內容簡介
Inclusive Forge 是一款專為 WooCommerce 商店設計的外掛，幫助網站符合 WCAG 2.1 AA 和 EN 301 549 的無障礙標準。它能夠記錄審核結果並發布無障礙聲明，確保網站的可及性。
【主要功能】
• 驗證網站所有權，添加 meta 標籤
• 發布無障礙聲明，支援短碼和區塊
• 顯示最後一次掃描結果於 wp-admin
• 提供重新測試功能，檢查掃描次數
• 確認驗證標籤是否正常運作
• 簡化設定介面，集中管理所有選項
外掛標籤
開發者團隊
② 後台搜尋「Inclusive Forge – Accessibility Statement for WooCommerce」→ 直接安裝（推薦）
原文外掛簡介
Inclusive Forge audits European online stores against WCAG 2.1 AA and EN 301 549, records what was found and what was fixed, and publishes an accessibility statement from that record. The audit, the evidence log and the statement live in your Inclusive Forge account. This plugin is the small piece that has to run on your site. It works on any WordPress site and is built for WooCommerce stores. This is all it does:
Proves you own the site. It adds to your
. Our scanner reads that tag before it audits anything, so a site is never scanned on the word of whoever filled in a form.Publishes your accessibility statement. The [inclusiveforge_statement] shortcode and the matching block render the statement you published in Inclusive Forge. The document is fetched over HTTPS and cached locally for 12 hours: only the page view that refreshes the cache waits for the request, and the request times out after five seconds.
Shows your last scan, right in wp-admin. A “Last scan” card on the settings screen and a dashboard widget show the score, open and closed findings, and the date — filled in automatically when a scan finishes.
Lets you ask for a re-test. A “Re-test now” button on the settings screen asks Inclusive Forge to scan the site again; the monthly allowance of your account is enforced by Inclusive Forge, and the button tells you how many re-tests you have left.
Checks that verification is actually working. The settings screen fetches your own home page (the answer is kept for five minutes) and confirms the verification tag is really there — not just emitted — and flags known cache/optimisation plugins that sometimes strip it.
Gives you one settings screen. Site token, webhook secret, statement language, verification status, and a button to refresh the cached statement.
What this plugin deliberately does not do
No overlay. It never modifies, re-labels or “corrects” your pages in the browser. Accessibility overlays are widely rejected by disabled users and by regulators; real fixes belong in your theme and templates, and Inclusive Forge reports them there.
No JavaScript and no CSS on your storefront. Not one script, not one stylesheet, not one inline style. The statement is plain server-rendered HTML that inherits your theme. The only JavaScript in this plugin runs in the block editor, so the block can appear in the inserter.
No scanning from inside your site. Nothing crawls your pages from your own server, and there is no background job competing with your store for resources.
No tracking and no analytics.
Honest scope
An automated scan detects a portion of WCAG 2.1 AA issues, not all of them, and no plugin can make a website accessible on its own. Inclusive Forge sells a documented process — scan, fix, re-test, evidence log, statement — not a compliance guarantee. This plugin and the Inclusive Forge service do not provide legal advice; talk to a qualified adviser about your obligations.
External services
This plugin connects to one third-party service. It is not optional: without it there is no statement to render and no store to connect.
Inclusive Forge (https://inclusiveforge.com, run by Avakode) — hosts your accessibility statement, verifies site ownership, and runs the scans this plugin reports on. The plugin talks to its API at https://app.inclusiveforge.com: GET /public/statement/{site token}?locale=… for the statement and POST /public/rescan/{site token} for a re-test.
What is sent: your Inclusive Forge site token (in the request path) and your site address (in the User-Agent header of the request). When you press “Re-test now”, a signed, empty request authenticated with your webhook secret asking the scan to be run again. Nothing else — no post content, no order data, no customer data, no visitor IP addresses, no administrator details.
When it is sent: only once a site token is saved; with none, the plugin sends nothing. Then: when a page containing the shortcode or block is rendered, or the plugin’s settings screen is opened, and the cached statement is missing or older than 12 hours; when a failed request is retried (at most once every 15 minutes); when you press “Refresh statement cache”; and when you press “Re-test now”. Pages without the shortcode or block send nothing.
What comes back: the HTML of your published accessibility statement, or an error saying the site is unknown or not verified yet; a re-test request answers with an accepted scan or a named reason it was refused, including your remaining monthly allowance.
What this address sends back to your site, unprompted: when a scan it ran finishes, it calls your site’s own REST API (/wp-json/inclusiveforge/v1/scan-completed) with the score, the open/closed finding counts, the date, and a link back to the full report. This plugin verifies a cryptographic signature on that request, using the same webhook secret, before storing anything from it — an unsigned or incorrectly signed request is rejected and changes nothing on your site.
The link visitors may see: when your site token is fine but the plugin could not fetch the statement (a timeout, for example), visitors see a plain link, “View our accessibility statement”, to https://inclusiveforge.com/
The endpoint address can be overridden for staging by defining INCLUSIVEFORGE_API_BASE in wp-config.php.
Terms: https://inclusiveforge.com/terms — Privacy: https://inclusiveforge.com/privacy
Your site token is also published in the verification meta tag in your site’s
, which is what makes ownership checkable from outside. It identifies the site to Inclusive Forge; it does not grant access to your Inclusive Forge account. The webhook secret is a separate value, used only to authenticate the scan-completed notice and the re-test request in both directions; it is never displayed anywhere on your storefront.The plugin’s own “verification health” check on the settings screen fetches your site’s own home page — a request to your own site, not to a third party — to confirm the verification tag actually reaches visitors. The answer is kept for five minutes, so reopening the screen does not fetch again.
