Title: Well Done Suite Connector
Author: welldonesuite
Published: October 11, 2026
Last modified: October 13, 2026
---
Search plugins
# Well Done Suite Connector
By [welldonesuite](https://profiles.wordpress.org/welldonesuite/)
[Download](https://downloads.wordpress.org/plugin/well-done-suite-connector.0.6.1.zip)
* [Details](https://wordpress.org/plugins/well-done-suite-connector/#description)
* [Reviews](https://wordpress.org/plugins/well-done-suite-connector/#reviews)
* [Installation](https://wordpress.org/plugins/well-done-suite-connector/#installation)
* [Development](https://wordpress.org/plugins/well-done-suite-connector/#developers)
[Support](https://wordpress.org/support/plugin/well-done-suite-connector/)
## Description
Well Done Suite is a hosted console a business runs its day from: enquiries, quotes,
invoices, support requests, bookings and the website. This plugin connects a WordPress
site to it, so the site and its WooCommerce shop are managed in the same place as
the rest of the work.
#### What the console can do with your site
* **Pages and posts.** Read posts, pages and other public content types, create
and update them, and move them to the trash.
* **WooCommerce catalogue.** Read products and variations, create draft products—
including hidden virtual products that stand for services sold through quotes
and bookings — and update names, descriptions, prices, SKU, stock, status, categories,
tags, images and their alt text, attributes, cross-sells, upsells, bundles and
the SEO title and description.
* **Shop orders.** See WooCommerce orders next to the orders kept in the console
and move them along: change the status, add order notes and record tracking.
WooCommerce sends its usual customer emails.
* **Media.** Add images and PDF files to the media library.
* **Forms.** Place enquiry forms, bookings, reservations and quote calculators
built in the console on any page with the `[welldosu_form slug="…"]` shortcode.
* **Customer portal.** Optional and off by default. The WooCommerce My Account
page shows a customer’s shop orders next to the quotes, invoices, support requests
and bookings the business keeps in the console. Sign-in, registration and passwords
stay in WordPress.
#### What it never does
The connector answers a fixed set of REST endpoints and nothing else. It never:
* creates, reads or changes other WordPress users;
* changes WordPress settings;
* installs, activates or updates plugins or themes, or downloads and runs code;
* creates, refunds, reprices or deletes orders;
* deletes anything permanently. Content can only go to the trash, and products
and variations are never deleted.
Every change is checked against the WordPress permissions of the administrator who
approved the connection. The connector does not log in as that administrator or
anyone else. New content is attributed to them; existing content keeps its author.
#### Two screens under Settings
* **Well Done Suite** connects or disconnects the site and switches the customer
portal on or off.
* **Well Done Suite — Overview** lists every REST endpoint, the data it returns
and how it is protected.
Nothing is sent anywhere until an administrator clicks **Connect to Well Done Suite**.
### External services
This plugin connects to Well Done Suite, a hosted service operated by Well Done
Suite Ltd. The service is required: connecting the site to it is the plugin’s only
purpose.
**Pairing.** When an administrator clicks Connect, the browser opens `https://app.
welldonesuite.com/wp-connect` with the site address, a WordPress administrator return
address and a random, single-use code that expires after five minutes. The administrator
signs in to Well Done Suite and approves the connection. `https://api.welldonesuite.
com` then sends a tenant identifier and a site-specific shared secret to the site’s`
POST /wp-json/wds/v1/pair` endpoint. WordPress accepts them only when the code is
valid and unused and the administrator who started pairing still has the `manage_options`
capability.
**Signed requests.** After pairing, the service sends HTTPS requests to the connector’s
endpoints. Each carries a current timestamp and an HMAC-SHA256 signature made with
the shared secret, and every write is locked against replay. Depending on the console
screen in use, the service receives:
* The connector, WordPress, PHP and WooCommerce versions, and which features the
site supports.
* Content from public, REST-enabled post types: title, body, excerpt, status, author
ID, dates and address, including drafts and private or trashed items when a signed
request asks for them.
* The site name, tagline, address, language, time zone, date and time format and
first day of the week.
* The login, display name, roles and a fixed list of permission flags of the administrator
who approved the connection (no email address).
* With WooCommerce active, the product catalogue (names, descriptions, SKUs, prices,
stock, categories, tags, images with alt text, variations, attributes, cross-
sells, upsells, bundles, SEO titles and descriptions, and addresses) and orders.
Order data includes order and customer identifiers, status, totals, payment-method
labels, billing name, company, email address, country, city and postcode, line
items, dates, customer notes, order notes and tracking, but never payment card,
bank-account or gateway credential data.
The service can also create and update content, move content to the trash, create
draft products, update product details, upload an image or PDF to the media library,
and change an order’s status, add an order note or record its tracking. A product
image given as a web address outside the site is downloaded by WordPress into the
media library, using WordPress’s own safe download and image checks, and reused
afterwards. An optional idempotency key lets the service safely retry a successful
write for up to 24 hours.
**Disconnecting.** When the administrator clicks Disconnect, the plugin sends the
tenant identifier and a signed revocation request to `https://api.welldonesuite.
com`, then deletes the local connection credentials.
**Forms.** Only pages that contain the `[welldosu_form slug="…"]` shortcode are
affected:
* When such a page is shown, WordPress asks `https://api.welldonesuite.com/m/{tenant
identifier}/{form name}/status` whether the form is switched on. Only the tenant
identifier and the form name are sent. The answer is cached for five minutes.
* The visitor’s browser loads the form in an iframe from `https://api.welldonesuite.
com/m/{tenant identifier}/{form name}`, together with the address of the page
the form is on so the site owner can see where a submission came from. Like any
web request, this sends the visitor’s IP address and browser details to the service.
* When the visitor sends the form, the answers they typed — which may include their
name, email address, phone number, message, a chosen appointment time and a consent
choice — are sent to Well Done Suite and stored for the site owner. The IP address
is used, as a keyed hash, only to limit repeated submissions. The service emails
the site owner and, if the site owner switched it on, sends the visitor a confirmation
email.
**Customer portal.** Off by default. Only when an administrator switches it on under
Settings Well Done Suite and the business switches it on in the console:
* WordPress asks `https://api.welldonesuite.com/v1/p/{tenant identifier}/connector-
config` for the portal design and whether the portal is switched on. This signed
request sends the My Account page address, the plugin version and whether WooCommerce
and the portal are switched on here. The answer is cached for five minutes.
* When a signed-in customer opens My Account, their browser asks this site’s `POST/
wp-json/welldosu/v1/portal/handoff` for a token signed with the shared secret.
It contains the tenant identifier, the customer’s WordPress user ID, email address
and display name, and expires after two minutes; the service accepts it once.
The browser exchanges it at `https://api.welldonesuite.com/v1/p/{tenant identifier}/
auth/wp-handoff` for a portal session and then loads that customer’s own records—
shop orders (read from this site through the signed orders endpoint, narrowed
to that customer), quotes, invoices, support requests and bookings — from `https://
api.welldonesuite.com/v1/p/…`. Like any web request this sends the customer’s
IP address and browser details.
* Support requests and replies the customer writes in the portal, and a quote they
accept there, are sent to Well Done Suite and kept for the site owner.
* Customers who are not signed in see a sign-in form that posts to this site’s `
POST /wp-json/welldosu/v1/portal/login` (WordPress’s `wp_signon()`), and, when
WooCommerce allows registration on My Account, a registration form that posts
to `POST /wp-json/welldosu/v1/portal/register` (WooCommerce’s `wc_create_new_customer()`).
Neither sends anything to Well Done Suite; passwords never leave WordPress.
The plugin loads no remote scripts or stylesheets into WordPress. Its only front-
end files are its own `assets/css/mechanism.css` and `assets/js/mechanism-frame.
js`, which fits the form frame to the height the form reports, and — only on My
Account with the customer portal switched on — `assets/portal/portal.js` and `assets/
portal/portal.css`.
The service never receives WordPress passwords or password hashes, other users’
details, payment card or bank-account data, private keys, gateway credentials or
WordPress options other than those listed above.
* [Well Done Suite service](https://welldonesuite.com/)
* [Connector documentation](https://welldonesuite.com/wordpress-connector/)
* [Terms of Service](https://welldonesuite.com/terms-conditions/)
* [Privacy Notice](https://welldonesuite.com/privacy-notice/)
### Source code
```
assets/portal/portal.js and `assets/portal/portal.css` are compiled. Their complete, readable source is shipped in `assets/portal/src/`. The build bundles `assets/portal/src/portal/embed.jsx` with React 18.3.1 into one script and one stylesheet, using Vite 6.4.3 with @vitejs/plugin-react 4.3.4 in library mode with IIFE output. Every other file in the plugin is shipped as written.Credits
```
The settings screens use the Onest typeface, © 2021 The Onest Project Authors, licensed
under the SIL Open Font License 1.1 (`assets/fonts/OFL.txt`).
## Screenshots
[⌊Settings → Well Done Suite before the site is connected.⌉⌊Settings → Well Done
Suite before the site is connected.⌉[
Settings Well Done Suite before the site is connected.
[⌊Approving the connection in Well Done Suite.⌉⌊Approving the connection in Well
Done Suite.⌉[
Approving the connection in Well Done Suite.
[⌊The connected site, with the optional customer portal switch.⌉⌊The connected site,
with the optional customer portal switch.⌉[
The connected site, with the optional customer portal switch.
[⌊Settings → Well Done Suite — Overview: every endpoint, the data it returns and
how it is protected.⌉⌊Settings → Well Done Suite — Overview: every endpoint, the
data it returns and how it is protected.⌉[
Settings Well Done Suite — Overview: every endpoint, the data it returns and how
it is protected.
## Installation
1. Install and activate Well Done Suite Connector.
2. Go to **Settings Well Done Suite**.
3. Click **Connect to Well Done Suite**.
4. Sign in to Well Done Suite and approve the named WordPress site.
5. Continue in the Well Done Suite console. If the business has no active access yet,
its owner can start the free 14-day trial or choose a monthly or annual plan there.
To disconnect, return to the same screen and click **Disconnect**.
## FAQ
### Is a Well Done Suite account required?
Yes, to connect the site. The Overview screen works without a connection and explains
every endpoint and data category.
### Can the console install or activate plugins?
No. The connector neither downloads nor runs code from Well Done Suite or any other
server, and has no way to install, activate, update or remove plugins or themes.
### Can the console create administrators or change users?
No. The connector has no user endpoints. The only user it reports on is the administrator
who approved the connection, and only their login, display name, roles and a fixed
list of permission flags.
### Can the console change WordPress settings?
No. The settings endpoint is read-only and returns only the site name, tagline,
address, language, time zone, date and time format and first day of the week.
### Can the console change content?
Yes. It can create and update posts, pages and other public, REST-enabled content,
and move them to the trash. WordPress checks the permissions of the administrator
who approved the connection before every change. Permanent deletion is not available:
if the WordPress trash is disabled, the connector refuses to delete and leaves the
content in place.
### What can it change in WooCommerce?
It can create draft products and update existing products and their listed variations:
name, descriptions, prices, SKU, stock, status, categories, tags, images and their
alt text, attributes, cross-sells, upsells, bundles and the SEO title and description.
Publishing needs the administrator to be allowed to publish products. It never deletes
products or variations.
For orders it can set the status to pending payment, on hold, processing, completed
or cancelled, add an order note and record a tracking number and link. Status changes
go through WooCommerce, so its customer emails and stock changes happen as they
do in wp-admin; a note for the customer is emailed by WooCommerce. Each change needs
the administrator to be allowed to edit shop orders. It never creates, refunds,
reprices or deletes orders, and refunded or failed orders stay as the payment provider
left them.
### Does the plugin execute AI-generated code?
No. Assistance in the hosted console can propose a change, but this plugin only
accepts its fixed REST endpoints. It never evaluates PHP, JavaScript, SQL or shell
commands it receives.
### Does the plugin add anything to the public site?
Only where a site editor adds the `[welldosu_form]` shortcode, and on the WooCommerce
My Account page when the customer portal is switched on. A shortcode page shows
a Well Done Suite form in an iframe (see External services). Everywhere else the
plugin adds nothing to the public site: no block, no tracking script and no other
visitor-facing output. While a form is switched off, visitors see nothing and editors
see a short note.
### How do I switch the customer portal on or off?
Under Settings Well Done Suite, use **Use the customer portal on My Account**,
and switch it on for the shop in the console under Customer portal Where the portal
runs. While either is off — or if the service cannot be reached — My Account shows
the standard WooCommerce page. Adding `?welldosu_classic=1` to the My Account address
always shows the standard page.
### Connecting says “Connection request expired”. What now?
The one-time code created when you click Connect lasts five minutes. Go back to
Settings Well Done Suite, click Connect again and finish the approval straight
away.
### What happens when the site is disconnected?
The local tenant identifier, shared secret and administrator reference are deleted,
and the service is told to forget the connection. Signed requests then fail.
### Does it support multisite?
Each site in a network can be connected separately. Network-wide connection is not
supported. Uninstalling removes the connector’s data from every site.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Well Done Suite Connector” is open source software. The following people have contributed
to this plugin.
Contributors
* [ welldonesuite ](https://profiles.wordpress.org/welldonesuite/)
[Translate “Well Done Suite Connector” into your language.](https://translate.wordpress.org/projects/wp-plugins/well-done-suite-connector)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/well-done-suite-connector/),
check out the [SVN repository](https://plugins.svn.wordpress.org/well-done-suite-connector/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/well-done-suite-connector/)
by [RSS](https://plugins.trac.wordpress.org/log/well-done-suite-connector/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 0.6.1
* Product updates from the console can now set cross-sells and upsells (by SKU),
attributes — shared attributes for the ones shoppers filter by, product-only
attributes for the rest of the specification — the SEO title and meta description,
alt text on the product’s images, and a bundle of products with a discount. Attributes
that make variations are never changed.
* The SEO title and description are kept in the connector’s own product fields,
and also written to Yoast SEO, Rank Math or SEOPress when that plugin is active.
Other plugins’ fields are never touched while they are inactive. With no SEO
plugin active, the connector prints the title and description on the product
page itself.
* A product read now includes its cross-sells, upsells, attributes, SEO fields
and bundle, so the console can tell what the shop already holds.
* New shared attributes and attribute values are created only when the administrator
who connected the site may manage WooCommerce and product terms.
#### 0.6.0
* Shop orders can be moved along from the console: status (pending payment, on
hold, processing, completed or cancelled), order notes and tracking, through
the new signed `PATCH /wds/v1/orders/{id}`. Status changes go through WooCommerce,
so its customer emails and stock changes happen as in wp-admin. Each change needs
the administrator who connected the site to be allowed to edit shop orders. Orders
are still never created, refunded, repriced or deleted.
* One order now comes with its order notes, and every order with the tracking recorded
in the console.
* The suggested privacy-policy text and the Overview screen now list every site
setting the connector reads, including the time format and the first day of the
week.
Earlier versions are listed in `changelog.txt`.
## Meta
* Version **0.6.1**
* Last updated **13 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.3 or higher **
* Tested up to **7.1.3**
* PHP version ** 8.1 or higher **
* Tags
* [business](https://wordpress.org/plugins/tags/business/)[customer portal](https://wordpress.org/plugins/tags/customer-portal/)
[forms](https://wordpress.org/plugins/tags/forms/)[orders](https://wordpress.org/plugins/tags/orders/)
[woocommerce](https://wordpress.org/plugins/tags/woocommerce/)
* [Advanced View](https://wordpress.org/plugins/well-done-suite-connector/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/well-done-suite-connector/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/well-done-suite-connector/reviews/)
## Contributors
* [ welldonesuite ](https://profiles.wordpress.org/welldonesuite/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/well-done-suite-connector/)