Title: Inclusive Forge – Accessibility Statement for WooCommerce
Author: avakodeforge
Published: October 16, 2026
Last modified: October 16, 2026
---
Search plugins
# Inclusive Forge – Accessibility Statement for WooCommerce
By [avakodeforge](https://profiles.wordpress.org/avakodeforge/)
[Download](https://downloads.wordpress.org/plugin/inclusiveforge.1.3.2.zip)
* [Details](https://wordpress.org/plugins/inclusiveforge/#description)
* [Reviews](https://wordpress.org/plugins/inclusiveforge/#reviews)
* [Installation](https://wordpress.org/plugins/inclusiveforge/#installation)
* [Development](https://wordpress.org/plugins/inclusiveforge/#developers)
[Support](https://wordpress.org/support/plugin/inclusiveforge/)
## Description
**Inclusive Forge** audits European online stores against WCAG 2.1 AA and EN 301
549, records what was found and what was fixed, and publishes an accessibility statement
from that record. The audit, the evidence log and the statement live in your Inclusive
Forge account. This plugin is the small piece that has to run on your site. It works
on any WordPress site and is built for WooCommerce stores. This is all it does:
1. **Proves you own the site.** It adds `` to your ``. Our scanner reads that tag before it audits anything,
so a site is never scanned on the word of whoever filled in a form.
2. **Publishes your accessibility statement.** The `[inclusiveforge_statement]` shortcode
and the matching block render the statement you published in Inclusive Forge. The
document is fetched over HTTPS and cached locally for 12 hours: only the page view
that refreshes the cache waits for the request, and the request times out after
five seconds.
3. **Shows your last scan, right in wp-admin.** A “Last scan” card on the settings
screen and a dashboard widget show the score, open and closed findings, and the
date — filled in automatically when a scan finishes.
4. **Lets you ask for a re-test.** A “Re-test now” button on the settings screen asks
Inclusive Forge to scan the site again; the monthly allowance of your account is
enforced by Inclusive Forge, and the button tells you how many re-tests you have
left.
5. **Checks that verification is actually working.** The settings screen fetches your
own home page (the answer is kept for five minutes) and confirms the verification
tag is really there — not just emitted — and flags known cache/optimisation plugins
that sometimes strip it.
6. **Gives you one settings screen.** Site token, webhook secret, statement language,
verification status, and a button to refresh the cached statement.
#### What this plugin deliberately does not do
* **No overlay.** It never modifies, re-labels or “corrects” your pages in the
browser. Accessibility overlays are widely rejected by disabled users and by
regulators; real fixes belong in your theme and templates, and Inclusive Forge
reports them there.
* **No JavaScript and no CSS on your storefront.** Not one script, not one stylesheet,
not one inline style. The statement is plain server-rendered HTML that inherits
your theme. The only JavaScript in this plugin runs in the block editor, so the
block can appear in the inserter.
* **No scanning from inside your site.** Nothing crawls your pages from your own
server, and there is no background job competing with your store for resources.
* **No tracking and no analytics.**
#### Honest scope
An automated scan detects a portion of WCAG 2.1 AA issues, not all of them, and
no plugin can make a website accessible on its own. Inclusive Forge sells a documented
process — scan, fix, re-test, evidence log, statement — not a compliance guarantee.
This plugin and the Inclusive Forge service do not provide legal advice; talk to
a qualified adviser about your obligations.
### External services
This plugin connects to one third-party service. It is not optional: without it
there is no statement to render and no store to connect.
* **Inclusive Forge** (https://inclusiveforge.com, run by Avakode) — hosts your
accessibility statement, verifies site ownership, and runs the scans this plugin
reports on. The plugin talks to its API at https://app.inclusiveforge.com: `GET/
public/statement/{site token}?locale=…` for the statement and `POST /public/rescan/{
site token}` for a re-test.
- **What is sent:** your Inclusive Forge site token (in the request path) and
your site address (in the `User-Agent` header of the request). When you press“
Re-test now”, a signed, empty request authenticated with your webhook secret
asking the scan to be run again. Nothing else — no post content, no order
data, no customer data, no visitor IP addresses, no administrator details.
- **When it is sent:** only once a site token is saved; with none, the plugin
sends nothing. Then: when a page containing the shortcode or block is rendered,
or the plugin’s settings screen is opened, and the cached statement is missing
or older than 12 hours; when a failed request is retried (at most once every
15 minutes); when you press “Refresh statement cache”; and when you press “
Re-test now”. Pages without the shortcode or block send nothing.
- **What comes back:** the HTML of your published accessibility statement, or
an error saying the site is unknown or not verified yet; a re-test request
answers with an accepted scan or a named reason it was refused, including
your remaining monthly allowance.
- **What this address sends back to your site, unprompted:** when a scan it
ran finishes, it calls your site’s own REST API (`/wp-json/inclusiveforge/
v1/scan-completed`) with the score, the open/closed finding counts, the date,
and a link back to the full report. This plugin verifies a cryptographic signature
on that request, using the same webhook secret, before storing anything from
it — an unsigned or incorrectly signed request is rejected and changes nothing
on your site.
- **The link visitors may see:** when your site token is fine but the plugin
could not fetch the statement (a timeout, for example), visitors see a plain
link, “View our accessibility statement”, to `https://inclusiveforge.com/<
language>/a11y/`, the same statement on Inclusive Forge’s own
site. The plugin sends nothing there; a visitor’s browser contacts inclusiveforge.
com only if the visitor follows the link.
- The endpoint address can be overridden for staging by defining `INCLUSIVEFORGE_API_BASE`
in `wp-config.php`.
- Terms: https://inclusiveforge.com/terms — Privacy: https://inclusiveforge.
com/privacy
Your site token is also published in the verification meta tag in your site’s `<
head>`, which is what makes ownership checkable from outside. It identifies the
site to Inclusive Forge; it does not grant access to your Inclusive Forge account.
The webhook secret is a separate value, used only to authenticate the scan-completed
notice and the re-test request in both directions; it is never displayed anywhere
on your storefront.
The plugin’s own “verification health” check on the settings screen fetches your
site’s own home page — a request to your own site, not to a third party — to confirm
the verification tag actually reaches visitors. The answer is kept for five minutes,
so reopening the screen does not fetch again.
## Screenshots
[⌊Settings → Inclusive Forge: the site is connected, the verification checks are
green, and the Last scan card shows the score and findings.⌉⌊Settings → Inclusive
Forge: the site is connected, the verification checks are green, and the Last scan
card shows the score and findings.⌉[
Settings Inclusive Forge: the site is connected, the verification checks are green,
and the Last scan card shows the score and findings.
[⌊The dashboard widget shows the last scan: score, open findings, closed findings
by outcome and the date.⌉⌊The dashboard widget shows the last scan: score, open
findings, closed findings by outcome and the date.⌉[
The dashboard widget shows the last scan: score, open findings, closed findings
by outcome and the date.
[⌊The published accessibility statement on the storefront, rendered by the shortcode
or block and inheriting the theme.⌉⌊The published accessibility statement on the
storefront, rendered by the shortcode or block and inheriting the theme.⌉[
The published accessibility statement on the storefront, rendered by the shortcode
or block and inheriting the theme.
[⌊The Accessibility Statement block in the block editor, with its language setting
in the sidebar.⌉⌊The Accessibility Statement block in the block editor, with its
language setting in the sidebar.⌉[
The Accessibility Statement block in the block editor, with its language setting
in the sidebar.
[⌊After pressing Re-test now: the request is accepted and the screen shows how many
re-tests are left this month.⌉⌊After pressing Re-test now: the request is accepted
and the screen shows how many re-tests are left this month.⌉[
After pressing Re-test now: the request is accepted and the screen shows how many
re-tests are left this month.
## Blocks
This plugin provides 1 block.
* Accessibility Statement Renders the accessibility statement published for this
site by Inclusive Forge.
## Installation
1. Upload `inclusiveforge` to `/wp-content/plugins/`, or install it from Plugins
Add New.
2. Activate the plugin.
3. Go to **Settings Inclusive Forge**. Paste the site token and the webhook secret
from your Inclusive Forge dashboard (Accessibility statement, then Connect the
companion plugin).
4. Start the verification check from your Inclusive Forge dashboard. The status on
the settings screen turns green when it passes.
5. Add `[inclusiveforge_statement]` to your accessibility statement page, or insert
the **Accessibility Statement** block.
## FAQ
### Do I need an Inclusive Forge account?
Yes. The plugin is a companion to the Inclusive Forge service: it verifies your
site and displays a statement produced there. On its own it has nothing to show.
### Can I connect a local or staging site?
No. Inclusive Forge audits public storefronts, and a local or staging address is
not reachable from the internet. Connect the plugin on the live store.
### Does this plugin make my site accessible?
No, and be wary of any plugin that says it does. Accessibility is fixed in your
theme, templates and content. Inclusive Forge finds issues, tracks them until they
are fixed, and documents the process; the fixes are real changes to your site.
### Is this an accessibility overlay?
No. Nothing from this plugin runs in your visitors’ browsers. It adds one meta tag
and, on the page where you place it, the HTML of your statement.
### Will it slow down my store?
No. The statement is cached for 12 hours in a WordPress transient, and a failed
request is cached for 15 minutes, so only the page view that refreshes the cache
waits on our API, and that request times out after five seconds. Pages without the
shortcode or block make no request at all.
### What happens if your API is unreachable?
It depends on why. If your site token and language are fine but our servers just
did not answer (a timeout, for example), visitors see a plain link to your statement
on our own domain instead — their browser can often reach it even when ours could
not reach yours. If the problem is a configuration one instead (no token, site not
verified, an unrecognised token or language), visitors see nothing at all — no error,
no empty box, no PHP warning — and if you are logged in as an administrator, you
see a short note explaining what is wrong.
### Where does the statement HTML come from?
From the statement you published in Inclusive Forge, for the language you selected.
It is filtered through `wp_kses_post()` when it arrives and again before it is printed,
so it cannot introduce scripts into your site.
### Can I show the statement in another language?
Yes. Set the default language on the settings screen, or override it per placement:`[
inclusiveforge_statement locale="de"]`. English, German and French are available.
### What is deleted when I remove the plugin?
All of its options (including the webhook secret and the last-scan summary) and
its cached statements. Your Inclusive Forge account, scans and evidence log are
untouched — delete those from your dashboard.
### What does “Re-test now” actually do?
It asks Inclusive Forge to scan this site again immediately, instead of waiting
for the monthly schedule. This plugin does not decide whether you are allowed one:
Inclusive Forge checks the monthly allowance of your account and either starts the
scan or refuses with a named reason (for example, the monthly limit is used up,
or a scan is already running), and either way this plugin only displays that answer.
### Can other plugins react when a scan finishes?
Yes. This plugin fires an `inclusiveforge/scan_completed` action (with the score,
the finding counts — open, and closed split into marked fixed / accepted risk /
false positives — the finish date and the report URL as arguments) every time a
signed scan-completed notice is verified and stored. Automation plugins can hook
it directly.
### How does the plugin know if verification is really working?
The settings screen fetches your own home page, asking caches for a fresh copy (
no-cache headers and a changing query argument), and looks for the verification
tag in the response — the same tag Inclusive Forge’s own scanner looks for. The
answer is kept for five minutes. If it is missing even though a site token is configured,
the screen also lists any installed cache or optimisation plugin known to sometimes
strip or rewrite the `` section, as a plain hint about where to look.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Inclusive Forge – Accessibility Statement for WooCommerce” is open source software.
The following people have contributed to this plugin.
Contributors
* [ avakodeforge ](https://profiles.wordpress.org/avakodeforge/)
[Translate “Inclusive Forge – Accessibility Statement for WooCommerce” into your language.](https://translate.wordpress.org/projects/wp-plugins/inclusiveforge)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/inclusiveforge/), check
out the [SVN repository](https://plugins.svn.wordpress.org/inclusiveforge/), or
subscribe to the [development log](https://plugins.trac.wordpress.org/log/inclusiveforge/)
by [RSS](https://plugins.trac.wordpress.org/log/inclusiveforge/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.3.2
* Removed: the optional key field on the settings screen and the account-status
lines that came with it (added in 1.3.0). Stores that were connected with it
stay connected: the site token and webhook secret were saved on their own. Connect
a new store by pasting the site token and webhook secret from the Inclusive Forge
dashboard.
* Change: the statement HTML is filtered when it arrives, before it is cached,
as well as when it is printed.
* Change: the “cache cleared” and “re-test” notices on the settings screen no longer
depend on a flag in the address.
* Change: removing the plugin deletes exactly the options and cached entries it
created, by name, and no longer flushes the site’s object cache.
* Change: the readme says the plugin works on any WordPress site and is built for
WooCommerce stores, describes the statement cache and the home-page check as
the code does, and lists the link visitors may see in “External services”.
* Internal: removed a helper class nothing called.
#### 1.3.1
* Fix: the Accessibility Statement block now appears in the block editor’s inserter.
Its editor script used to register the block under an old product name, so the
block could not be added from the editor. The `[inclusiveforge_statement]` shortcode
was not affected.
* Change: the “External services” section says exactly when the plugin contacts
Inclusive Forge and no longer names a service the plugin itself never contacts.
* Change: the translation template now includes the block editor’s strings.
* Change: the readme no longer says a visitor never waits for the statement. The
page view that refreshes the 12-hour cache does.
* Internal notes removed from the code comments. No change in behaviour.
#### 1.3.0
* New: an optional key field on the settings screen that connected the store for
you and filled in the site token and webhook secret (removed in 1.3.2).
* Fix: a verified site with no published statement yet no longer reads as “Could
not reach Inclusive Forge” on the settings screen; it says the statement is still
to be published.
#### 1.2.1
* Change: the “Last scan” card and the dashboard widget no longer show one “Closed
findings” number. Closed findings are three different facts about a store — marked
fixed, accepted risk, false positives — and a single total read as “all of this
is fixed”. The `inclusiveforge/scan_completed` counts array carries the same
three keys; `closed` stays as their sum.
* Fix: the webhook secret now has somewhere to come from. Open “Accessibility statement”
in your Inclusive Forge dashboard and click “Connect the companion plugin” to
generate it, then copy it (and the site token next to it) into the field below—
1.2.0 shipped the field with no way to get a value for it.
* Fix: `inclusiveforge/scan_completed` no longer fires a second time for the same
scan when the portal has to retry a delivery that timed out or was lost.
* Fix: the verification health check no longer re-fetches your home page on every
visit to the settings screen (the answer is now cached for a few minutes) and
no longer follows a redirect while checking it, so a redirecting home page cannot
report a stale “visible” result.
#### 1.2.0
* New: signed “scan completed” notice from Inclusive Forge — drops the statement
cache and stores a “last scan” summary (score, open/closed findings, date) the
moment a scan finishes.
* New: “Last scan” card on the settings screen and a matching wp-admin dashboard
widget, both reading that same summary.
* New: “Re-test now” button on the settings screen. Inclusive Forge alone decides
whether the monthly allowance of your account permits it; this plugin only shows
the answer, including how many re-tests are left this month.
* New: verification health check on the settings screen — fetches your own home
page to confirm the verification tag is actually there, and flags known cache/
optimisation plugins that can strip it.
* New: `inclusiveforge/scan_completed` action for other plugins to hook.
* New: a “Webhook secret” field, alongside the site token, authenticating the scan-
completed notice and the re-test request in both directions.
#### 1.1.0
* New: if the plugin’s own fetch to Inclusive Forge fails but your site token is
fine, visitors now see a plain link to the hosted statement on inclusiveforge.
com instead of nothing at all.
* Fix: an unrecognised configured language or a blocked API address now show the
administrator-only setup note instead of a link that would 404 for visitors.
#### 1.0.0
* Initial release: verification meta tag, `[inclusiveforge_statement]` shortcode,
Accessibility Statement block, and the settings screen.
## Meta
* Version **1.3.2**
* Last updated **10 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.5 or higher **
* Tested up to **7.1.3**
* PHP version ** 7.4 or higher **
* Tags
* [accessibility](https://wordpress.org/plugins/tags/accessibility/)[Accessibility statement](https://wordpress.org/plugins/tags/accessibility-statement/)
[european accessibility act](https://wordpress.org/plugins/tags/european-accessibility-act/)
[wcag](https://wordpress.org/plugins/tags/wcag/)[woocommerce](https://wordpress.org/plugins/tags/woocommerce/)
* [Advanced View](https://wordpress.org/plugins/inclusiveforge/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/inclusiveforge/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/inclusiveforge/reviews/)
## Contributors
* [ avakodeforge ](https://profiles.wordpress.org/avakodeforge/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/inclusiveforge/)