About this plugin
CacheSafe for WooCommerce checks cart caching and customer session isolation using controlled anonymous cart sessions. Use it to investigate whether caching could mix cart responses between sessions.
Run a manual scan, review the findings, and share a sanitized report with your developer or hosting provider. Results describe the tested requests and scan conditions; a passing scan is not a guarantee for every customer or cache path.
Scans create temporary anonymous carts using a configured test product. They do not place orders or process payments. CacheSafe provides guidance so you can investigate findings; it does not change cache settings automatically.
Manual scans, sanitized reports, provider guidance, and WP-CLI are included. Evidence stays on your site, with no telemetry or account required.
What it does
- Preflight checks — WooCommerce pages, loopback reachability, Store API, test product, runner health, perspective
- Manual staged scans — Store API Cart-Token A/B isolation plus classic cookie/add-to-cart flow where supported
- 16 safety checks (CS-101–116) — headers, Set-Cookie, session isolation, replay, cleanup, perspective
- Sanitized reports — copy or download JSON, text, or HTML without cookie values, tokens, or raw bodies
- Provider guidance — evidence-linked remediation for generic stacks and common cache/CDN plugins
- WP-CLI — wp cachesafe preflight, scan, status, report, cancel, cleanup, purge
- Retention — keeps the last five completed scans within 30 days (configurable shorter); automatic daily purge
What it does not do
- Place orders, process payments, or call checkout write endpoints
- Change cache, CDN, DNS, or host settings automatically
- Send telemetry or require an account
- Show a numeric “safety score”
Admin
WooCommerce → CacheSafe with tabs for Overview, Preflight, Live scan, Results, History, Settings, and Tools.
Privacy
All scan evidence stays on your WordPress site. CacheSafe does not phone home. Reports are sanitized to exclude cookie values, Cart-Tokens, nonces, Authorization headers, raw bodies, secrets, and customer PII.
Retention is bounded and configurable; uninstall can remove plugin-owned data when enabled in Settings.
Development
Unminified JavaScript and CSS live in assets/src/. Built admin assets are written to assets/build/ via @wordpress/scripts.
To regenerate the compiled files from this plugin directory:
- npm install
-
npm run build
js ship with the plugin so the build can be reproduced without a separate repository.