{"id":394063,"date":"2026-11-08T11:04:32","date_gmt":"2026-11-08T11:04:32","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/faro-factu-sif\/"},"modified":"2026-11-08T11:35:56","modified_gmt":"2026-11-08T11:35:56","slug":"encadena-sif","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/encadena-sif\/","author":23581855,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.4.18","stable_tag":"1.4.18","tested":"7.1.4","requires":"6.2","requires_php":"7.4","requires_plugins":null,"header_name":"Encadena SIF","header_author":"fwp","header_description":"Verifactu (Veri*factu) billing record system (SIF) for WooCommerce that follows RD 1007\/2023 and Order HAC\/1177\/2024: it records every invoice, chains it with its hash, prints the tax QR and submits it to the AEAT in VERI*FACTU mode, or keeps it chained.","assets_banners_color":"585d64","last_updated":"2026-11-08 11:35:56","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/farowp.com\/encadena-sif","header_author_uri":"https:\/\/farowp.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":94,"num_ratings":0,"support_threads":1,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.4.18":{"tag":"1.4.18","author":"farowp","date":"2026-11-08 11:35:56","revision":3790915}},"upgrade_notice":{"1.3.2":"<p>First public release on WordPress.org.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3790876,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3790876,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3790876,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3790876,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.4.18"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3790876,"resolution":"1","location":"assets","locale":"","width":1440,"height":900},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3790876,"resolution":"2","location":"assets","locale":"","width":1440,"height":900},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3790876,"resolution":"3","location":"assets","locale":"","width":1440,"height":900}},"screenshots":{"1":"Configuration: what is missing and what is already in place, plus the four-step guide.","2":"Issuer and invoicing: tax ID, series and the status that triggers the invoice.","3":"Billing records with their hash, their AEAT status and a link to the order."}},"plugin_section":[],"plugin_tags":[257667,26218,19126,247447,286],"plugin_category":[45],"plugin_contributors":[286458],"plugin_business_model":[],"class_list":["post-394063","plugin","type-plugin","status-publish","hentry","plugin_tags-aeat","plugin_tags-invoicing","plugin_tags-vat","plugin_tags-verifactu","plugin_tags-woocommerce","plugin_category-ecommerce","plugin_contributors-farowp","plugin_committers-farowp"],"banners":{"banner":"https:\/\/ps.w.org\/encadena-sif\/assets\/banner-772x250.png?rev=3790876","banner_2x":"https:\/\/ps.w.org\/encadena-sif\/assets\/banner-1544x500.png?rev=3790876","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/encadena-sif\/assets\/icon-128x128.png?rev=3790876","icon_2x":"https:\/\/ps.w.org\/encadena-sif\/assets\/icon-256x256.png?rev=3790876","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/encadena-sif\/assets\/screenshot-1.png?rev=3790876","caption":"Configuration: what is missing and what is already in place, plus the four-step guide."},{"src":"https:\/\/ps.w.org\/encadena-sif\/assets\/screenshot-2.png?rev=3790876","caption":"Issuer and invoicing: tax ID, series and the status that triggers the invoice."},{"src":"https:\/\/ps.w.org\/encadena-sif\/assets\/screenshot-3.png?rev=3790876","caption":"Billing records with their hash, their AEAT status and a link to the order."}],"raw_content":"<!--section=description-->\n<p>Encadena SIF is an independent plugin. Veri*factu (Verifactu) is the invoice verification system of the\nSpanish Tax Agency (AEAT): this plugin is not affiliated with, endorsed by or sponsored by the AEAT.<\/p>\n\n<p>Encadena SIF turns every WooCommerce order into a Spanish billing record (registro de facturaci\u00f3n) that follows\nRoyal Decree 1007\/2023 and Order HAC\/1177\/2024: it creates the record, chains it with its SHA-256 hash, prints the\ntax QR and either sends it to the Spanish tax agency (VERI<em>FACTU mode) or keeps it chained locally (non VERI<\/em>FACTU\nmode, with event records).<\/p>\n\n<p>It is a <strong>Verifactu<\/strong> plugin: Verifactu is how everyone writes it, and Veri*factu is the official name the AEAT uses.\nBoth are the same regulation, and this plugin works either way: with a certificate it submits to the AEAT, and without\none it keeps the chain in the shop.<\/p>\n\n<p>The plugin is free and complete: issuing, voiding, corrective invoices, QR, PDF and submission with the\nshop's own certificate. Every feature is in this download; nothing is held back.<\/p>\n\n<p><strong>What it does, and why it is built this way<\/strong><\/p>\n\n<ul>\n<li>The hash reproduces <strong>exactly<\/strong> the official AEAT examples (three cases from the technical specification v0.1.2),\nand the QR reproduces the four official URL variants.<\/li>\n<li>Records are <strong>immutable<\/strong>: they are only inserted, never updated or deleted. The submission state lives in a\nseparate table, so the fiscal content of a record never changes.<\/li>\n<li><strong>Independent chains per taxpayer<\/strong> and correlative numbering per series and tax ID.<\/li>\n<li>The certificate is stored <strong>outside the public directory<\/strong>, encrypted, in <code>uploads\/encadena-sif-certs\/<\/code>, and its\npassword is encrypted too: it is read from the <code>ENCASI_CERT_PASS<\/code> constant in <code>wp-config.php<\/code> when you define it, or\nfrom the encrypted copy the plugin keeps next to the certificate.<\/li>\n<li><strong>PDF invoice with the QR<\/strong>: with <em>PDF Invoices &amp; Packing Slips for WooCommerce<\/em> active, the invoice carries the\nrecord number and date, the customer tax ID, the issuer's fiscal data and the verification QR.<\/li>\n<li>Compatible with WooCommerce High-Performance Order Storage (HPOS).<\/li>\n<\/ul>\n\n<p><strong>What the shop owner never has to fill in<\/strong><\/p>\n\n<p>The system identifier, its version, the producer and the responsible declaration travel with the plugin. The shop\nonly configures its own data: tax ID, legal name, series, when to invoice, and its certificate.<\/p>\n\n<h3>External services<\/h3>\n\n<p>The plugin connects to two external services. Both are optional: without a certificate it never contacts the AEAT,\nand the Telegram notice stays off until a bot token and a chat are entered.<\/p>\n\n<h4>Spanish Tax Agency (AEAT) \u2014 Veri*factu<\/h4>\n\n<ul>\n<li><strong>What is sent:<\/strong> the billing record (invoice number and date, amounts and tax breakdown, the customer's tax ID and\nname, the previous record's hash and the hash of the record itself). No other data of the shop or of the customer\nis sent, and nothing is sent while the plugin is in non VERI*FACTU mode.<\/li>\n<li><strong>When:<\/strong> only when the mode is VERI*FACTU and an order reaches the status you chose, and when you press\n\u201cTest connection\u201d in the panel.<\/li>\n<li><strong>Where:<\/strong> <code>https:\/\/prewww1.aeat.es\/wlpl\/TIKE-CONT\/ws\/SistemaFacturacion\/VerifactuSOAP<\/code> (test) or\n  https:\/\/www1.agenciatributaria.gob.es\/wlpl\/TIKE-CONT\/ws\/SistemaFacturacion\/VerifactuSOAP (production).<\/li>\n<li><strong>How it identifies itself:<\/strong> with the certificate you upload (mutual TLS). There is no shared credential and no\naccount with the AEAT.<\/li>\n<li><strong>Terms of service:<\/strong> https:\/\/sede.agenciatributaria.gob.es\/Sede\/condiciones-uso-sede-electronica\/aviso-legal.html<\/li>\n<li><strong>Privacy policy:<\/strong> https:\/\/sede.agenciatributaria.gob.es\/Sede\/condiciones-uso-sede-electronica\/aviso-legal\/politica-privacidad.html<\/li>\n<\/ul>\n\n<h4>Telegram (optional notices)<\/h4>\n\n<ul>\n<li><strong>What is sent:<\/strong> the text of the notice (invoice issued, submission rejected, summary) and the chat identifier\nyou configure. No customer data beyond what the notice text already shows.<\/li>\n<li><strong>When:<\/strong> only if you enter a bot token and a chat ID in the settings, and only when one of those events happens.<\/li>\n<li><strong>Where:<\/strong> <code>https:\/\/api.telegram.org\/bot&lt;token&gt;\/sendMessage<\/code>, the official Telegram Bot API.<\/li>\n<li><strong>Terms of service:<\/strong> https:\/\/telegram.org\/tos<\/li>\n<li><strong>Privacy policy:<\/strong> https:\/\/telegram.org\/privacy<\/li>\n<\/ul>\n\n<p>The plugin does not send telemetry, does not contact any update server of its own and does not share data with any\nother third party.<\/p>\n\n<h3>Privacy<\/h3>\n\n<p>The plugin does not send telemetry and does not contact any server of its own. What leaves the site is what is\ndescribed in <strong>External services<\/strong> above: the billing record submitted to the AEAT when the shop runs in\nVERI*FACTU mode with a certificate, and the optional Telegram notice, if it is switched on.<\/p>\n\n<ul>\n<li><strong>Privacy policy:<\/strong> https:\/\/farowp.com\/privacidad<\/li>\n<li><strong>Terms of service:<\/strong> https:\/\/farowp.com\/terminos<\/li>\n<\/ul>\n\n<!--section=installation-->\n<ol>\n<li>Upload the plugin folder to <code>\/wp-content\/plugins\/<\/code>, or install it from the zip.<\/li>\n<li>Go to <strong>Encadena SIF \u2192 Issuer<\/strong> and enter the tax ID, the legal name and the series.<\/li>\n<li>In <strong>Certificate<\/strong>, add <code>define('ENCASI_CERT_PASS', '\u2026');<\/code> to <code>wp-config.php<\/code> and upload your <code>.p12<\/code>.<\/li>\n<li>In <strong>Invoicing<\/strong>, choose the mode, the environment (start with <strong>AEAT test<\/strong>) and when an order is invoiced.<\/li>\n<li>Place a test order and move it to the status that invoices: the record appears in <strong>Records<\/strong>.<\/li>\n<\/ol>\n\n<p>The full guide ships inside the ZIP, in Spanish and English: <code>guia\/GUIA-DE-INSTALACION.pdf<\/code> and\n    guia\/INSTALL-GUIDE.pdf. It covers the two modes, the two environments, the ten-minute check and what to do\nwhen something does not add up.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"is%20this%20electronic%20invoicing%20%28factura%20electr%C3%B3nica%29%3F\"><h3>Is this electronic invoicing (factura electr\u00f3nica)?<\/h3><\/dt>\n<dd><p>No. This covers the billing record system (Veri*factu). Business-to-business electronic invoicing is a different\nregulation (Law 18\/2022 and Royal Decree 238\/2026).<\/p><\/dd>\n<dt id=\"do%20i%20need%20an%20aeat%20%22homologation%22%3F\"><h3>Do I need an AEAT \"homologation\"?<\/h3><\/dt>\n<dd><p>There is no such homologation. The manufacturer signs a responsible declaration (art. 15 RRSIF), which is\nreproduced inside the plugin, in the <strong>Help<\/strong> tab.<\/p><\/dd>\n<dt id=\"what%20happens%20if%20i%20uninstall%20the%20plugin%3F\"><h3>What happens if I uninstall the plugin?<\/h3><\/dt>\n<dd><p>Settings are removed, <strong>billing records are not<\/strong>: the law requires keeping them.<\/p><\/dd>\n<dt id=\"does%20it%20work%20without%20a%20certificate%3F\"><h3>Does it work without a certificate?<\/h3><\/dt>\n<dd><p>It issues and chains records but cannot submit them. The panel warns about it in the header and in the summary.<\/p><\/dd>\n<dt id=\"does%20it%20send%20data%20anywhere%20else%3F\"><h3>Does it send data anywhere else?<\/h3><\/dt>\n<dd><p>Only to the two services described in <strong>External services<\/strong>: the AEAT endpoint you select (test or production), and\nonly if you enable it, your own Telegram bot. Nothing else leaves the site.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.4.18<\/h4>\n\n<ul>\n<li>Fix (plugin review): the migration of the old \"vf_\" prefix is skipped on a fresh installation, so the\nplugin no longer rewrites any post metadata it did not create. On sites coming from the old version the\nmigration still runs, but only over orders and refunds.<\/li>\n<li>The package for the directory does not ship its own update checker: WordPress.org serves those updates.<\/li>\n<\/ul>\n\n<h4>1.4.17<\/h4>\n\n<ul>\n<li>The links to the terms of service and the privacy policy of the Spanish Tax Agency in the \"External services\"\nsection pointed to pages that no longer exist and returned 404; they now point to the current pages of the\nAEAT electronic office.<\/li>\n<li>Added the privacy policy and the terms of service of the plugin itself.<\/li>\n<li>Internal error messages are now in English, like the rest of the strings of the plugin.<\/li>\n<\/ul>\n\n<h4>1.4.16<\/h4>\n\n<ul>\n<li>Fix: in the chained-only mode (non VERI*FACTU) the overview counted every record as \"waiting to be sent\" and\nshowed a red warning, because nothing is submitted in that mode by design. Pending submissions and submission\nerrors are now counted only for installations that do submit.<\/li>\n<\/ul>\n\n<h4>1.4.15<\/h4>\n\n<ul>\n<li>Fix: the code fingerprint now leaves out the updater class. That file only exists in the package served from\nfarowp.com, so the same version had two different fingerprints and the signed statement could only match one\nof the two packages. The fingerprint now identifies the invoicing code, which is the same in both.<\/li>\n<\/ul>\n\n<h4>1.4.14<\/h4>\n\n<ul>\n<li>Fix: the producer of the system is now identified as a natural person, with name and surname and tax ID,\ninstead of with the trade name \"Encadena\", which has no legal personality. The label of that field is\n\"Name and surname\" rather than \"Company name\". The same identification goes to the AEAT in the\nSistemaInformatico block of every submission.<\/li>\n<li>The trade names FaroWP and Encadena SIF stay as brand and commercial name of the system, not as producer.<\/li>\n<\/ul>\n\n<h4>1.4.13<\/h4>\n\n<ul>\n<li>Fix: the declaration of responsibility is no longer generated when it is downloaded. The package carries the\nPDF signed by the producer and the plugin serves that file. The date on the statement is the date it was\nsigned, not the day it is opened. If a version has no signed statement yet, the plugin says so instead of\nbuilding one.<\/li>\n<li>Fix: the button to download the declaration returned HTTP 400, because its admin-post action was never\nregistered.<\/li>\n<li>Fix: the invoice PDF printed the issuer address twice, once from Encadena and once from the PDF plugin. The\nstatement now prints only the tax ID and leaves the address to the document header.<\/li>\n<li>Tweak: the label no longer asks the shop to sign and archive the statement: it states who signed it and when.<\/li>\n<\/ul>\n\n<h4>1.4.12<\/h4>\n\n<ul>\n<li>New: the panel has been redesigned. The overview shows four figures (records in the last seven days, waiting,\nwith an incident and the last correct submission), the status of the certificate and the AEAT, a chart of the\nlast eight weeks, the latest records and the state of the hash chain.<\/li>\n<li>New: setup is now a four-step wizard inside Configuration (welcome, tax data, certificate, mode) that advances\non its own and shows the result of every save. The separate \"Getting started\" screen and its menu entry are gone:\nthere was only one setup, reached from two places.<\/li>\n<li>New: the issuer address (address, postcode and town) is asked for in Issuer and printed on the PDF invoice. It\nwas read by the invoice but there was no way to fill it in.<\/li>\n<li>New: every tab shows \"Settings saved\" and the errors (an invalid tax ID, a missing company name) instead of\nsaving silently.<\/li>\n<li>Fix: opening the Plugins screen no longer fails when the update feed is read (a list was passed to wp_kses_post).<\/li>\n<li>Fix: the Records tab printed a stray PHP closing tag above the table.<\/li>\n<li>Fix: the certificate upload from the setup wizard continues to the next step instead of staying on the same one.<\/li>\n<\/ul>\n\n<h4>1.4.11<\/h4>\n\n<ul>\n<li>New: the Summary is the panel it should have been. Four figures at a glance: records issued in the last\nseven days (with the change against the previous week), those waiting to be sent, those with an error and\nwhen the last correct submission happened.<\/li>\n<li>New: a system status card (certificate with days left, last answer from the AEAT and the environment in use),\na bar chart of the last eight weeks with the incidents marked, and the latest records in a table with number,\ndate, customer, type, submission status and total.<\/li>\n<li>New: a side column with the hash chain (total records, verification and last hash), the setup checklist with\nits progress, and the guide and statement links, plus the versions in the footer.<\/li>\n<li>The four-step guide and the rest of the tabs do not change.<\/li>\n<\/ul>\n\n<h4>1.4.10<\/h4>\n\n<ul>\n<li>Fix: the Plugins screen no longer breaks when the version feed is read. The published feed sends the\nchangelog as a list, and the plugin information window passed it to WordPress as if it were text, which\nbrought down the whole Plugins screen on sites that also have Encadena SIF Pro installed.<\/li>\n<li>Fix: the \"requires\", \"tested\" and \"PHP\" data are shown again in the version details window; the published\nfeed names them differently and they were arriving empty.<\/li>\n<\/ul>\n\n<h4>1.4.9<\/h4>\n\n<ul>\n<li>New: getting-started wizard, in four steps, that opens by itself the first time the plugin is activated:\ntax details (with the check letter validated as you type), certificate, and how you invoice. It can be left\nhalfway and picked up later, and it stays in the menu as \"Getting started\".<\/li>\n<li>New: a help note under every field of the wizard explaining what goes in it and what the AEAT does with it.<\/li>\n<li>Fix: the issuer tax ID is now checked against its control letter before saving. A wrong one was accepted and\nevery record was rejected later by the AEAT (error 1239), with the invoice already numbered.<\/li>\n<li>Fix: a non-empty <code>index.php<\/code> left in the data folder by an earlier version is rewritten empty on upgrade, not\nonly on a fresh install. The folder keeps its <code>.htaccess<\/code> with <code>Require all denied<\/code>.<\/li>\n<\/ul>\n\n<h4>1.4.8<\/h4>\n\n<ul>\n<li>Fix (plugin review): the data folder in <code>uploads<\/code> no longer writes a non-empty <code>index.php<\/code>. It was the last\nplace doing it (<code>includes\/class-encasi-remision.php<\/code>): the directory protection file is now created empty\n(0 bytes), which is the only form the guidelines allow. The folder keeps its <code>.htaccess<\/code> with <code>Require all\ndenied<\/code>, so nothing inside can be listed or fetched.<\/li>\n<li>Fix: the internal version constant <code>ENCASI_VERSION<\/code> was still 1.4.6, so the panel, the record header and the\nAEAT submission reported an older version than the release. It now follows the plugin version.<\/li>\n<\/ul>\n\n<h4>1.4.7<\/h4>\n\n<ul>\n<li>Fix (plugin review): the certificate folder no longer writes an <code>index.php<\/code> with content. It is created empty, which is the only form the directory allows; the folder keeps its <code>.htaccess<\/code> (deny) and an empty <code>index.html<\/code>, so the certificate stays unreachable from the browser.<\/li>\n<li>Fix (plugin review): the two remaining defines without the plugin prefix, <code>VFRUNTIME<\/code> and <code>VFRUNTIME_VERSION<\/code>, are now <code>ENCASI_RUNTIME<\/code> and <code>ENCASI_RUNTIME_VERSION<\/code>. No behaviour changes: it is the same runtime marker, renamed as the review guidelines require.<\/li>\n<li>Translations: Spanish, Catalan and Galician for the new changelog lines.<\/li>\n<\/ul>\n\n<h4>1.4.6<\/h4>\n\n<ul>\n<li>New: when the AEAT rejects a record, the reason now opens in a dialog on the order screen, with what happened and what to do, instead of being left only in the order notes at the bottom of the page. It opens by itself once per session; the \"See what happened\" button next to the status reopens it.<\/li>\n<li>New: the most recent rejected record in the Records tab also opens its explanation by itself.<\/li>\n<li>New: 3000 and 2007 added to the explanation dictionary, and 4104 corrected: it is \"tax ID not identified\", not an expired certificate.<\/li>\n<li>Translations: Spanish, Catalan and Galician for the new texts.<\/li>\n<\/ul>\n\n<h4>1.4.5<\/h4>\n\n<ul>\n<li>Fix: a 3000 \"duplicate\" answer from the AEAT is no longer shown as accepted. The AEAT answers EstadoEnvio \"Incorrecto\" when a different invoice already uses that number and date, so the invoice never entered; the panel used to say \"accepted\" and the QR led nowhere.<\/li>\n<li>New: \"Starting number\" setting. When the counter restarts (fresh install, wiped data) the numbering began again at 1 and collided with the invoices the AEAT already had. Set the number to start above the last one used.<\/li>\n<li>New: the error hint for 3000 and 2007 explains what to do (same invoice already declared, or change the series).<\/li>\n<\/ul>\n\n<h4>1.4.4<\/h4>\n\n<ul>\n<li>Every global identifier moved from the short \"vf_\" prefix to \"encasi_\" \/ \"ENCASI_\", as required by the plugin directory guidelines. Existing settings, invoices, submission log and order metadata are migrated once on upgrade, so no data is lost.<\/li>\n<li>The certificate folder is now resolved with wp_upload_dir() and lives in uploads\/encadena-sif\/certs; certificates saved in the previous locations are moved automatically.<\/li>\n<\/ul>\n\n<h4>1.4.3<\/h4>\n\n<ul>\n<li>New version notices: the plugin checks farowp.com twice a day and, when there is a newer release, it\nshows up in <strong>Plugins \u2192 Updates<\/strong> and installs with the usual button. Until now a shop could keep the\nversion it installed on day one for years, which in a billing program means issuing invoices with a\nsystem that no longer complies. Nothing is sent from your site: it is a plain read of a public file.<\/li>\n<li>If the plugin is ever published on WordPress.org, this notice steps aside on its own and updates come\nfrom the official repository.<\/li>\n<\/ul>\n\n<h4>1.4.2<\/h4>\n\n<ul>\n<li>The declaration of responsibility (article 15 RRSIF) now arrives <strong>closed<\/strong> in the Help tab, behind a\nbutton that opens it in place: it does not reload the page and needs no JavaScript. The text, the PDF\ndownload and the missing-data warning are the same; only the initial state changes.<\/li>\n<\/ul>\n\n<h4>1.4.1<\/h4>\n\n<ul>\n<li>New <strong>Report a problem<\/strong> box in the Help tab: it shows the details needed to reproduce a failure\n(plugin, core, WordPress, WooCommerce and PHP versions, mode, environment and certificate state),\nwith a button to copy them and another to write the report by email. It never sends anything on its own,\nand it carries no tax ID, no customer data and no certificate path.<\/li>\n<li>The testers' channel can be added to that box from a filter, without touching the plugin.<\/li>\n<\/ul>\n\n<h4>1.4.0<\/h4>\n\n<ul>\n<li>New name: the plugin is now <strong>Encadena SIF<\/strong>. Only the visible name, the slug and the text domain change; the settings, the billing records and the certificate stay where they were, so\nupdating does not lose anything.<\/li>\n<li>The name shown inside the plugin (menu, screens, schedule label and notices) is the same as in the directory.<\/li>\n<li>The locale files are renamed to the new text domain.<\/li>\n<li>Scripts are enqueued with <code>wp_enqueue_script()<\/code> \/ <code>wp_add_inline_script()<\/code>: no raw <code>&lt;script&gt;<\/code> tags are printed.<\/li>\n<li>Every output is escaped (<code>esc_html<\/code>, <code>esc_attr<\/code>, <code>esc_url<\/code>, <code>wp_kses_post<\/code>).<\/li>\n<li>All functions, options, constants and tables carry the plugin prefix.<\/li>\n<li>Requests to the AEAT and to Telegram go through the WordPress HTTP API (<code>wp_remote_post()<\/code>); the client\ncertificate is attached with the <code>http_api_curl<\/code> hook.<\/li>\n<li>The certificate is stored in <code>uploads\/encadena-sif-certs\/<\/code>, not in <code>wp-content\/<\/code>; the file of an older installation\nis moved there automatically on the first upload or on the first request.<\/li>\n<li>The settings are sanitized with a callback of their own, and the certificate path is checked against the folder\nthe plugin uses (realpath, no traversal).<\/li>\n<li>Secrets on disk (certificate password, Telegram token, SMTP password) are encrypted with AES-256-GCM and a local\nkey file. No external process is started in any system.<\/li>\n<li>External services (AEAT and Telegram) are documented in the readme: what is sent, when, and their terms and\nprivacy links.<\/li>\n<\/ul>\n\n<h4>1.3.2<\/h4>\n\n<ul>\n<li>First public release. The readme also spells it \"Verifactu\", as most people write it, so the search finds it.<\/li>\n<\/ul>\n\n<h4>1.3.1<\/h4>\n\n<ul>\n<li>Initial submission. The interface is in English and fully translatable (456 strings); the Spanish\ntranslation is published on translate.wordpress.org.<\/li>\n<\/ul>\n\n<h4>1.2.0<\/h4>\n\n<ul>\n<li>Internal build. The plugin is free and complete.<\/li>\n<li>Distribution and licence metadata prepared for the WordPress.org directory.<\/li>\n<\/ul>\n\n<h4>1.1.1<\/h4>\n\n<ul>\n<li>Complete responsible declaration: address, contact email, legal representative, place of signature and\navailability come from the producer and travel with the plugin.<\/li>\n<li>The panel shows the whole document and warns about missing data.<\/li>\n<li>The declaration can be downloaded as a PDF from the Help tab.<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>Step-by-step, collapsible guide in every panel tab.<\/li>\n<li>Warning when the tax ID and the name do not match (the AEAT 4104 error).<\/li>\n<li>Warning for a certificate saved on disk but not linked to the settings.<\/li>\n<li>Red warning while in Production, so nobody declares by accident.<\/li>\n<\/ul>\n\n<h4>1.0.2<\/h4>\n\n<ul>\n<li>AEAT failures (SOAP <code>&lt;Fault&gt;<\/code>) are stored as rejections with their code and reason.<\/li>\n<li>Added the hint for error 4104.<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Fixed: the certificate was uploaded and encrypted but the panel kept saying \"No certificate\".<\/li>\n<li>Uploading a certificate removes the other extension (.p12 or .pfx).<\/li>\n<li>The panel shows the certificate holder and tax ID without the full distinguished name.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Own tabbed panel (Summary, Issuer, Invoicing, Certificate, Records, Help) with status checks.<\/li>\n<li>Every invoicing option explained on screen.<\/li>\n<li>Producer data and the responsible declaration no longer asked from the shop.<\/li>\n<li>PDF invoice with the tax QR and the verification texts.<\/li>\n<\/ul>\n\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>First development version: record core (hash verified against the official AEAT examples), immutable store,\nsettings, diagnostics panel and responsible declaration.<\/li>\n<\/ul>","raw_excerpt":"Verifactu (Veri*factu) invoices for WooCommerce: chained record, hash, tax QR, PDF and AEAT submission with your own certificate.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/394063","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=394063"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/farowp"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=394063"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=394063"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=394063"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=394063"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=394063"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=394063"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}