內容簡介
CacheSafe for WooCommerce 是一款由 Cobalt Branch Labs 開發的診斷外掛，專為檢查 WooCommerce 網店的快取行為而設計。它能夠執行匿名購物車會話測試，並報告快取行為、Cookies、標頭及 Store API 回應是否能保持顧客的隔離。
【主要功能】
• 預檢查 WooCommerce 頁面及 Store API
• 手動階段掃描，檢查 Cart-Token 隔離
• 提供 16 項安全檢查報告
• 生成無 Cookie 值的清理報告
• 提供針對常見快取/CDN 外掛的修復指導
• 支援 WP-CLI 指令操作
外掛標籤
開發者團隊
原文外掛簡介
CacheSafe for WooCommerce is a diagnostic evidence plugin by Cobalt Branch Labs. It runs controlled anonymous cart sessions through your store’s public WooCommerce surfaces and reports whether cache behavior, cookies, headers, and Store API responses preserve customer isolation.
Free v1.0 includes manual scans, sanitized findings, provider-aware remediation guidance, WP-CLI, and local-only evidence. No telemetry, no accounts, no automatic cache changes.
What it does
Preflight checks — WooCommerce pages, loopback reachability, Store API, test product, runner health, perspective
Manual staged scans — Store API Cart-Token A/B isolation plus classic cookie/add-to-cart flow where supported
16 safety checks (CS-101–116) — headers, Set-Cookie, session isolation, replay, cleanup, perspective
Sanitized reports — copy or download JSON, text, or HTML without cookie values, tokens, or raw bodies
Provider guidance — evidence-linked remediation for generic stacks and common cache/CDN plugins
WP-CLI — wp cachesafe preflight, scan, status, report, cancel, cleanup, purge
Retention — keeps the last five completed scans within 30 days (configurable shorter); automatic daily purge
What it does not do
Place orders, process payments, or call checkout write endpoints
Change cache, CDN, DNS, or host settings automatically
Send telemetry or require an account
Show a numeric “safety score”
Admin
WooCommerce → CacheSafe with tabs for Overview, Preflight, Live scan, Results, History, Settings, and Tools.
Privacy
All scan evidence stays on your WordPress site. CacheSafe does not phone home. Reports are sanitized to exclude cookie values, Cart-Tokens, nonces, Authorization headers, raw bodies, secrets, and customer PII. Retention is bounded and configurable; uninstall can remove plugin-owned data when enabled in Settings.
Development
Unminified JavaScript and CSS live in assets/src/. Built admin assets are written to assets/build/ via @wordpress/scripts.
To regenerate the compiled files from this plugin directory:
npm install
npm run build
package.json and webpack.config.js ship with the plugin so the build can be reproduced without a separate repository.
