Title: Proteside for WooCommerce
Author: Proteside
Published: <strong>October 28, 2026</strong>
Last modified: October 28, 2026

---

Search plugins

![](https://ps.w.org/proteside-for-woocommerce/assets/banner-772x250.png?rev=3770947)

![](https://ps.w.org/proteside-for-woocommerce/assets/icon-256x256.png?rev=3770947)

# Proteside for WooCommerce

 By [Proteside](https://profiles.wordpress.org/proteside/)

[Download](https://downloads.wordpress.org/plugin/proteside-for-woocommerce.1.1.2.zip)

 * [Details](https://wordpress.org/plugins/proteside-for-woocommerce/#description)
 * [Reviews](https://wordpress.org/plugins/proteside-for-woocommerce/#reviews)
 *  [Installation](https://wordpress.org/plugins/proteside-for-woocommerce/#installation)
 * [Development](https://wordpress.org/plugins/proteside-for-woocommerce/#developers)

 [Support](https://wordpress.org/support/plugin/proteside-for-woocommerce/)

## Description

Proteside for WooCommerce connects your store to your existing [Proteside](https://proteside.com)
account and loads the Proteside protection on the pages you select: checkout, order
payment page, order confirmation and, optionally, cart, shop, my account, login 
or custom URLs.

Proteside is a client-side security service that monitors your checkout in the shopper’s
browser for e-skimming / Magecart attacks, payment tampering (Pix, card, crypto),
malicious script injection, form hijacking and overlay fraud. It is designed to 
support the payment page script controls in PCI DSS 4.0 requirements 6.4.3 and 11.6.1.

This plugin does not by itself make your store PCI DSS compliant: compliance covers
your whole environment and is assessed by your acquirer or QSA.

**What this plugin does**

 * Adds a settings screen under WooCommerce where you paste your public SDK key (`
   pk_live_…`).
 * Validates the key against Proteside server-side and shows the connection status:
   Active, Grace period, Suspended, Inactive, Invalid key or Connection error.
 * Prints the Proteside bootstrapper (bundled, version 1.1.3) **inline and first**
   in the page head, then loads `shield.js` asynchronously from the Proteside CDN—
   exactly the two tags the dashboard gives you, in the right order.
 * Optionally embeds your active blocking rules and allowed Google Tag Manager containers
   in the page (inline config) so blocking starts from the first byte, before the
   SDK fetches its remote configuration.
 * Follows the release channel chosen in your dashboard (stable/latest), with a 
   manual override.
 * Detects pages with WooCommerce conditional tags, so it works with translated 
   or custom slugs and with the classic or block-based checkout.
 * Stops loading the protection when your subscription is no longer active; keeps
   the last known status for up to 48 hours if Proteside cannot be reached.
 * Re-checks status and rules periodically (WP-Cron, every 6/12/24 h) and on demand,
   caching everything locally: there is never a network call on a normal page load.
 * Advanced “strict first position” mode that buffers the page and inserts the tags
   right after `<head>` when a theme or plugin prints scripts before `wp_head`.

**You need a Proteside account.** The SDK key comes from your Proteside dashboard(
Settings  Pages and Domains). Don’t have one yet? Visit [proteside.com](https://proteside.com).

### External services

This plugin connects your site to the Proteside service (https://proteside.com).
The connection is required for the plugin to function.

 1. **Entitlement check (server-side).** When you save your SDK key, on each scheduled
    re-check (every 6/12/24 hours) and when you click “Check status”, your server calls`
    https://app.proteside.com/api/sdk/status`. It sends your SDK key, your site URL,
    the platform name (`woocommerce`) and the plugin version. No personal or visitor
    data is sent. The answer tells the plugin whether your subscription is active.
 2. **Remote configuration (server-side).** In the same cycle, when the subscription
    is active, your server calls `https://app.proteside.com/api/sdk/config` with your
    SDK key to fetch the active blocking rules, the allowed Google Tag Manager containers
    and the release channel configured in your dashboard. The result is cached locally
    and, if “Embed blocking rules in the page” is enabled, embedded in the page as `
    window.__PROTE_INLINE__`.
 3. **Protection script (front-end).** On the pages you select, the plugin prints the
    bundled inline bootstrapper and loads `https://cdn.proteside.com/v1/shield.js` (
    or `/v1/latest/shield.js` on the latest channel) into your visitors’ browsers.
 4. **Calls made by the Proteside SDK in the visitor’s browser**, on the selected pages
    only:
 5.  * `GET https://app.proteside.com/api/sdk/config` with your public SDK key, to 
       load the protection settings of your store.
     * `POST https://app.proteside.com/api/sdk/events` with security events about the
       page (for example the type of event, the address of a script, the page URL, 
       severity and timing). Card numbers, CVV, passwords and payment keys are removed
       before sending.
     * `POST https://app.proteside.com/api/sdk/pix-location`, only when a dynamic Pix
       charge is shown on the page: the charge URL contained in the Pix code, your 
       SDK key and the page path, once per charge, so Proteside can check the recipient
       against the record signed by the payment provider.
     * To detect modified scripts, the SDK downloads the external scripts the page 
       already loads (from their own addresses, without cookies) and computes their
       hashes. Nothing is sent to those addresses besides the normal request.

See the Proteside documentation (https://docs.proteside.com) for the details of 
what the SDK collects.

By using this plugin you agree to the Proteside Terms of Use (https://proteside.
com/termos) and Privacy Policy (https://proteside.com/privacidade). As the store
owner, you are responsible for informing your visitors as required by GDPR / LGPD.

## Screenshots

[⌊The Proteside settings screen with connection status, page targeting, options 
and diagnostics.⌉⌊The Proteside settings screen with connection status, page targeting,
options and diagnostics.⌉[

The Proteside settings screen with connection status, page targeting, options and
diagnostics.

## Installation

 1. Install and activate WooCommerce.
 2. Install and activate Proteside for WooCommerce.
 3. Go to WooCommerce  Proteside.
 4. Paste your SDK key (Proteside dashboard  Settings  Pages and Domains) and save.
 5. Keep the default pages (checkout, order payment page, order confirmation) or add
    more. Done.
 6. Open your checkout and run `Proteside.getStatus()` in the browser console: `installationOrderValid`
    must be `true`.

## FAQ

### Do I need a paid Proteside account?

Yes. The plugin activates an existing Proteside subscription. You can create one
at proteside.com.

### Is my SDK key a secret?

No. The `pk_` key is public by design — it already appears in your store’s HTML.
Keep your account credentials safe; the SDK key itself is not sensitive.

### Does it work with the block-based checkout?

Yes. Page detection uses WooCommerce conditional tags plus block detection, so both
classic and block cart/checkout are supported.

### Where is the trust badge?

The Proteside SDK no longer renders a badge. The badge is a static HTML snippet 
you copy from your dashboard (Settings  Store) and paste wherever you want it in
your theme; the plugin does not add it for you.

### What is “Embed blocking rules in the page”?

The plugin copies your active rules and allowed GTM containers from the dashboard
into the inline bootstrapper (same `<script>` tag). Blocking then starts before 
the SDK downloads its remote configuration. It is refreshed on every status check
and is on by default.

### What does “installation order” mean?

The bootstrapper must be the first script in `<head>`. If another script runs before
it, the SDK reports `INSTALLATION_ORDER_WARNING` and `Proteside.getStatus().installationOrderValid`
is `false` (protection continues, with partial coverage). The default `wp_head` 
priority 1 is enough for most themes; if a theme or plugin prints scripts earlier,
enable Advanced  “Strict first position (output buffering)”.

### What happens if my subscription lapses?

The plugin detects the change on its next status check and stops loading the script.
During the billing grace period the script keeps loading and you’ll see a reminder
in the admin.

### What if Proteside is unreachable?

Only a definitive answer (HTTP 200 or 401) changes the decision. On timeouts or 
server errors the plugin keeps the last known status for up to 48 hours, then fails
closed.

### Does it slow down my store?

No network call happens on normal page loads — everything is cached locally and 
refreshed by WP-Cron. `shield.js` is loaded asynchronously; the inline bootstrapper
is about 4 KB.

### My site has a Content-Security-Policy. What do I allow?

script-src: the inline bootstrapper (hash shown in Diagnostics, or a nonce/’unsafe-
inline’) plus `https://cdn.proteside.com`; `connect-src`: `https://app.proteside.
com` and `https://cdn.proteside.com`. Use the hash from Diagnostics: it is computed
from the exact tag WordPress prints on your site and changes when your inline rules
change.

## Reviews

There are no reviews for this plugin.

## Contributors & Developers

“Proteside for WooCommerce” is open source software. The following people have contributed
to this plugin.

Contributors

 *   [ Proteside ](https://profiles.wordpress.org/proteside/)

[Translate “Proteside for WooCommerce” into your language.](https://translate.wordpress.org/projects/wp-plugins/proteside-for-woocommerce)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/proteside-for-woocommerce/),
check out the [SVN repository](https://plugins.svn.wordpress.org/proteside-for-woocommerce/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/proteside-for-woocommerce/)
by [RSS](https://plugins.trac.wordpress.org/log/proteside-for-woocommerce/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.1.2

 * Changed: bundled bootstrapper updated to 1.1.3. On Pix pages in block mode, Proteside
   can now put the legitimate Pix code back before a malicious clipboard write happens.
 * Fixed: an SDK key with a trailing line break is no longer accepted.
 * Changed: translation files are no longer bundled; translations come from translate.
   wordpress.org.
 * Changed: admin notices are shown only on the Proteside settings screen.
 * Changed: the External services section lists every call the Proteside SDK makes
   from the browser.

#### 1.1.1

 * Changed: the inline bootstrapper and shield.js tags are now printed with the 
   WordPress script tag API (`wp_print_inline_script_tag()` / `wp_get_script_tag()`),
   so the `wp_inline_script_attributes` and `wp_script_attributes` filters apply(
   e.g. CSP nonces).
 * Changed: the CSP hash in Diagnostics is computed from the exact tag WordPress
   prints.
 * Security: the CDN address returned by the Proteside API is only accepted on `
   https://` Proteside domains.
 * Changed: requires WordPress 6.7+, which loads translations by itself (no `load_plugin_textdomain()`).
 * Fixed: the plugin name is no longer translated (it stays “Proteside for WooCommerce”
   in every language).
 * Tested with WordPress 7.1 and WooCommerce 11.2.

#### 1.1.0

 * Bundled bootstrapper updated to 1.1.2 (pre-insertion script blocking, inline 
   config support), with its TypeScript sources.
 * New: inline config — active blocking rules and allowed GTM containers from `GET/
   api/sdk/config` are embedded as `window.__PROTE_INLINE__` in the same tag as 
   the bootstrapper (default on).
 * New: release channel setting — follow the dashboard (default), stable or latest.
 * New: “Order payment page” target (`order-pay`). Defaults are now checkout + order
   payment page + order confirmation; cart is off by default.
 * New: advanced “Strict first position (output buffering)” mode that inserts the
   tags right after `<head>`.
 * New: `inactive` status, domain-mismatch advisory notice, connection-error notice.
 * Changed: the 48-hour tolerance for API outages is now applied properly (fail-
   closed when never validated or after 48 h).
 * Changed: diagnostics show bundled bootstrapper version, inline rules/GTM count,
   channel in use, injection mode, CSP hash and a verification hint.
 * Changed: admin wording aligned with the Proteside glossary; pt_BR, es_ES and 
   en_US translations completed.
 * Removed: the trust badge option and `data-safe-url` (the SDK no longer renders
   a badge; it is a static snippet from the dashboard).
 * Removed: the option to disable the inline bootstrapper (it is mandatory for the
   protection to work).
 * Uninstall now also removes the revalidation lock transient.

#### 1.0.0

 * Initial release: SDK key activation, real-time status, page targeting via WooCommerce
   conditional tags, bootstrapper + async shield.js injection, WP-Cron revalidation,
   HPOS and Cart/Checkout Blocks compatibility.

## Meta

 *  Version **1.1.2**
 *  Last updated **2 days ago**
 *  Active installations **Fewer than 10**
 *  WordPress version ** 6.7 or higher **
 *  Tested up to **7.1.4**
 *  PHP version ** 7.4 or higher **
 * Tags
 * [checkout](https://wordpress.org/plugins/tags/checkout/)[magecart](https://wordpress.org/plugins/tags/magecart/)
   [pci-dss](https://wordpress.org/plugins/tags/pci-dss/)[security](https://wordpress.org/plugins/tags/security/)
   [woocommerce](https://wordpress.org/plugins/tags/woocommerce/)
 *  [Advanced View](https://wordpress.org/plugins/proteside-for-woocommerce/advanced/)

## Ratings

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/proteside-for-woocommerce/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/proteside-for-woocommerce/reviews/)

## Contributors

 *   [ Proteside ](https://profiles.wordpress.org/proteside/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/proteside-for-woocommerce/)