=== CacheSafe for WooCommerce ===
Contributors: bananasaging
Tags: woocommerce, cache, session, cart, security
Requires at least: 6.9
Tested up to: 7.1
Requires PHP: 7.4
WC requires at least: 9.0
WC tested up to: 11.2
Stable tag: 1.0.5
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Check WooCommerce cart caching and session isolation. Investigate cache-related cart problems with controlled scans and sanitized reports.

== Description ==

CacheSafe for WooCommerce checks cart caching and customer session isolation using controlled anonymous cart sessions. Use it to investigate whether caching could mix cart responses between sessions.

Run a manual scan, review the findings, and share a sanitized report with your developer or hosting provider. Results describe the tested requests and scan conditions; a passing scan is not a guarantee for every customer or cache path.

Scans create temporary anonymous carts using a configured test product. They do not place orders or process payments. CacheSafe provides guidance so you can investigate findings; it does not change cache settings automatically.

Manual scans, sanitized reports, provider guidance, and WP-CLI are included. Evidence stays on your site, with no telemetry or account required.

= What it does =

* **Preflight checks** — WooCommerce pages, loopback reachability, Store API, test product, runner health, perspective
* **Manual staged scans** — Store API Cart-Token A/B isolation plus classic cookie/add-to-cart flow where supported
* **16 safety checks (CS-101–116)** — headers, Set-Cookie, session isolation, replay, cleanup, perspective
* **Sanitized reports** — copy or download JSON, text, or HTML without cookie values, tokens, or raw bodies
* **Provider guidance** — evidence-linked remediation for generic stacks and common cache/CDN plugins
* **WP-CLI** — `wp cachesafe preflight`, `scan`, `status`, `report`, `cancel`, `cleanup`, `purge`
* **Retention** — keeps the last five completed scans within 30 days (configurable shorter); automatic daily purge

= What it does not do =

* Place orders, process payments, or call checkout write endpoints
* Change cache, CDN, DNS, or host settings automatically
* Send telemetry or require an account
* Show a numeric "safety score"

= Admin =

WooCommerce → **CacheSafe** with tabs for Overview, Preflight, Live scan, Results, History, Settings, and Tools.

= Privacy =

All scan evidence stays on your WordPress site. CacheSafe does not phone home. Reports are sanitized to exclude cookie values, Cart-Tokens, nonces, Authorization headers, raw bodies, secrets, and customer PII. Retention is bounded and configurable; uninstall can remove plugin-owned data when enabled in Settings.

== Installation ==

1. Upload the `cachesafe-for-woocommerce` folder to `/wp-content/plugins/`, or install the ZIP via **Plugins → Add New → Upload Plugin**.
2. Activate the plugin through the Plugins screen.
3. Ensure WooCommerce is active and configure a **test product ID** under CacheSafe → Settings.
4. Run **Preflight**, then start a scan from **Live scan** or WP-CLI.

== Frequently Asked Questions ==

= Does this place test orders? =

No. CacheSafe only creates ephemeral anonymous carts using an approved simple product. It never completes checkout or captures customer PII.

= Is this a cache optimizer? =

No. It is an evidence-led auditor, not a performance plugin. It does not change cache provider settings for you.

= Does it work without WP-Cron? =

Yes. The Live scan tab advances scans while you watch; Action Scheduler is used when available but is not required for manual scans.

= How long is scan history kept? =

By default, the last five completed scans within 30 days. Failed or cancelled scans are purged sooner. You can purge manually from Tools or WP-CLI.

= Will this slow down my storefront? =

Scans are admin-triggered and budget-limited (default ≤30 HTTP requests, short timeouts). They are not continuous background traffic.

= Where can I get support? =

Use the [WordPress.org support forum](https://wordpress.org/support/plugin/cachesafe-for-woocommerce/) for this plugin.

== Screenshots ==

1. CacheSafe overview and scan summary
2. Live scan progress with stage timeline
3. Findings with sanitized evidence drawer

== Development ==

Unminified JavaScript and CSS live in `assets/src/`. Built admin assets are written to `assets/build/` via `@wordpress/scripts`.

To regenerate the compiled files from this plugin directory:

1. `npm install`
2. `npm run build`

`package.json` and `webpack.config.js` ship with the plugin so the build can be reproduced without a separate repository.

== Changelog ==

= 1.0.5 =
* Correct diagnostic snapshots so plugin-declared WooCommerce compatibility, the site’s HPOS enabled state, and cart/checkout page composition are reported as separate facts.
* This correction may produce a one-time environment snapshot hash change on the first scan after upgrading.

= 1.0.4 =
* Fixed a bootstrap failure when stored plugin settings contain malformed or out-of-range values.
* Added fail-closed release-package validation and reproducible build checks.
* Confirmed compatibility with WordPress 7.1.3 and WooCommerce 11.2.1.

= 1.0.3 =
* Fixed incomplete classic-cart checks masking confirmed Store API cart-isolation failures.
* Fixed installed-version tracking after in-place upgrades.
* Kept decisive Critical summaries visible when another required core check is Inconclusive.
* Expanded isolation and upgrade regression coverage.

= 1.0.2 =
* Added detection for unsafe public caching of Store API cart responses
* Restored cached-cart fragment-risk detection
* Added fail-closed cart item-count consistency validation
* Expanded unsafe-cache regression coverage
* Confirmed WooCommerce 11.1 compatibility

= 1.0.1 =
* Ship unminified `assets/src` plus build tooling in the distributable package for Guideline 4 source access
* List WordPress.org username bananasaging in Contributors

= 1.0.0 =
* Free v1.0 release: full manual scan pipeline, 16 checks, admin UI, WP-CLI, sanitized reports
* Store API and classic cookie A/B session isolation in live scans
* Automatic retention purge (daily cron + after scan completion)
* Provider-aware remediation catalog (Cloudflare, LiteSpeed, WP Rocket, WP Super Cache, W3 Total Cache, host-cache)
* Request-budget accounting and duplicate-finding fixes for live polling

= 0.1.0-alpha.0 =
* Early lab scaffold and quality toolchain

== Upgrade Notice ==

= 1.0.5 =
Improves the accuracy and clarity of WooCommerce feature information recorded in diagnostic snapshots.

= 1.0.4 =
This maintenance release prevents malformed stored plugin settings from causing a site-wide critical error.

= 1.0.3 =
Preserves confirmed Store API isolation failures when classic checks run incomplete, stamps the installed version after in-place upgrades, and keeps Critical summaries visible when another required core check is Inconclusive.

= 1.0.2 =
Improves Store API and cached-cart isolation detection; confirmed with WooCommerce 11.1.

= 1.0.1 =
Includes unminified front-end source and build tooling in the plugin package for public source access.

= 1.0.0 =
First public free release with complete manual scan workflow. Review Settings for test product ID before scanning.
