carts using a configured test product. They do not place orders or process payments. CacheSafe provides guidance so you can investigate findings; it does not change cache settings automatically.
Manual scans, sanitized reports, provider guidance, and WP-CLI are included. Evidence stays on your site, with no telemetry or account required.
What it does
Preflight checks — WooCommerce pages, loopback reachability, Store API, test product, runner health, perspective
Manual staged scans — Store API Cart-Token A/B isolation plus classic cookie/add-to-cart flow where supported
16 safety checks (CS-101–116) — headers, Set-Cookie, session isolation, replay, cleanup, perspective
Sanitized reports — copy or download JSON, text, or HTML without cookie values, tokens, or raw bodies
Provider guidance — evidence-linked remediation for generic stacks and common cache/CDN plugins
WP-CLI — wp cachesafe preflight, scan, status, report, cancel, cleanup, purge
Retention — keeps the last five completed scans within 30 days (configurable shorter); automatic daily purge
What it does not do
Place orders, process payments, or call checkout write endpoints
Change cache, CDN, DNS, or host settings automatically
Send telemetry or require an account
Show a numeric “safety score”
Admin
WooCommerce → CacheSafe with tabs for Overview, Preflight, Live scan, Results, History, Settings, and Tools.
Privacy
All scan evidence stays on your WordPress site. CacheSafe does not phone home. Reports are sanitized to exclude cookie values, Cart-Tokens, nonces, Authorization headers, raw bodies, secrets, and customer PII. Retention is bounded and configurable; uninstall can remove plugin-owned data when enabled in Settings.
Development
Unminified JavaScript and CSS live in assets/src/. Built admin assets are written to assets/build/ via @wordpress/scripts.
To regenerate the compiled files from this plugin directory:
npm install
npm run build
package.json and webpack.config.js ship with the plugin so the build can be reproduced without a separate repository.
