Description
All The-Goods Supplier Hub Core gives a WooCommerce administrator a supplier-independent connection and catalogue layer.
Core can:
- store multiple supplier connection profiles and encrypted credentials;
- connect to generic REST/JSON APIs using Basic, Bearer, API-key or token-exchange authentication;
- preview bounded responses and test authentication plus field mappings;
- normalize supplier product data into one internal model;
- browse live catalogues with server-side pagination;
- browse temporary catalogue snapshots without a permanent SQL catalogue index;
- enrich descriptive fields from an optional exact-match CSV content feed;
- record controlled diagnostic codes without raw credentials or response bodies;
- provide stable extension services for a separately installed add-on.
The administrator supplies endpoints, credentials and mappings from the chosen supplier’s documentation. The plugin does not run remote code. Core has no built-in supplier domains, fixed supplier list or required supplier account. Optional connector extensions are installed separately; their service documentation and settings belong to that extension.
Core is permanently usable without a licence, product quota or supplier quota. It contains no licence calls, telemetry or private updater. It does not create WooCommerce products, write WooCommerce inventory, import product media or send customer orders. Those functions are available in the separately distributed Supplier Hub Pro add-on.
Private feed storage must be blocked from public HTTP access by the hosting server. Apache and IIS rules are supplied. Hosts that ignore per-directory rules (including some managed static-file services) require an equivalent server-side deny rule for the plugin upload directory. Directory listing being disabled is not sufficient.
External services
This plugin contacts supplier or feed endpoints only after a site administrator configures the relevant connection or enables its scheduled refresh. There is no registration requirement for Core.
Generic REST/JSON, CSV and XML connections use the HTTPS URL and credentials supplied by the administrator. Review the selected supplier’s own terms and privacy policy before enabling the connection.
Core includes no predefined third-party supplier service. The administrator chooses each endpoint and must review that service’s API documentation, terms of use and privacy policy before configuring credentials. Separately installed connector extensions must document their own external services and requests.
Connection tests, response previews, live catalogue browsing, exact-product requests and scheduled catalogue/feed refresh may send the configured credential, account identifier, pagination values, product identifiers and filters to that endpoint. Returned product data may be stored in the local WordPress database or a private uploads directory. The administrator must review the chosen supplier’s terms and privacy policy.
Core sends no telemetry, licence request, WooCommerce customer record, payment data or order address to All The-Goods.
Languages and user guide
English is the source language. Available translations are distributed through translate.wordpress.org language packs. Existing independently installed WordPress language packs remain usable. The included user guide is one document with a Dutch/English language choice, accessible from Supplier Hub. Core does not change the rest of the WordPress dashboard language.
Private feed storage
Temporary feed snapshots use the all-the-goods-supplier-hub directory under the runtime WordPress uploads directory. Existing atgsh-private storage is retained in place for compatibility. Apache and IIS access-denial files are created before use. Nginx and other servers must be configured by the hosting administrator to deny HTTP access to this directory. Verify that direct requests are denied before using private feeds. The plugin does not edit hosting configuration. Existing cache files and supplier settings are retained during upgrades.
Privacy
Core stores supplier configuration, encrypted credentials, normalized catalogue fields, optional private feed snapshots, task state and diagnostic codes on the WordPress site. Logs are retained for thirty days. Core does not process customer orders or customer addresses. The plugin adds suggested text to the WordPress privacy-policy guide.
Installation
- Install and activate WooCommerce.
- Upload and activate Supplier Hub Core.
- Open Supplier Hub in wp-admin.
- Try the local test-data connector, or add an inactive REST/JSON supplier.
- Enter the supplier’s documented HTTPS endpoint and authentication settings.
- Map the required product fields.
- Preview the response and test the connection.
- Activate the supplier only after the test succeeds.
If you are replacing the earlier monolithic Supplier Hub 2.0 release, install Core and Pro together during one backed-up maintenance window. Follow the migration guide supplied with Pro.
FAQ
-
Am I limited to a fixed list of suppliers?
-
No. The generic connector is configured from the documentation and credentials supplied by your chosen supplier. Separately installed connector extensions can support additional service formats. Core does not require any named supplier, supplier account or site-specific extension.
-
Does Core import products into WooCommerce?
-
No. Core validates connections, mappings and catalogue data. The separate Pro add-on performs WooCommerce import, inventory synchronization, media import and supplier-order automation.
-
Does Core have a paid product or supplier quota?
-
No. Core has no commercial quota; a compact administration safety bound applies to stored connection profiles. The separately downloaded Pro trial can automate up to two selected suppliers and fifty managed WooCommerce products.
-
Are credentials sent to All The-Goods?
-
No. Core stores credentials encrypted in your WordPress database and sends them only to the supplier or feed service selected and explicitly configured by your administrator. Core has no telemetry or licence request.
-
Why must endpoints use HTTPS?
-
Supplier credentials and product data should not cross an unencrypted connection. Core also blocks embedded URL credentials, unsafe redirects and private/local network targets through WordPress safe HTTP handling.
-
Can any API work without configuration?
-
No universal API schema exists. The administrator must supply authentication, pagination and field mappings that match the supplier documentation. APIs with unusual signing or transport rules may require a separately developed connector.
-
What happens when I uninstall Core?
-
Deactivation preserves data. Uninstall removes Core data by default unless the data-retention setting is enabled. Shared supplier records are not deleted while the Pro plugin folder is installed.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“All The-Goods Supplier Hub” is open source software. The following people have contributed to this plugin.
Contributors
Translate “All The-Goods Supplier Hub” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.2.4
- Protect private directories and create owner-only feed files before writing data; repair existing cache file permissions without changing their contents.
-
Upgrade known legacy Apache access-denial rules while retaining existing feed caches and custom hosting rules.
-
Verify live catalogue request nonces before contacting a supplier, including exact searches and navigation.
- Keep operational notices on Supplier Hub screens; show dependency errors to plugin administrators.
- Use static storage guards under the plugin slug for new installations, retaining existing cache paths.
- Cancel feed continuations on deactivation and remove owned feed settings and nested cache files on an explicitly destructive uninstall. Preserve all data when retention is selected or Pro is installed.
- Align package documentation and version metadata.
1.2.1
- Avoid generating executable PHP in private cache storage; retain existing snapshots and fail on protection-file write errors. Scope administrative notices and document storage protection and translation distribution.
1.2.0
- Harden nonce-verified administration input parsing without altering credential or delimiter bytes.
- Use WordPress 6.8+ automatic translation loading for bundled Dutch and English source strings.
- Prepare uninstall table identifiers and clear owned options/transients through WordPress APIs, including aggregate-cache invalidation.
- Document narrowly scoped read-only nonce and advisory-lock exceptions at the affected lines.
- Remove supplier-specific adapters, service domains and supplier-branded administration from the reusable Core and Pro distributions.
- Provide documented extension hooks and a cached-product connector contract for separately installed adapters.
- Make full-list snapshot exact lookup an explicit per-profile setting with a configurable maximum age of 60 to 86400 seconds.
- Block a configured connection when its required extension is missing, without silently selecting another source.
- Keep generic REST/JSON, CSV and XML connections independent of private site extensions.
1.1.0
- Provide English source strings and a complete bundled Dutch translation.
- Include one user guide with Dutch/English language selection.
- Retain exact-product lookup against a complete saved catalogue snapshot under the documented source freshness rules.
- Clarify source freshness and retired permanent catalogue indexing.
- Escape translated interface text and document bounded private-cache streaming.
- Keep Core independent of commercial licensing, commerce writes and private updates.
1.1.0-rc.9.1
- Reject invalid numeric types in exact product responses.
- Apply saved full-list intervals and show dated configuration-specific test and worker status.
- Provide independent catalogue browsing and exact ID search without retired SQL index controls.
- Include the current Dutch customer guide.
1.0.0-rc.1
- First separated Core release candidate.
- Adds the generic REST/JSON and local test-data connectors.
- Adds field mapping, response preview, live catalogue and batched indexes.
- Adds Core/Pro extension boundaries, privacy text and uninstall controls.
- Removes all WooCommerce product-writing, order, licence and private-update code from Core.