{"id":388773,"date":"2026-10-28T15:16:30","date_gmt":"2026-10-28T15:16:30","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/proteside-for-woocommerce\/"},"modified":"2026-10-28T15:16:18","modified_gmt":"2026-10-28T15:16:18","slug":"proteside-for-woocommerce","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/proteside-for-woocommerce\/","author":23588252,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.1.2","stable_tag":"1.1.2","tested":"7.1.4","requires":"6.7","requires_php":"7.4","requires_plugins":null,"header_name":"Proteside for WooCommerce","header_author":"Proteside","header_description":"Helps you meet PCI DSS 4.0 requirements 6.4.3 and 11.6.1 by loading the Proteside client-side protection on your payment pages.","assets_banners_color":"0f3765","last_updated":"2026-10-28 15:16:18","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/docs.proteside.com\/en\/docs\/integration\/platforms","header_author_uri":"https:\/\/proteside.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":57,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.1.2":{"tag":"1.1.2","author":"proteside","date":"2026-10-28 15:16:18","revision":3770947}},"upgrade_notice":{"1.1.2":"<p>Bootstrapper 1.1.3. If your Content-Security-Policy pins a hash for the inline script, copy the new hash from Diagnostics.<\/p>","1.1.1":"<p>Uses the WordPress script tag API. If your site has a Content-Security-Policy with a hash for the inline script, copy the new hash from Diagnostics.<\/p>","1.1.0":"<p>Bootstrapper 1.1.2, inline blocking rules, release channel and order-pay page. The trust badge option was removed. Cart is now off by default for new installs.<\/p>","1.0.0":"<p>Initial release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3770947,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3770947,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3770947,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3770947,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.1.2"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3770947,"resolution":"1","location":"assets","locale":"","width":1230,"height":2449}},"screenshots":{"1":"The Proteside settings screen with connection status, page targeting, options and diagnostics."}},"plugin_section":[],"plugin_tags":[3148,245444,265161,600,286],"plugin_category":[45,54],"plugin_contributors":[289236],"plugin_business_model":[],"class_list":["post-388773","plugin","type-plugin","status-publish","hentry","plugin_tags-checkout","plugin_tags-magecart","plugin_tags-pci-dss","plugin_tags-security","plugin_tags-woocommerce","plugin_category-ecommerce","plugin_category-security-and-spam-protection","plugin_contributors-proteside","plugin_committers-proteside"],"banners":{"banner":"https:\/\/ps.w.org\/proteside-for-woocommerce\/assets\/banner-772x250.png?rev=3770947","banner_2x":"https:\/\/ps.w.org\/proteside-for-woocommerce\/assets\/banner-1544x500.png?rev=3770947","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/proteside-for-woocommerce\/assets\/icon-128x128.png?rev=3770947","icon_2x":"https:\/\/ps.w.org\/proteside-for-woocommerce\/assets\/icon-256x256.png?rev=3770947","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/proteside-for-woocommerce\/assets\/screenshot-1.png?rev=3770947","caption":"The Proteside settings screen with connection status, page targeting, options and diagnostics."}],"raw_content":"<!--section=description-->\n<p>Proteside for WooCommerce connects your store to your existing <a href=\"https:\/\/proteside.com\">Proteside<\/a> account and loads the Proteside protection on the pages you select: checkout, order payment page, order confirmation and, optionally, cart, shop, my account, login or custom URLs.<\/p>\n\n<p>Proteside is a client-side security service that monitors your checkout in the shopper's browser for e-skimming \/ Magecart attacks, payment tampering (Pix, card, crypto), malicious script injection, form hijacking and overlay fraud. It is designed to support the payment page script controls in PCI DSS 4.0 requirements 6.4.3 and 11.6.1.<\/p>\n\n<p>This plugin does not by itself make your store PCI DSS compliant: compliance covers your whole environment and is assessed by your acquirer or QSA.<\/p>\n\n<p><strong>What this plugin does<\/strong><\/p>\n\n<ul>\n<li>Adds a settings screen under WooCommerce where you paste your public SDK key (<code>pk_live_\u2026<\/code>).<\/li>\n<li>Validates the key against Proteside server-side and shows the connection status: Active, Grace period, Suspended, Inactive, Invalid key or Connection error.<\/li>\n<li>Prints the Proteside bootstrapper (bundled, version 1.1.3) <strong>inline and first<\/strong> in the page head, then loads <code>shield.js<\/code> asynchronously from the Proteside CDN \u2014 exactly the two tags the dashboard gives you, in the right order.<\/li>\n<li>Optionally embeds your active blocking rules and allowed Google Tag Manager containers in the page (inline config) so blocking starts from the first byte, before the SDK fetches its remote configuration.<\/li>\n<li>Follows the release channel chosen in your dashboard (stable\/latest), with a manual override.<\/li>\n<li>Detects pages with WooCommerce conditional tags, so it works with translated or custom slugs and with the classic or block-based checkout.<\/li>\n<li>Stops loading the protection when your subscription is no longer active; keeps the last known status for up to 48 hours if Proteside cannot be reached.<\/li>\n<li>Re-checks status and rules periodically (WP-Cron, every 6\/12\/24 h) and on demand, caching everything locally: there is never a network call on a normal page load.<\/li>\n<li>Advanced \"strict first position\" mode that buffers the page and inserts the tags right after <code>&lt;head&gt;<\/code> when a theme or plugin prints scripts before <code>wp_head<\/code>.<\/li>\n<\/ul>\n\n<p><strong>You need a Proteside account.<\/strong> The SDK key comes from your Proteside dashboard (Settings \u2192 Pages and Domains). Don't have one yet? Visit <a href=\"https:\/\/proteside.com\">proteside.com<\/a>.<\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin connects your site to the Proteside service (https:\/\/proteside.com). The connection is required for the plugin to function.<\/p>\n\n<ol>\n<li><p><strong>Entitlement check (server-side).<\/strong> When you save your SDK key, on each scheduled re-check (every 6\/12\/24 hours) and when you click \"Check status\", your server calls <code>https:\/\/app.proteside.com\/api\/sdk\/status<\/code>. It sends your SDK key, your site URL, the platform name (<code>woocommerce<\/code>) and the plugin version. No personal or visitor data is sent. The answer tells the plugin whether your subscription is active.<\/p><\/li>\n<li><p><strong>Remote configuration (server-side).<\/strong> In the same cycle, when the subscription is active, your server calls <code>https:\/\/app.proteside.com\/api\/sdk\/config<\/code> with your SDK key to fetch the active blocking rules, the allowed Google Tag Manager containers and the release channel configured in your dashboard. The result is cached locally and, if \"Embed blocking rules in the page\" is enabled, embedded in the page as <code>window.__PROTE_INLINE__<\/code>.<\/p><\/li>\n<li><p><strong>Protection script (front-end).<\/strong> On the pages you select, the plugin prints the bundled inline bootstrapper and loads <code>https:\/\/cdn.proteside.com\/v1\/shield.js<\/code> (or <code>\/v1\/latest\/shield.js<\/code> on the latest channel) into your visitors' browsers.<\/p><\/li>\n<li><p><strong>Calls made by the Proteside SDK in the visitor's browser<\/strong>, on the selected pages only:<\/p>\n\n<ul>\n<li><code>GET https:\/\/app.proteside.com\/api\/sdk\/config<\/code> with your public SDK key, to load the protection settings of your store.<\/li>\n<li><code>POST https:\/\/app.proteside.com\/api\/sdk\/events<\/code> with security events about the page (for example the type of event, the address of a script, the page URL, severity and timing). Card numbers, CVV, passwords and payment keys are removed before sending.<\/li>\n<li><code>POST https:\/\/app.proteside.com\/api\/sdk\/pix-location<\/code>, only when a dynamic Pix charge is shown on the page: the charge URL contained in the Pix code, your SDK key and the page path, once per charge, so Proteside can check the recipient against the record signed by the payment provider.<\/li>\n<li>To detect modified scripts, the SDK downloads the external scripts the page already loads (from their own addresses, without cookies) and computes their hashes. Nothing is sent to those addresses besides the normal request.<\/li>\n<\/ul><\/li>\n<\/ol>\n\n<p>See the Proteside documentation (https:\/\/docs.proteside.com) for the details of what the SDK collects.<\/p>\n\n<p>By using this plugin you agree to the Proteside Terms of Use (https:\/\/proteside.com\/termos) and Privacy Policy (https:\/\/proteside.com\/privacidade). As the store owner, you are responsible for informing your visitors as required by GDPR \/ LGPD.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install and activate WooCommerce.<\/li>\n<li>Install and activate Proteside for WooCommerce.<\/li>\n<li>Go to WooCommerce \u2192 Proteside.<\/li>\n<li>Paste your SDK key (Proteside dashboard \u2192 Settings \u2192 Pages and Domains) and save.<\/li>\n<li>Keep the default pages (checkout, order payment page, order confirmation) or add more. Done.<\/li>\n<li>Open your checkout and run <code>Proteside.getStatus()<\/code> in the browser console: <code>installationOrderValid<\/code> must be <code>true<\/code>.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"do%20i%20need%20a%20paid%20proteside%20account%3F\"><h3>Do I need a paid Proteside account?<\/h3><\/dt>\n<dd><p>Yes. The plugin activates an existing Proteside subscription. You can create one at proteside.com.<\/p><\/dd>\n<dt id=\"is%20my%20sdk%20key%20a%20secret%3F\"><h3>Is my SDK key a secret?<\/h3><\/dt>\n<dd><p>No. The <code>pk_<\/code> key is public by design \u2014 it already appears in your store's HTML. Keep your account credentials safe; the SDK key itself is not sensitive.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20the%20block-based%20checkout%3F\"><h3>Does it work with the block-based checkout?<\/h3><\/dt>\n<dd><p>Yes. Page detection uses WooCommerce conditional tags plus block detection, so both classic and block cart\/checkout are supported.<\/p><\/dd>\n<dt id=\"where%20is%20the%20trust%20badge%3F\"><h3>Where is the trust badge?<\/h3><\/dt>\n<dd><p>The Proteside SDK no longer renders a badge. The badge is a static HTML snippet you copy from your dashboard (Settings \u2192 Store) and paste wherever you want it in your theme; the plugin does not add it for you.<\/p><\/dd>\n<dt id=\"what%20is%20%22embed%20blocking%20rules%20in%20the%20page%22%3F\"><h3>What is \"Embed blocking rules in the page\"?<\/h3><\/dt>\n<dd><p>The plugin copies your active rules and allowed GTM containers from the dashboard into the inline bootstrapper (same <code>&lt;script&gt;<\/code> tag). Blocking then starts before the SDK downloads its remote configuration. It is refreshed on every status check and is on by default.<\/p><\/dd>\n<dt id=\"what%20does%20%22installation%20order%22%20mean%3F\"><h3>What does \"installation order\" mean?<\/h3><\/dt>\n<dd><p>The bootstrapper must be the first script in <code>&lt;head&gt;<\/code>. If another script runs before it, the SDK reports <code>INSTALLATION_ORDER_WARNING<\/code> and <code>Proteside.getStatus().installationOrderValid<\/code> is <code>false<\/code> (protection continues, with partial coverage). The default <code>wp_head<\/code> priority 1 is enough for most themes; if a theme or plugin prints scripts earlier, enable Advanced \u2192 \"Strict first position (output buffering)\".<\/p><\/dd>\n<dt id=\"what%20happens%20if%20my%20subscription%20lapses%3F\"><h3>What happens if my subscription lapses?<\/h3><\/dt>\n<dd><p>The plugin detects the change on its next status check and stops loading the script. During the billing grace period the script keeps loading and you'll see a reminder in the admin.<\/p><\/dd>\n<dt id=\"what%20if%20proteside%20is%20unreachable%3F\"><h3>What if Proteside is unreachable?<\/h3><\/dt>\n<dd><p>Only a definitive answer (HTTP 200 or 401) changes the decision. On timeouts or server errors the plugin keeps the last known status for up to 48 hours, then fails closed.<\/p><\/dd>\n<dt id=\"does%20it%20slow%20down%20my%20store%3F\"><h3>Does it slow down my store?<\/h3><\/dt>\n<dd><p>No network call happens on normal page loads \u2014 everything is cached locally and refreshed by WP-Cron. <code>shield.js<\/code> is loaded asynchronously; the inline bootstrapper is about 4 KB.<\/p><\/dd>\n<dt id=\"my%20site%20has%20a%20content-security-policy.%20what%20do%20i%20allow%3F\"><h3>My site has a Content-Security-Policy. What do I allow?<\/h3><\/dt>\n<dd><p>script-src: the inline bootstrapper (hash shown in Diagnostics, or a nonce\/'unsafe-inline') plus <code>https:\/\/cdn.proteside.com<\/code>; <code>connect-src<\/code>: <code>https:\/\/app.proteside.com<\/code> and <code>https:\/\/cdn.proteside.com<\/code>. Use the hash from Diagnostics: it is computed from the exact tag WordPress prints on your site and changes when your inline rules change.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.1.2<\/h4>\n\n<ul>\n<li>Changed: bundled bootstrapper updated to 1.1.3. On Pix pages in block mode, Proteside can now put the legitimate Pix code back before a malicious clipboard write happens.<\/li>\n<li>Fixed: an SDK key with a trailing line break is no longer accepted.<\/li>\n<li>Changed: translation files are no longer bundled; translations come from translate.wordpress.org.<\/li>\n<li>Changed: admin notices are shown only on the Proteside settings screen.<\/li>\n<li>Changed: the External services section lists every call the Proteside SDK makes from the browser.<\/li>\n<\/ul>\n\n<h4>1.1.1<\/h4>\n\n<ul>\n<li>Changed: the inline bootstrapper and shield.js tags are now printed with the WordPress script tag API (<code>wp_print_inline_script_tag()<\/code> \/ <code>wp_get_script_tag()<\/code>), so the <code>wp_inline_script_attributes<\/code> and <code>wp_script_attributes<\/code> filters apply (e.g. CSP nonces).<\/li>\n<li>Changed: the CSP hash in Diagnostics is computed from the exact tag WordPress prints.<\/li>\n<li>Security: the CDN address returned by the Proteside API is only accepted on <code>https:\/\/<\/code> Proteside domains.<\/li>\n<li>Changed: requires WordPress 6.7+, which loads translations by itself (no <code>load_plugin_textdomain()<\/code>).<\/li>\n<li>Fixed: the plugin name is no longer translated (it stays \"Proteside for WooCommerce\" in every language).<\/li>\n<li>Tested with WordPress 7.1 and WooCommerce 11.2.<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>Bundled bootstrapper updated to 1.1.2 (pre-insertion script blocking, inline config support), with its TypeScript sources.<\/li>\n<li>New: inline config \u2014 active blocking rules and allowed GTM containers from <code>GET \/api\/sdk\/config<\/code> are embedded as <code>window.__PROTE_INLINE__<\/code> in the same tag as the bootstrapper (default on).<\/li>\n<li>New: release channel setting \u2014 follow the dashboard (default), stable or latest.<\/li>\n<li>New: \"Order payment page\" target (<code>order-pay<\/code>). Defaults are now checkout + order payment page + order confirmation; cart is off by default.<\/li>\n<li>New: advanced \"Strict first position (output buffering)\" mode that inserts the tags right after <code>&lt;head&gt;<\/code>.<\/li>\n<li>New: <code>inactive<\/code> status, domain-mismatch advisory notice, connection-error notice.<\/li>\n<li>Changed: the 48-hour tolerance for API outages is now applied properly (fail-closed when never validated or after 48 h).<\/li>\n<li>Changed: diagnostics show bundled bootstrapper version, inline rules\/GTM count, channel in use, injection mode, CSP hash and a verification hint.<\/li>\n<li>Changed: admin wording aligned with the Proteside glossary; pt_BR, es_ES and en_US translations completed.<\/li>\n<li>Removed: the trust badge option and <code>data-safe-url<\/code> (the SDK no longer renders a badge; it is a static snippet from the dashboard).<\/li>\n<li>Removed: the option to disable the inline bootstrapper (it is mandatory for the protection to work).<\/li>\n<li>Uninstall now also removes the revalidation lock transient.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release: SDK key activation, real-time status, page targeting via WooCommerce conditional tags, bootstrapper + async shield.js injection, WP-Cron revalidation, HPOS and Cart\/Checkout Blocks compatibility.<\/li>\n<\/ul>","raw_excerpt":"Helps you meet PCI DSS 4.0 requirements 6.4.3 and 11.6.1 by loading the Proteside client-side protection on your payment pages.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/388773","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=388773"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/proteside"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=388773"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=388773"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=388773"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=388773"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=388773"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=388773"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}