=== Agentic Commerce for WooCommerce === Contributors: xpaysh Tags: woocommerce, chatgpt, ai, analytics, product feed Requires at least: 6.2 Tested up to: 7.0 Requires PHP: 7.4 WC requires at least: 7.0 WC tested up to: 10.8.1 Stable tag: 0.6.3 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html See which AI assistants drive your orders, get your products into ChatGPT answers, and run ChatGPT Ads — without leaving WooCommerce. == Description == = AI Traffic & Sales Tracking for WooCommerce — ChatGPT Ads, Product Feed & AI Visibility = **Something is already sending you customers, and your analytics can't see it.** When a shopper asks ChatGPT "find me a cordless drill under $80 that ships in 2 days" and buys from the store it names, that order lands in WooCommerce looking like ordinary direct traffic. Google Analytics shows you nothing. Your reports show you nothing. You cannot tell whether AI assistants are worth your attention, because you cannot see them at all. **This plugin makes the AI channel visible, then makes you the answer it gives — and lets you buy more of it.** Three jobs, in that order: 1. **Measure it.** See which AI crawlers reach your store, which pages they read, and which of your real WooCommerce orders came from an AI assistant — broken out by ChatGPT, Claude, Perplexity, Gemini, Copilot and a dozen more, reconciled against your actual orders so you know the number is true. 2. **Win it.** Publish your catalog, prices, stock and answers in the formats AI shopping assistants actually read, so you're the store they recommend. 3. **Buy it.** Run ChatGPT Ads — campaigns, budgets, creative and results — from inside WooCommerce, measured against your real orders rather than the ad platform's own scorecard. No theme changes. No replatforming. No new payment processor. Your existing gateway and your payout schedule are untouched. **We show you the match rate.** Every AI-attributed number in this plugin comes with the percentage of your real orders it accounts for. When tracking misses something, you'll see that too — because a revenue figure you can't check isn't worth having. 🌐 **Plugin home:** [www.xpay.sh/merchants/woocommerce/](https://www.xpay.sh/merchants/woocommerce/) 🤖 **New to this?** [What agentic commerce actually means for a store owner](https://www.xpay.sh/agentic-commerce) = See the AI channel = * **[AI crawler analytics →](https://www.xpay.sh/merchants/ai-traffic/)** — which assistants visit (GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-User, PerplexityBot, Google-Extended and more), what page types they read, whether they reached your catalog, and how that compares against your human traffic. Opt-in, off by default, known AI bots only — never your shoppers. * **AI-attributed orders** — real WooCommerce orders traced back to the assistant that referred the buyer, with revenue split by source. Strictly non-PII: no names, emails, addresses or payment data ever leave your store. * **[Agent-readiness audit →](https://www.xpay.sh/merchants/audit/)** — a live score for how well AI shopping assistants can read, understand and recommend your catalog, with a prioritised fix list. * **[Agent delivery speed →](https://www.xpay.sh/merchants/woocommerce/speed-fix/)** — AI crawlers give up on slow pages. See how fast your catalog, `/llms.txt` and product pages answer *when requested by the AI crawlers themselves*, and what to do when one is too slow. A diagnostic — it won't fight your caching plugin. = Win the AI channel = * **An agent-readable product feed** — your full catalog with live prices and stock, hosted on xpay's CDN, so assistants reading it never touch your origin. Refreshed within ~30 seconds of any product or stock change, with an hourly safety net. * **AI-shopping structured data** — `Product`, `Offer`, `AggregateOffer`, `BuyAction` and `ItemList` JSON-LD on product pages, shop archive and home page. Detects Yoast, Rank Math and WooCommerce core schema and **fills only the gaps** — never a duplicate. * **The real AI shopping standards, on your own domain** — `/llms.txt` ([llmstxt.org](https://llmstxt.org)) and an explicit `robots.txt` allowlist for AI user-agents. If you already publish your own `/llms.txt`, this appends to it and leaves your content untouched. * **Cart deep-link** — an assistant can hand a shopper a one-click Buy link that pre-fills your existing WooCommerce cart and lands them on your existing checkout. * **Product FAQs and return policy** — `FAQPage` and `MerchantReturnPolicy` structured data answering the delivery, returns and variant questions AI shoppers ask, for products you approve. Optionally shown to your shoppers too, as a product tab, a summary block, or an `[xpay-faq]` shortcode — **off on new installs**. * **[AI storefront assistant →](https://www.xpay.sh/merchants/storefront-assistant)** *(optional)* — an on-site shopper chat that answers from your own catalog. Never appears without your explicit say-so. = Run ChatGPT Ads = *Not sure what these are? [ChatGPT Ads, explained for store owners](https://www.xpay.sh/merchants/chatgpt-ads/explained/) — what they are, what they cost, and who's eligible.* * **[Campaign management inside WooCommerce →](https://www.xpay.sh/merchants/chatgpt-ads/)** — create, edit, budget, activate and pause ChatGPT Ads campaigns and ad groups without switching to another tab. Results land next to the orders they produced. * **Your numbers, not just theirs** — every campaign shows the orders *we* reconciled against your real WooCommerce data alongside what OpenAI reports. The gap between the two is the most useful number on the screen. * **A ChatGPT product feed** — your catalog serialised to OpenAI's specification and delivered on a schedule, with a per-product health score so you can see exactly which listings are incomplete and fix them inline. * **Eligibility, up front** — ChatGPT Ads requires a minimum catalog size and is currently limited to the US, Canada, Australia and New Zealand. The plugin tells you where you stand **before** you invest time, and points you at the organic path if ads aren't open to you yet. * **Tracking that works with what you have** — already running Pixel Manager, PixelYourSite or a GTM container? This verifies *their* pixel is firing and reconciles it, instead of asking you to rip it out and install another one. = Works alongside what you already run = Built to cooperate, not compete. If another plugin already does a job, this one stands down rather than duplicating: * **Yoast SEO / Rank Math / SEOPress** — detects existing Product and FAQ schema and fills only what's missing. * **AdTribes Product Feed PRO / CTX Feed / Google Listings & Ads** — separate feeds for separate channels; nothing conflicts. * **Pixel Manager / PixelYourSite / GTM / WooCommerce core Order Attribution** — attribution here is additive and non-destructive. * **WP Rocket / LiteSpeed / Autoptimize / SiteGround Optimizer** — automatically excluded from JS optimization so nothing breaks. * **HPOS and Cart/Checkout Blocks** — declared compatible. * **Storefront / Astra / Divi / Elementor** and the standard page builders. = What it doesn't do = * **It doesn't touch your checkout.** Stripe / WooPayments / PayPal / Square / whatever you already use — payment runs through them, unchanged. Your payout schedule is unchanged. * **It doesn't see your customers.** No buyer names, emails, addresses, IPs, payment cards, order line items, refunds, or PII of any kind passes through xpay. Ever. The plugin is non-custodial. * **It doesn't require a new account or contract** to start. Free to install and get going — paid plans available as you grow. [See pricing](https://www.xpay.sh/pricing/?tab=agentic-commerce). * **It doesn't slow down your site.** The JSON-LD block is tiny and cached; the catalog feed is served from xpay's CDN, not your origin. = Five-minute install flow = 1. Install the plugin from this directory or upload the zip. 2. Activate. You'll land on the **xpay✦ Commerce** dashboard. 3. Click **Connect store**. You're redirected to app.xpay.sh, where you grant a read-only WooCommerce REST API key. 4. Your catalog goes live on AI surfaces within about 10 minutes. The built-in readiness checklist turns green as each piece confirms, and tells you in plain English what to do about anything that doesn't. Stuck on any step? Email merchants@xpay.sh or post in the support forum on this page — we aim to reply within one business day. = Compatibility = * WooCommerce 7.0+ on WordPress 6.2+ and PHP 7.4+. * Declares compatibility with WooCommerce High-Performance Order Storage (HPOS) and Cart/Checkout Blocks. * Works alongside Yoast SEO, Rank Math, WooCommerce Blocks, WooPayments, Stripe for WooCommerce, and the standard Storefront / Astra / Divi / Elementor themes. = Privacy and consent = * **Anonymous lifecycle telemetry is off by default.** On first activation a single admin notice asks once. Pick "No thanks" and the plugin never contacts our backend for analytics. Pick "Enable" and you can change your mind any time under **xpay✦ Commerce → Settings → Privacy**. System-wide opt-out via `define( 'XPAY_WC_TELEMETRY', false );` in `wp-config.php`. * **Full data disclosure** at [install.xpay.sh/woocommerce/privacy.html](https://install.xpay.sh/woocommerce/privacy.html) — every byte the plugin sends, when it sends it, how to opt out, how to request deletion. = More from xpay = * **[Agentic commerce, explained](https://www.xpay.sh/agentic-commerce)** — what changes when AI assistants, not people, do the browsing. * **[Plugin listing and version history](https://www.xpay.sh/directory/woocommerce/plugins/agentic-commerce-for-woocommerce/)** — feature detail, release notes and compatibility, kept current. * **[ChatGPT Ads for store owners](https://www.xpay.sh/merchants/chatgpt-ads/explained/)** — eligibility, costs and what to expect before you spend anything. = Source code = The plugin is GPLv2-or-later and ships as readable PHP — the complete source is in `wp-content/plugins/agentic-commerce-for-woocommerce/` on your own server the moment you install it. You can read it, fork it, modify it, redistribute it and self-host it without paying anything. Full technical changelog: [install.xpay.sh/woocommerce/CHANGELOG.md](https://install.xpay.sh/woocommerce/CHANGELOG.md). Questions or bug reports: merchants@xpay.sh, or the support forum on this page. == Installation == = From the WordPress.org plugin directory = 1. In your WordPress admin, go to **Plugins → Add New**. 2. Search for "Agentic Commerce for WooCommerce". 3. Click **Install Now**, then **Activate**. 4. You'll be redirected to **xpay✦ Commerce → Settings**. Click **Connect store**. 5. Approve the WooCommerce REST API permissions on app.xpay.sh, then you'll be redirected back to your store. = System requirements = * WordPress 6.2 or higher * WooCommerce 7.0 or higher * PHP 7.4 or higher * SSL (`https://`) on the store domain — required for the agent discovery files to be honored by AI surfaces == Frequently Asked Questions == = Will this slow down my store? = No. What we add to your pages is a few lines of invisible data. Your catalog is served from our CDN, so AI shoppers reading it never touch your server at all. = Does xpay see my customers or their payment details? = No — never. Payment runs through your existing gateway exactly as it does today. No buyer names, emails, addresses, cards or order contents ever reach us. = Will it change how my product pages look? = Almost everything we add is invisible to shoppers. The one exception is the product FAQ block, and it is **off on new installs** — nothing appears on your store until you ask for it. = I already use Yoast or Rank Math. Will this conflict? = No. We check what they've already published and add only what's missing, so you never end up with two of anything. = How much does it cost? = Free to install and use. Paid plans as you grow — [see pricing](https://www.xpay.sh/pricing/?tab=agentic-commerce). = What does it send to xpay, and when? = Nothing until you click **Connect store**. After that: your public product details (name, description, price, stock, images, categories) so we can publish your catalog for AI shoppers. Optional anonymous diagnostics are **off by default** and you're asked once. No customer data, no order data, ever. [Full disclosure](https://install.xpay.sh/woocommerce/privacy.html). = How do I remove it? = **Plugins → Deactivate → Delete**, and everything the plugin wrote is removed from your database. To also delete your catalog from our CDN, email privacy@xpay.sh from your admin address. = I run several stores. Do I install it on each? = Yes — each store gets its own catalog and its own settings. = Do you support Subscriptions, Bookings or Memberships? = Simple, variable and grouped products today. The others are on the roadmap — email merchants@xpay.sh if one is blocking you and we'll tell you where it stands. = My host blocks /.well-known/ — does discovery still work? = Yes. There's an automatic fallback that AI shoppers find on their own. If your host intercepts those paths, nothing breaks. = Is the source code available? = Yes. GPLv2-or-later, shipped as plain readable PHP in `wp-content/plugins/agentic-commerce-for-woocommerce/`. Nothing minified, obfuscated or loaded from a remote script. Developers: `add_filter( 'xpay_wc_faq_visible', '__return_false' );` turns the FAQ block off from code, whatever the dashboard says. = I have a question that isn't answered here. = Email merchants@xpay.sh, or post in the support forum on this page — we answer both, and we aim to reply within one business day. == External services == This plugin connects to the following xpay-operated services to deliver its core function. Every endpoint and its purpose is documented; full payload disclosure is in the [Privacy](https://install.xpay.sh/woocommerce/privacy.html) section. 1. **agent-feed.xpay.sh** — Public CDN that hosts your AI-readable catalog feed at `https://agent-feed.xpay.sh/catalog/{your-slug}.json`. The plugin does not contact this URL directly; the xpay backend writes it from your WooCommerce REST API after you click **Connect store**. 2. **agent-commerce.xpay.sh** — The agent-side API that AI shopping agents call to surface and buy from your products. The plugin contacts this host at the following paths: (a) `POST /v1/onboard/woocommerce/wc-auth-callback` is the WooCommerce OAuth callback target (WordPress itself calls this on your behalf, server-to-server, after you approve the one-click connect prompt); (b) `GET /v1/onboard/woocommerce/status?nonce=…` is polled by the xpay onboarding page while the handshake finishes; (c) `POST /v1/merchants/{slug}/resync` triggers a fresh catalog ingest after a product or stock change; (d) `GET /v1/merchants/{slug}` is called when **xpay✦ Commerce → Settings** verifies the current connection state; (e) `PATCH /v1/merchants/{slug}/products/{sku}` pushes a single-product delta when a WooCommerce product/stock webhook fires; (f) `DELETE /v1/merchants/{slug}` is sent (non-blocking) when you click **Disconnect** so xpay marks your account as disconnected and archives the cached catalog. The hostname is also the publicly advertised target for `POST /mcp/{slug}` (the JSON-RPC commerce MCP endpoint AI agents talk to) — the plugin itself does not call this URL but lists it in the `/.well-known/ucp` manifest. 3. **app.xpay.sh/onboard/woocommerce** — The merchant-side onboarding page. When you click **Connect store**, the plugin redirects your browser here with three query-string parameters: your site URL, your administrator email address, and a one-time random nonce generated locally. No data is sent to xpay before you click the button. You sign in or sign up on xpay and grant the WooCommerce REST API permission there. 4. **agent-commerce.xpay.sh/v1/events** — Optional anonymous lifecycle telemetry. Disabled by default; only contacted if you explicitly opt in via the first-activation admin notice or **xpay✦ Commerce → Settings → Privacy**. Full payload disclosure in the Privacy section. 9. **agent-commerce.xpay.sh/v1/merchants/{slug}/orders** — Agent-attributed order reporting for connected stores (non-PII order summary + attribution source; no customer, payment, or personal data). Off via the `xpay_wc_order_events_enabled` option. Full payload disclosure in the Privacy section. 8. **agent-commerce.xpay.sh/v1/agent-analytics** — Optional anonymous AI-bot crawl analytics. Disabled by default; shares the same opt-in as item 4 (and respects a separate `define( 'XPAY_WC_AGENT_ANALYTICS', false )` hard-off). When enabled, the plugin counts requests from *known AI bots only* (e.g. GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot, Google-Extended) — recording the bot name, a coarse page type (home/product/category/discovery-file/sitemap/other), the HTTP status, and whether we routed the bot to your structured catalog. It also sends an aggregate daily count of human pageviews (a number only — no user-agent, no URLs, no per-visit data) as the AI-vs-human denominator. Since 0.5.3 a bot event also carries a salted, one-way hash of the connecting IP address (a bot's — behind a proxy or CDN this is the connecting edge address), so two hits from the same crawler can be counted as one visitor. The salt is unique to your store and is regenerated every day, so the hash cannot be linked across days or across stores, and the address itself is never stored or transmitted. This applies to AI bots only — a human visitor's IP is never read, hashed or sent. Events are buffered locally and sent in the background by WP-Cron, never on a page load. Cart, checkout, account, admin and REST paths are never recorded. No per-visit human data, no customer, order, or personal data. 5. **audit.xpay.sh** — Merchant-facing audit dashboard. The plugin emits a link to `audit.xpay.sh/{your-slug}` on the Settings page so you can review the live agent-readiness score xpay computed from your catalog; the plugin itself does not fetch from this host. Opening the link from your browser sends standard browser headers to xpay. 6. **auth.xpay.sh** — Public OAuth-protected-resource discovery target. The plugin publishes `auth.xpay.sh` as the `authorization_servers[0]` entry in `/.well-known/oauth-protected-resource` (an RFC 9728 metadata document AI agents fetch to learn where to obtain a token). The plugin does not contact this host server-to-server; it is referenced for agent-side discovery only. 7. **install.xpay.sh/woocommerce/{terms,privacy}.html** — Static legal documents linked from this readme and from the Settings privacy panel. The plugin itself does not fetch these URLs; clicking the links opens them in your browser. Terms of use: [install.xpay.sh/woocommerce/terms.html](https://install.xpay.sh/woocommerce/terms.html) Privacy policy: [install.xpay.sh/woocommerce/privacy.html](https://install.xpay.sh/woocommerce/privacy.html) == Privacy == **We never see your customers, your orders, or any payment data.** The plugin is non-custodial by design. * **Nothing leaves your site until you click Connect store.** Before that, the settings page makes no outbound request of any kind. * **After you connect** we receive: your site URL, your admin email, a one-time nonce, a WooCommerce REST API key so we can read your catalog, and your public product fields (name, description, price, stock, images, categories). **No customer data. No order data. No payment data.** * **Anonymous diagnostics are OFF by default.** You're asked once. If you turn them on, we receive plugin lifecycle events and version numbers tagged with your site URL — and, separately, counts of *known AI bots only* (which bot, what kind of page, the response code) plus a daily total of human pageviews as a number, so you can see your AI-vs-human split. **A human visitor's IP address is never read, hashed or sent**, and cart, checkout, account and admin pages are never recorded. * **Turn it off any time** at **xpay✦ Commerce → Settings → Privacy**, or hard-disable in `wp-config.php` with `define( 'XPAY_WC_TELEMETRY', false );` (or `XPAY_WC_AGENT_ANALYTICS` for bot counts alone). The constant overrides any UI choice. * **Delete your data**: email privacy@xpay.sh from your admin address with your store name. Processed within 7 business days. Every byte, itemised: [install.xpay.sh/woocommerce/privacy.html](https://install.xpay.sh/woocommerce/privacy.html) · [Terms](https://install.xpay.sh/woocommerce/terms.html) == Screenshots == 1. Your AI revenue, last 30 days — with the match rate beside it, so you know how much of it we can actually account for. 2. ChatGPT Ads, managed inside WooCommerce — campaigns, budgets and spend, with the orders we reconciled against your real store next to what OpenAI reports. 3. Which AI assistants are reading your store — ChatGPT, Claude, Perplexity and Gemini crawlers over time, against your human traffic. 4. Your ChatGPT product feed, scored listing by listing — exactly which products are incomplete, and why. 5. Your agent-readiness score and the prioritised list of what to fix first. 6. The AI storefront assistant answering a shopper from your own catalog — and off until you say otherwise. == Upgrade Notice == = 0.6.3 = The AI Storefront Assistant now loads reliably alongside caching/optimization plugins (WP Rocket, LiteSpeed, Autoptimize, SiteGround) with no manual exclusion, and shows your store's name correctly on multilingual stores. = 0.6.2 = Product-FAQ sync is safer: a single product's FAQ can update on its own, and a partial or interrupted sync can no longer wipe FAQs you've already approved. = 0.6.1 = Turning the AI Storefront Assistant on now takes effect immediately on cached stores, instead of waiting for the cache to expire. Fixes the full-page shopper returning 404 after you enable it. Adds support for opening a side-cart drawer from an off-site link. = 0.6.0 = Control over the on-page product-FAQ block, which previously had no off switch. It now also renders on page-builder themes, as a product tab or an [xpay-faq] shortcode, with headings in your own language. Page caches are cleared when FAQs change. = 0.4.4 = GDPR-aware attribution defaults for EU/UK stores, asynchronous order-attribution dispatch off the shopper's thank-you page, a resilient widget consent gate with a 60-second failure breaker, and GTIN schema validation for non-numeric identifiers. = 0.4.3 = AI-attributed orders: shoppers referred by ChatGPT, Perplexity, Claude, Gemini, Copilot and 10+ more assistants now surface in your xpay dashboard with revenue split by source. Strictly non-PII. Bundles the 0.4.2 capabilities. = 0.4.2 = Explicit-consent gate on the AI Storefront Assistant — chat surfaces only after you turn it on. GTIN in Product JSON-LD. Variable-product carts. Defensive out-of-stock guard at the deeplink. Seconds-fast dashboard propagation. = 0.4.1 = Optional Content Engine add-on: when enabled for your store, xpay can publish answer-first comparison/buying-guide pages to your site. Off unless you're subscribed. = 0.3.7 = Maintenance and reliability polish, plus optional agency/referral attribution for stores set up by a partner. = 0.3.6 = AI-bot crawl analytics: see which AI crawlers (GPTBot, ClaudeBot, Perplexity, etc.) discover your store and whether they reach your discovery files, on your xpay dashboard. Opt-in, off by default, shares the telemetry consent. Known AI bots only — no human or customer data. = 0.3.5 = New /agents.md skill tells AI shopping agents exactly how to browse your live catalog and build a cart. Hardened /llms.txt merge that ignores non-text pages from headless storefronts. Optional shopping-bot routing to your structured catalog, off until you enable it. = 0.3.4 = Outcome-first Connect screen: plain-language value, no jargon, and an upfront promise that it's safe to try — the plugin writes no files to your site and fully reverts on deactivate. New panel lists every external service the plugin contacts. = 0.3.3 = New Tools → Run site diagnostics button verifies that AI agents and xpay can reach your store (Permalinks, REST API, /.well-known/ discovery files) and tells you exactly what to do if a layer needs attention. = 0.3.2 = Good-neighbour discovery: if your site already publishes its own `llms.txt`, this update appends our agent-shopping sections at the end and leaves your content untouched. Backend-callable admin/refresh endpoint and a smoother connect handshake round it out. = 0.3.1 = Second WP.org review pass: REST endpoints constructed via `rest_url()` to respect custom REST prefixes, raw-Markdown `/llms.txt` output, i18n-wrapped readiness strings, and an expanded External Services disclosure. See Changelog for full details. = 0.3.0 = Privacy hardening: Settings → xpay is pure markup — outbound requests fire only after you click **Connect store**. Declares WC dependency via the WP 6.5 `Requires Plugins` header. See Changelog for full details. = 0.2.4 = Settings → xpay reorganised into five tabs (General, Capabilities, Payments, Links, Tools). Toggle UCP shopping capabilities, map your gateways to `payment_handlers[]`, and override the URLs in `ucp.links`. See Changelog for full details. = 0.2.1 = Tighter alignment between what /llms.txt advertises and what's actually serving — the Commerce protocols section is now backend-driven. See Changelog for the full backend-side changes. = 0.2.0 = Aligned with ACP / UCP / AP2 commerce standards and the real discovery conventions (llms.txt, schema.org JSON-LD, robots.txt allowlist). Serves `/.well-known/ucp` for capability negotiation. See Changelog for full details. = 0.1.12 = Plugin RENAMED to "Agentic Commerce for WooCommerce" (slug `agentic-commerce-for-woocommerce`). Same product, same code — the previous name overlapped with the existing Nexi XPay plugin in the directory. See Changelog for full details. = 0.1.11 = Plugin Check (PCP) follow-up: cleared the four remaining PrefixAllGlobals warnings. No functional changes. See Changelog for full details. = 0.1.10 = Plugin Check (PCP) submission-readiness pass: tested up to WP 6.9, short description trimmed to ≤150 chars, removed the deprecated load_plugin_textdomain() call (WP auto-loads WP.org-hosted translations since 4.6), and excluded non-canonical markdown from the zip. = 0.1.9 = Docs moved from docs.xpay.sh/products/woocommerce → docs.xpay.sh/merchants/woocommerce so the path matches the audience. Future Shopify / BigCommerce integrations will live as siblings under /merchants/. URL-only; no code changes. = 0.1.8 = Pricing link updated. Punchier Description hero. Full setup walkthroughs with screenshots published at docs.xpay.sh/merchants/woocommerce — readme now backlinks them at the right moments (install / REST API keys / connect / audit / troubleshooting / privacy). = 0.1.7 = Source repo at github.com/xpaysh/agentic-commerce-for-woocommerce is now public. Restored repo link references in readme.txt FAQ and source-code section so reviewers and merchants can browse the source directly. = 0.1.6 = GitHub link references in readme.txt held back until the source repo flips public (currently private). Plugin remains GPLv2-or-later — the installed zip is the canonical unminified source. = 0.1.5 = Adds the `/?xpay_route=acp` query-arg fallback for the discovery file on hosts that intercept `/.well-known/`. Post-activation redirect now also fires for upgrades where the store hasn't connected yet. WC HPOS compatibility declared. Privacy + terms pages live. == Changelog == The full machine-readable changelog lives at [install.xpay.sh/woocommerce/CHANGELOG.md](https://install.xpay.sh/woocommerce/CHANGELOG.md) (Keep-a-Changelog format). The summary below is the WP.org-required mirror. = 0.6.3 = * **The AI Storefront Assistant now loads reliably alongside caching/optimization plugins.** When WP Rocket, LiteSpeed Cache, Autoptimize or SiteGround Optimizer minifies, combines, delays or self-hosts JavaScript, it could break the assistant loader so the chat bubble never appeared — while everything looked fine in an incognito/preview window. The loader is now excluded from those optimizers automatically, so you no longer need to add a manual exclusion. (For W3 Total Cache or an edge cache, which have no runtime hook, the plugin still shows a one-line manual-exclusion note.) * **Fixed: the assistant could show "Array" instead of your store name on multilingual stores.** A localized store name is now resolved to your store's language before it's displayed. * No other storefront changes — reliability fixes only. = 0.6.2 = * **Your approved product FAQs can no longer be wiped by a partial or interrupted sync.** Previously, every FAQ sync replaced the entire stored set with whatever it received — so if a sync ran with an incomplete list (a dropped connection, a catalog still rebuilding), any product left out had its FAQ silently deleted. A sync that would shrink your FAQ set by more than half is now refused unless it explicitly confirms a full replace, so an accidental one fails loudly instead of clearing your pages. * **A single product's FAQ can now be updated on its own.** Approving one new product, editing one answer, or changing the heading no longer resends every FAQ — the update touches only the products it names and leaves the rest exactly as they were. Only the changed product pages are cleared from your cache. * No visible change to your storefront; these are safety improvements to how xpay keeps your FAQs in sync. = 0.6.1 = * **Enabling the AI Storefront Assistant now works immediately on a cached store.** If you run WP Rocket, LiteSpeed, WP Super Cache, W3 Total Cache, WP Fastest Cache, Cache Enabler or SiteGround, your pages were served from the cache *before* our code ran — so you could switch the assistant on and see nothing change, sometimes for hours, until each page's cache happened to expire. The page cache is now cleared when you turn the assistant on or off. (Cloudflare APO caches at the edge and can only be purged with your own Cloudflare credentials; those stores still wait for the edge TTL. Developers can hook `xpay_wc_purge_site_cache` to wire up any other stack.) * **Fixed: the full-page shopper could stay a 404 after you enabled it.** The page is only reconciled when someone loads wp-admin or an hourly job runs, and it refuses to publish until your account is confirmed as entitled — so if you enabled it before that confirmation landed, your own link was dead and nothing retried it. It can now be published on demand. * **Your shopper page is no longer renamed behind your back.** If you retitled it or changed its slug, we were silently restoring our own value every time the page was reconciled — breaking your menu link. Your edits are now left alone. * **New: open a side-cart drawer from an off-site link.** Stores using a side-cart plugin (such as Caddy) often retire the `/cart/` page entirely, leaving any link to it a dead end. A link ending in `#open-cart` now opens the drawer instead. Does nothing on stores without a side cart. Developers can switch it off with `add_filter( 'xpay_wc_side_cart_bridge', '__return_false' );`. = 0.6.0 = * **The on-page FAQ block now has an off switch.** For products you approve, xpay publishes FAQ schema that AI shoppers and search engines read. Until now it *also* injected a visible FAQ section into your product pages, with no way to say no — **that switch now exists**, managed from your xpay account. New installs start with the block off. Stores already displaying it keep displaying it (this release doesn't strip it off your live pages) and can now have it turned off. Either way the schema is unaffected: approving a FAQ publishes the answers to AI shoppers; showing them to your own shoppers is a separate decision. Developers can force it off from their own code with `add_filter( 'xpay_wc_faq_visible', '__return_false' );`. * **The FAQ block works on page-builder themes.** It can now render as a WooCommerce **product tab**, which Elementor and similar builders display — previously it hung off a hook those themes never call, so stores built with them saw nothing at all. There's also an `[xpay-faq]` shortcode if you want to place it exactly where you like. Classic themes keep the original placement. * **FAQ answers show in your own language.** The section heading arrives with the FAQ content instead of being hardcoded English, so a French store gets a French heading. It's now called "Additional questions" rather than "Frequently asked questions" — these answer the commerce facts (delivery, returns, variants) that your own product FAQ usually doesn't. * **FAQ changes appear immediately on cached stores.** If you run LiteSpeed, WP Rocket, WP Super Cache or W3 Total Cache, the cached copy of a product page was served before our code ran — so an updated FAQ stayed invisible until the cache happened to expire. Product pages are now cleared from the cache whenever their FAQ changes. * **Non-returnable products no longer advertise a return window.** A product marked as non-returnable was still emitting a 14-day return window in its schema, contradicting its own FAQ text. The return category, method and fees you set are now used as given. * **One FAQPage per page.** Where xpay can see that another plugin (Rank Math, a dedicated FAQ plugin) already publishes FAQ schema on a product page, it stands down instead of adding a competing one. = 0.5.3 = * **AI referrals are now detected even when your pages are cached.** If your store runs a page cache, the cached HTML is served before our code runs — so a shopper arriving from ChatGPT looked identical to someone typing your address in. Detection now also happens in the browser and reports back to a page that is never cached, which is how WooCommerce's own order-source tracking works. Referrals from AI assistants stop silently disappearing. * **Works with WP Rocket out of the box.** Our referral tag no longer gets swallowed by WP Rocket's cache, and it does not create a second cached copy of the page. * **A "likely AI (unconfirmed)" signal, kept honest.** Some AI apps (ChatGPT's iOS app, the Atlas browser) send no clue at all — Atlas even identifies itself as ordinary Chrome, so no rule can ever spot it for certain. Where an order arrives with no referrer straight onto a deep product page, we now flag it as *possible* AI influence and show it separately. It is never counted as confirmed AI revenue. * **Fixed: Google crawls could have been mislabelled as AI traffic.** Gemini's fetcher identifies itself as exactly "Google", which is also the start of "Googlebot" — we now require an exact match, so your ordinary Google search crawling is never misreported as an AI referral. * **Better AI-crawler reporting.** Repeat visits from the same crawler can now be grouped into sessions, using a salted daily hash of the bot's address (never a person's, and never the address itself). Added lmarena.ai and komo.ai; removed a rule that could never match anything. = 0.5.2 = * **See the orders AI agents actually place.** WooCommerce's built-in Agentic Checkout records a session ID on every order an AI agent completes through it. We now read that ID, so those orders show up in your dashboard as confirmed agent orders instead of being lumped in with everything else. This applies to new orders from now on — it can't reach back and re-label past ones. * **Attribution that survives page caching.** If your store runs a page cache (WP Rocket, LiteSpeed and friends), the cached HTML is served before our code gets a chance to look at where the shopper came from — so referrals from ChatGPT and other assistants were being missed. We now also read WooCommerce's own order-source data, which is recorded in the shopper's browser and isn't affected by caching. * **Orders paid by bank transfer, cheque or cash on delivery are no longer skipped.** Previously only orders that reached "Processing" or "Completed" were reported. Stores using offline payments, or shipping plugins with their own custom statuses (La Poste, for example), were missing roughly a fifth of their orders. * **Order reporting no longer depends on a visitor arriving.** Order events were queued for WordPress's scheduler, which only runs when someone next loads a page — so on a quiet store an order could sit unsent for hours, or never send. Orders now dispatch straight after checkout, and a daily catch-up re-sends anything that slipped through the past week. Only runs on stores connected to xpay. = 0.5.1 = * **Help search engines find your articles.** Your blog's sitemap is now reachable on your own domain (yourstore.com/blog/sitemap.xml), and its address is added to your robots.txt automatically — so Google and other search engines discover and index your xpay articles faster. Only active when the blog feature is turned on, and it adds to your robots.txt without changing anything already there. = 0.5.0 = * **Publish your xpay articles on your own domain.** Your Content Agent articles can now appear at yourstore.com/blog — on your own domain instead of a separate subdomain — so the pages build your site's authority and are more likely to be cited by AI answer engines. Off until you turn it on; only the articles xpay created for you; your own content always wins if you already have a page at that address. = 0.4.4 = * **GDPR-aware attribution defaults.** EU/UK stores (30-country list: all EU + EEA IS/LI/NO + UK) ship with the 30-day `_xpay_ref` persistence cookie OFF by default; the WC session still carries attribution through the active shopping journey (~48h). New `xpay_wc_attribution_cookie_enabled` option and `xpay_wc_attribution_should_set_cookie` filter for CMP integrations (Cookiebot, Iubenda, Complianz, etc.). * **Asynchronous agentic-order attribution.** Order summaries dispatch in the background via a `wp_schedule_single_event` cron job that fires immediately through WP-Cron loopback, keeping the shopper's thank-you page on the critical path. An in-flight sentinel collapses concurrent completion hooks into a single dispatched job. * **Resilient storefront-widget consent gate.** Only successful entitlement responses are cached for an hour; transient backend failures use a 60-second breaker so a brief blip clears within a minute instead of locking the widget out for the full hour. * **GTIN schema validation.** Numeric identifiers continue to emit as length-keyed `gtin8`/`gtin12`/`gtin13`/`gtin14`; alphanumeric values now route to the bare `gtin` slot per schema.org so Google Search Console accepts the markup on every PDP. = 0.4.3 = * **AI-referred orders are now attributed and reported.** When a shopper completes checkout after being referred by an AI assistant — through one of our links (sidecar, MCP, chat widget) or via a Referer / `utm_source` from ChatGPT, Perplexity, Claude, Gemini, Copilot, Meta AI, You.com, DeepSeek, Grok, Phind, Poe, Mistral, HuggingChat, Kagi or DuckDuckGo AI — the order surfaces in your xpay dashboard's attributed-orders feed with revenue split by source. First-touch attribution carried in a first-party cookie (30 days, no third-party tracking). * **Strict no-PII contract.** Only `order_id`, `placed_at`, `status`, `amount_total`, `amount_discount`, `currency`, `line_count`, ordered SKUs and the attribution source leave your store. Never customer email, address, phone or IP. The server-side ingest enforces an allow-list on top-level keys as defence in depth. As of 0.5.2 an attributed order may also carry: the WooCommerce Agentic Checkout session and provider ID (present only on orders an AI agent completed through WooCommerce's own agentic checkout), and WooCommerce's own order-source context — the channel type (`utm`/`organic`/`referral`/`typein`/`admin`), the device type, and the *path* of the page the shopper first landed on. The landing value is the path only: the host, query string and fragment are stripped before it leaves your store, so no tokens or personal data can ride along. Still never sent: customer email, address, phone, or IP. * **No re-authorization needed.** Uses existing plugin permissions only — no new WooCommerce REST scope, no new merchant grant. WordPress will not surface a "permission change" prompt on auto-update. * **Includes everything from 0.4.2** (consent-gated AI Storefront Assistant, GTIN in product schema, defensive out-of-stock guard at the cart deeplink, variable-product carts, faster dashboard propagation). = 0.4.2 = * **AI Storefront Assistant is consent-gated.** The chat bubble surfaces on your storefront only after you explicitly turn it on — either from the Storefront Assistant page in the xpay dashboard or from the WooCommerce settings toggle. A backend subscription or design-partner grant alone never renders the widget; you stay in control of what shows on your site. * **GTIN in product schema.** When your products carry a `global_unique_id` (WC 8.6+) or a legacy GTIN/EAN/UPC value, it's emitted in the Product JSON-LD as `gtin8`/`gtin12`/`gtin13`/`gtin14` so Google Shopping, Bing and AI shopping agents can match each PDP to the corresponding offer in your feed. * **Defensive out-of-stock guard at the cart deeplink.** The cart-deeplink handler refuses lines whose target product or variation is out of stock — a guard against stale agent responses or manual deeplinks arriving after a stock-out. If every line is rejected, you still get the existing "items unavailable" response. * **Variable-product carts.** Agent-minted carts pass the variation attribute map through to `WC()->cart->add_to_cart()` so variable-product lines flow into checkout correctly. Variation SKUs supplied without a separate variation id are resolved automatically. * **Faster propagation.** Toggle and appearance changes from the xpay dashboard take effect on your storefront within seconds. = 0.4.1 = * **New: Content Engine pages.** When your store is subscribed to the Content Engine add-on, xpay can publish answer-first comparison, buying-guide and listicle pages — tuned to the questions AI assistants ask — as real Pages on your own domain (indexable, in your sitemap, human-visible, and discoverable by AI agents). Pages stay in sync automatically: published while subscribed, reverted to draft if you unsubscribe, and we only ever touch pages we created — your own content is never modified. Off by default; nothing publishes unless the add-on is active for your store. = 0.3.7 = * Maintenance and reliability polish. * Optional agency/referral attribution: a store set up by a partner can carry that partner's referral code — captured automatically from a referral link, entered on the Connect screen, or pinned by the installer. Counts only — no product, customer or order data is shared. = 0.3.5 = * **New: `/agents.md` agent skill.** A dedicated, machine-readable skill served at `yourstore.com/agents.md` that tells AI shopping agents (and skill-using assistants) exactly how to connect to your store: browse the live catalog over MCP or REST, look products up, and build a cart that hands the shopper off to your existing checkout. Purpose-written connect-and-transact instructions — not a copy of `/llms.txt`. Served once your store is connected; like our other discovery files it steps aside quietly if you already publish your own `/agents.md`. * **Hardened `/llms.txt` merge.** When appending to an existing `/llms.txt`, the plugin ignores non-text responses. Hybrid/headless storefronts and single-page themes that answer every URL with an HTML page have that page rejected instead of pulled in above our agent-shopping sections. * **Branded catalog link.** The `/llms.txt` catalog link now points at your store's own agent-commerce surface instead of the shared feed host (same data, your brand). * **Optional AI shopping-bot routing.** Realtime AI *shopping* assistants can be transparently routed to your structured catalog surface for cleaner, faster product data, while search/indexing crawlers stay on your store for citations. Centrally controlled and **off by default** — nothing changes for your site until xpay enables it for your store; never affects humans, logged-in users, your cart, or checkout. = 0.3.4 = * **Outcome-first Connect screen.** The pre-connect panel leads with what you get — your products discoverable to ChatGPT, Claude, Gemini and Perplexity, with no code and no payment change — and demotes the protocol acronyms (llms.txt, schema.org, ACP/UCP/AP2/MCP) to a small footnote for technical reviewers. * **Upfront safety promise.** The Connect screen now states plainly what this update verified end-to-end: the plugin writes zero files to your site, doesn't touch your theme or payments, appends to any existing `/llms.txt` rather than replacing it, and fully reverts the moment you deactivate. * **New transparency panel.** Once connected, the General tab lists every external service the plugin contacts (`agent-feed.xpay.sh`, `agent-commerce.xpay.sh`, `app.xpay.sh`) and what each receives, alongside the Terms and Privacy links. * **Value-first telemetry opt-in.** The anonymous-diagnostics prompt explains the benefit to you — we can flag a silently broken AI connection (failed sync, blocked endpoint) before your products drop out of ChatGPT, Claude and Perplexity. Still off by default, still no customer or order data, still changeable any time. = 0.3.3 = * **New: Run site diagnostics (Tools tab).** One click loopback-checks the three layers that gate connection at the web server before WordPress runs: the WordPress REST API (Pretty Permalinks), the plugin's own REST routes, and the `/.well-known/` discovery files. Each row shows pass/fail with the HTTP status, and any failure renders the exact next step — switch Permalinks off "Plain", or (on Apache/ACME hosts that reserve `/.well-known/`) the query-arg fallback URL that agents can still use. * **No behaviour change to the connect flow itself.** Diagnostics are network-only on the explicit button click; the Settings page still makes zero outbound calls on render. = 0.3.2 = * **Good neighbour with other AI/SEO plugins.** If your site already publishes its own `llms.txt` (e.g. via Yoast SEO AI, RankMath AI, AIOSEO, or your own setup), the plugin appends our agent-shopping sections at the end of your file. Everything you wrote is preserved exactly as you wrote it; `/.well-known/*` JSON emitters defer to existing handlers cleanly. * **Automatic detection.** A daily WP-Cron probe (and a 6-hour transient cache) detects when another tool is publishing one of the same discovery files we do. When it sees one, we step aside or append cleanly — no merchant action needed. * **Smoother connect experience.** A handful of polish items in the Connect flow so the handshake is quicker and an idempotent retry resolves silently. * **Backend-callable admin/refresh endpoint.** Once you're connected, xpay can flush local discovery caches and fine-tune small parts of your discovery setup without a plugin update. Constant-time site-token auth, local-only actions (no outbound HTTP triggered by the endpoint), forward-compatible action vocabulary. = 0.3.1 = * **REST endpoints constructed via `rest_url()`.** The fallback UCP manifest now calls `rest_url('xpay/ucp/v1')` / `rest_url('xpay/mcp')` instead of hardcoding `home_url('/wp-json/...')`, so the plugin respects sites that customize the REST prefix. Per the WP.org Determining Locations guideline. * **Tested against WordPress 7.0 + WooCommerce 10.8.1** on a clean sandbox with `WP_DEBUG=true`. = 0.3.0 = * **Privacy: no outbound calls on Settings page load.** The Connect panel no longer pre-registers a nonce with the xpay backend when the page renders. The nonce is generated, the attempt is stamped, and the merchant is redirected to the xpay onboarding flow only after the **Connect store** button is clicked. Matches WordPress.org's no-phoning-home guideline. * **`Requires Plugins: woocommerce` header.** Declares the WooCommerce dependency via the WP 6.5 plugin-dependencies mechanism so the plugin won't activate without WooCommerce present. Existing manual activation check remains as defence-in-depth for pre-6.5 sites. * **Inline admin script removed.** The Connect button no longer emits an inline `