Description
Vixns Commerce Profile for Universal Commerce Protocol writes an honest business profile JSON to a static file at /.well-known/ucp, can expose UCP catalog REST (search / lookup / product), and can publish keys[] (JWK Set) with rotation for Web Bot Auth type=jwks_uri interop.
This is a third-party WooCommerce integration by Vixns. It is not an official Universal Commerce Protocol product.
- Spec target: 2026-08-25
- Never advertises checkout, cart, or payment handlers
- Private keys stored under
uploads/vixns-commerce-profile-ucp/private/(Apache/IIS deny files are written automatically; block the path on nginx) - Optional product feed (JSONL), not linked from the profile
- Catalog REST is intentionally open to agents that send a valid
UCP-Agentheader (same visibility as a public product catalog)
Installation
- Install and activate WooCommerce.
- Upload the
vixns-commerce-profile-ucpfolder to/wp-content/plugins/(or install the ZIP via Plugins Add New). - Activate Vixns Commerce Profile for Universal Commerce Protocol.
- Configure your web server to serve
/.well-known/ucpas static JSON withCache-Control: public, max-age≥60and no redirects. - Open WooCommerce Settings Vixns UCP, set the canonical HTTPS host if needed, then Generate now.
Example nginx location (adjust root):
location = /.well-known/ucp {
default_type application/json;
add_header Cache-Control "public, max-age=300" always;
add_header Access-Control-Allow-Origin "*" always;
add_header Access-Control-Allow-Methods "GET, HEAD" always;
try_files /.well-known/ucp =404;
}
# Deny private key material (nginx ignores .htaccess):
location ^~ /wp-content/uploads/vixns-commerce-profile-ucp/private/ {
deny all;
return 403;
}
FAQ
-
How do I serve /.well-known/ucp?
-
See the nginx example under Installation. Do not apply wwwapex redirects to this URI — UCP platforms do not follow 3xx on the profile URL.
-
Web Bot Auth
-
Use:
Signature-Agent: sig1="https://yoursite/.well-known/ucp";type=jwks_uriOmitting
typedefaults todirectory, which does not read this static profile. -
Catalog REST
-
Base:
/wp-json/ucp/v1— POST/catalog/search,/catalog/lookup,/catalog/product.
Requires header:UCP-Agent: profile="https://yoursite/.well-known/ucp".
There is no WordPress cookie auth on these routes (agent discovery). Disable Catalog REST in settings if you do not want them. -
Where are private keys stored?
-
Default:
wp-content/uploads/vixns-commerce-profile-ucp/private/. Prefer a path outside the document root via thevixns_ucp_private_key_dirfilter. On nginx, always deny the default directory explicitly. -
Is this an official Universal Commerce Protocol plugin?
-
No. It is developed by Vixns as a third-party WooCommerce integration.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Vixns Commerce Profile for Universal Commerce Protocol” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Vixns Commerce Profile for Universal Commerce Protocol” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
0.4.0
- Renamed for WordPress.org trademark clarity (slug vixns-commerce-profile-ucp).
- Private keys and feed default under uploads/{slug}/; tightened write allowlist to .well-known + uploads plugin dir.
0.3.0
- Signing keys[] (EdDSA/ES256), rotate/revoke, WBA jwks_uri documentation.
- Path allowlist for profile/feed writes; HTTPS-only canonical host / probe.
- Test-only failure filters gated behind VIXNS_UCP_TESTING.
0.2.0
- Catalog REST: search, lookup, product; profile advertises services + catalog capabilities.
0.1.0
- Initial release: profile generation, dual scheduler, WP-CLI, admin status/probe, optional JSONL feed.