CODZap – COD Confirmation & Abandoned Cart Recovery for WooCommerce

Changelog

1.7.1

• Every database query now goes through $wpdb->prepare(), including table
  names (as %i identifier placeholders) and lists of values inside IN (...)
  clauses. Nothing is pasted into SQL by hand any more.
• Requires WordPress 6.2 or newer, which is where %i placeholders arrived.

1.7.0

• Every name the plugin declares or stores now starts with codzap:
  functions, classes, constants, options, database tables, order meta,
  transients, scheduled actions, hooks, admin pages, REST namespace, script
  handles and CSS classes. The old swa prefix was too short to be unique.
• Updating from an earlier version moves existing data across automatically,
  once, on the first page load: settings, WhatsApp opt-outs, the message log,
  saved carts, order confirmation history and messages already queued.
• The webhook URL is now /wp-json/codzap/v1/webhook. On sites updated from
  an earlier version the old URL keeps working until Meta is pointed at the
  new one, and a notice on CODZap’s screens says so.
• Buttons, recovery links and review links in messages sent before the update
  still work, as do WhatsApp templates Meta approved before it.
• Developer hooks were renamed to match, e.g. swa_should_notify_status is
  now codzap_should_notify_status. Order meta keys now start _codzap_.
• The “WooCommerce is required” notice now shows only on the Plugins screen,
  and a duplicated App Secret warning was merged into one.

1.6.1

• The admin screens’ styles and the one script they use now load as proper
  files, enqueued only on CODZap’s own screens, rather than being printed
  into the page.
• The External services section of this readme now lists every data flow to
  and from Meta, including forwarded customer messages, review requests,
  owner alerts, read notices and delivery receipts.
• Declared as tested with WooCommerce 11.1.

1.6.0

• New: delivery and read ticks in the Inbox. A single grey tick when WhatsApp
  has the message, two grey when it reaches the phone, two blue when it is
  read — with the time on hover. Receipts arrive out of order, so a message
  only ever moves forward and a late “delivered” can never undo a “read”.
• New: a message that fails after WhatsApp accepted it — Meta’s marketing
  limit, for instance — is now marked failed on the message itself, with
  Meta’s reason and error code underneath.
• Fixed: a failed-delivery notice from Meta was counted as something the
  customer had written, so it started conversations of its own in the Inbox
  and showed the customer-wrote-last dot.
• New: Follow Up Reports. Every cart the plugin has recorded, searchable by
  name, email or number and filterable by status and date, with a detail view,
  single and bulk delete, and a CSV export of whatever the filters match. The
  dashboard’s View All now opens it, instead of the message log, and carries
  the dashboard’s date range with it.
• Security: the CSV export neutralises cells that a spreadsheet would run as a
  formula. Names and emails are typed by shoppers, so an export must never
  execute one when it is opened.
• Security: admin notices are no longer carried in the URL. Before, a link
  crafted by anyone could put their own words inside a genuine notice on the
  settings screen; they are now kept on the server, per user, and shown once.
  This also clears the one warning from the official Plugin Check.
• The message log gains columns for WhatsApp message ids and receipts. The
  table upgrades itself the first time an admin page loads after updating.
  Messages sent before the update keep a single tick, as their ids were never
  kept.

1.5.0

• New: review requests. A few days after an order reaches the status you treat
  as delivered, the customer is asked for a review. The button opens the
  product they bought, at its reviews section — or one fixed link for
  everybody, such as a Google listing, if you prefer. Off until you switch it
  on, and skipped if the order has been refunded or moved on in the meantime.
• The per-order link is signed, so it cannot be edited into a link for somebody
  else’s order.
• New: customer messages now reach your own phone even when your 24-hour window
  is shut, through a new approved template built to carry their words. Until
  now those messages could only arrive by email, because the owner alert
  template has fixed order-shaped slots with nowhere to put free text.
• Both templates are created for you on the Templates screen, and both appear
  on the Preview screen so the wording can be checked before anything is sent.
• Fixed: the Preview screen failed to load on any shop that had issued a
  refund, because a refund was being offered in the order picker as if it were
  an order.
• Fixed: “Delete & recreate” on the Templates screen deleted a template at Meta
  without asking first; its confirmation dialog never appeared.
• The review button address is always https, which Meta requires, even where
  the site address in Settings is stored as http.

1.4.1

• Fixed: the Inbox conversation had no scrollbar, so anything past the first
  screenful – including the newest messages – could not be read. The panes were
  growing to fit their contents and being clipped by the card around them
  instead of scrolling inside it. The conversation list had the same fault.
• The thread now opens on the newest message reliably, including when the tab
  is loaded in the background, and stops trying the moment you scroll yourself.

1.4.0

• New: backup and restore, at the foot of the Settings screen. Download the
  whole configuration as a readable JSON file, and put it back in one step.
• A Meta access token is shown to you once and never again, so the backup can
  include your credentials — with a plain warning that the file is then as
  sensitive as the token itself. Untick the box and you get everything except
  the two secrets, which is safe to keep anywhere.
• Restoring only writes settings this plugin defines, and a value the file
  leaves out keeps whatever the site already has. A backup taken without
  credentials can never blank the ones you are running on.

1.3.1

• Fixed: the order links in the Message Log went nowhere on stores using
  WooCommerce’s High Performance Order Storage, where an order is no longer a
  post. Both the log and the Inbox now ask WooCommerce for the address of an
  order rather than assembling it themselves.
• A log row for an order that has since been deleted shows the number without
  a link, instead of a link that leads to an error page.

1.3.0

• New: an Inbox screen. Everything sent and received, grouped by number and
  laid out as conversations rather than as log rows.
• Approved templates are shown as the customer read them: the wording you had
  approved, with that order’s details filled in, and the buttons underneath.
• Messages that failed or were held back are marked in the thread with the
  reason, so a broken number stops being invisible.
• Search across numbers and message text, a link straight to the order each
  message was about, and a button that opens the same chat on your own phone
  to reply.
• Reading only. Nothing can be sent from this screen.

1.2.0

• New: a deadline for orders the customer never answers. Set the hours you are
  willing to wait, and choose whether the order is then cancelled and restocked
  or put on hold for you to look at. Off until you switch it on.
• The clock runs from the last confirmation request sent, so a reminder that
  falls back to the template gives the customer the full wait again.
• An order that has been answered, or that you have already dealt with by hand,
  is never touched by the deadline.
• Orders closed this way count towards the return-to-origin savings on the
  dashboard, and alert you on WhatsApp like any other decision.

1.1.1

First public release.

• Asks every Cash on Delivery customer to confirm their order on WhatsApp,
  with Yes and No buttons.
• Cancels and restocks the orders they refuse, before anything is packed.
• Sends an order update on every WooCommerce status change.
• Recovers abandoned baskets with a link that restores the basket, sent only
  to shoppers who agreed to it at checkout.
• Alerts you on new COD orders and on every customer decision.
• Passes on anything a customer writes that is not a Yes or a No, by WhatsApp
  when your service window is open and by email otherwise.
• Honours STOP and START, so a customer can unsubscribe themselves.
• Creates your Meta message templates for you, keeping the template variables
  and what the plugin sends in step.
• Previews every message against a real order before you send anything.
• Connection check that tells you which part of a Cloud API setup is wrong,
  rather than leaving you to guess why nothing happened.
• Full message log with Meta’s error codes explained in plain English.
• Dashboard reporting on returns avoided and baskets recovered.
• Works with High Performance Order Storage and the block checkout.
• Supports WordPress’s Export and Erase Personal Data tools.
• Fully translatable, with a template in /languages.