{ "title": "WooCommerce", "seo_title": "WooCommerce: review, recommended settings and limits", "h1": "WooCommerce", "description": "WooCommerce in detail: which stores it suits, strengths, limits, recommended security settings (accounts, HPOS, checkout, API) and past vulnerabilities.", "lead": "WooCommerce, Automattic’s free plugin, turns WordPress into a full store, but exposes a public Store API and customer accounts. Our take to help you decide whether it fits your project, and the settings that cut the risk: guest checkout, HPOS, checkout rate limiting and downloads.", "language": "en", "locale": "en-US", "type": "plugin-sheet", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/woocommerce/", "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/woocommerce/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/woocommerce/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/woocommerce/index.json", "published": "2026-11-03T08:00:00+00:00", "modified": "2026-11-05T21:30:55+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "WooCommerce", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/woocommerce/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/woocommerce/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/woocommerce/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "WooCommerce", "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/woocommerce/", "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/woocommerce/index.md", "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/woocommerce/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "WooCommerce", "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/woocommerce/", "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/woocommerce/index.md", "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/woocommerce/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "WooCommerce", "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/woocommerce/", "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/woocommerce/index.md", "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/woocommerce/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "WooCommerce", "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/woocommerce/", "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/woocommerce/index.md", "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/woocommerce/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "WooCommerce", "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/woocommerce/", "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/woocommerce/index.md", "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/woocommerce/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "WooCommerce", "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/woocommerce/", "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/woocommerce/index.md", "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/woocommerce/index.json" } ], "headings": [ { "level": 1, "text": "WooCommerce" }, { "level": 2, "text": "What WooCommerce does on your site" }, { "level": 2, "text": "Which stores WooCommerce is a good fit for" }, { "level": 2, "text": "WooCommerce strengths and limitations" }, { "level": 3, "text": "Strengths" }, { "level": 3, "text": "Limitations" }, { "level": 2, "text": "The WooCommerce settings we recommend" }, { "level": 2, "text": "WooCommerce security: the Store API and the Shop manager role" }, { "level": 2, "text": "WooCommerce frequently asked questions", "id": "faq" } ], "body": "## The essentials\n\n- Best for selling from your own WordPress site, with no platform subscription for the software.\n- Main caveat: subscriptions, bookings and memberships need paid Marketplace extensions.\n- Free, with no paid edition; the real cost comes from the paid extensions you add.\n\n## What WooCommerce does on your site\n\nWooCommerce turns a WordPress site into a store. The plugin handles the catalog (physical, downloadable, variable and external products), the cart, checkout, customer accounts, stock, taxes, shipping and transactional emails. It creates the Shop, Cart, Checkout and My account pages, a WooCommerce menu in the admin and two roles, Customer and Shop manager.\n\nSince version 8.3, new stores use the Cart and Checkout blocks, which talk to the Store API, a public REST API that answers without login. Since version 8.2, orders on new installs live in dedicated tables, called High-Performance Order Storage (HPOS). A full REST API, webhooks and WP-CLI commands cover integrations.\n\nThe core is free and open source, with no paid edition. Automattic, the developer, earns its money around it: the WooCommerce Marketplace sells extensions (subscriptions, bookings, memberships and more) and themes, and offers services such as WooPayments. Orders and customers stay in your own database.\n\n![Diagram: WooCommerce works on visitors and bots, database and files, external services. Public traces: generator tag (removed, free version); signed HTML comments (removed, free version); folder name (hidden with Pro); tag IDs (hidden with Pro); file names (still visible); JavaScript variables (still visible); CSS classes (still visible); cookies (still visible); REST routes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/woocommerce/diagram-en.svg?v=0980b8f7)\n\n## Which stores WooCommerce is a good fit for\n\nWooCommerce fits when you want to sell from a WordPress site you control, with no platform subscription for the software itself:\n\n- **Stores selling physical goods** with variations (sizes, colors), stock management and several shipping zones.\n- **Digital downloads** (ebooks, templates, software) with download access after payment.\n- **Content sites and makers** adding a store next to their articles, with the same theme.\n- **Agencies** connecting a custom catalog to an ERP or a fulfillment service through the REST API.\n\nIt is not the right choice if you sell a single product or take donations: a payment link from your provider is enough. Nor if nobody can handle updates, backups and monitoring: a hosted platform does that work for you, in exchange for a subscription and less freedom.\n\n## WooCommerce strengths and limitations\n\n### Strengths\n\n- **A free, complete core.** Catalog, cart, checkout, accounts, stock, taxes, coupons and emails are included with no license.\n- **Your data stays with you.** Orders and customers live in your WordPress database and can be exported to another platform.\n- **A huge ecosystem.** More than 100 payment gateways, including Stripe, PayPal and Square, and hundreds of extensions.\n- **Serious fixes reach older versions.** In March 2026, a Store API flaw was patched in 52 versions, from the 5.4 branch to 10.5, with an automatic rollout.\n\n### Limitations\n\n- **The real cost is in extensions.** Subscriptions, bookings and memberships require paid Marketplace extensions.\n- **A public attack surface.** The Store API, account registration and checkout all respond without login.\n- **No CAPTCHA on registration.** According to WooCommerce, the My account registration form is covered neither by WordPress registration settings nor by a built-in CAPTCHA.\n- **Services vary by country.** WooPayments is offered in only ten countries, and WooCommerce Shipping works only in the United States.\n\n## The WooCommerce settings we recommend\n\nPaths start from WooCommerce > Settings (version 11.2). Confirm each change with a test order, ideally on a staging copy of the site.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Enable guest checkout** Settings > Accounts & Privacy | On (default), unless you sell subscriptions | Every unneeded customer account is one more login to protect. |\n| **Account creation: On “My account” page** Settings > Accounts & Privacy | Unchecked (default), or checked with a compatible CAPTCHA | This form draws account-creation bots, and WordPress does not protect it. |\n| **Send password setup link** Settings > Accounts & Privacy | On (default) | Customers choose their own password through an emailed link. |\n| **Retain pending, failed and cancelled orders** Settings > Accounts & Privacy | A duration, for example 3 months | Empty by default, so kept forever; with a duration, these unpaid orders are moved to the trash. |\n| **Order data storage** Settings > Advanced > Features | High-performance order storage | Dedicated, faster tables. On an older store, check your extensions and go through compatibility mode. |\n| **Rate limit Checkout** Settings > Advanced > Features | On, then a test order | Off by default. Limits checkout to 3 attempts per minute, which slows down stolen-card testing. |\n| **Reviews can only be left by “verified owners”** Settings > Products > General | On | Off by default. Cuts review spam and fake reviews. |\n| **File download method** Settings > Products > Downloadable products | Force downloads (default), or X-Accel-Redirect/X-Sendfile | The real file URL stays hidden. Avoid “Redirect only (Insecure)”. |\n| **REST API keys** Settings > Advanced > REST API keys | “Read” permissions when that is enough | A forgotten read/write key gives access to orders and customers: revoke unused keys. |\n\n- In the WordPress Users menu, filter by the Shop manager role and remove it from anyone who no longer needs it.\n- In Settings > Payments, disable unused payment methods and delete the matching gateway plugins.\n- Place a test order in a private window after every change to checkout or cache settings.\n- In Plugins, enable automatic updates for WooCommerce.\n\n## WooCommerce security: the Store API and the Shop manager role\n\nWidely installed and open to the public, WooCommerce has a steady vulnerability history. Three episodes sum up the risks:\n\n- **July 2021, CVE-2021-32789**: an unauthenticated [SQL injection](https://www.wp-masquerade.com/glossary/sql-injection/) in the Store API affected versions 3.3 to 5.5. WooCommerce 5.5.1 fixed it, and WordPress.org pushed the update to vulnerable stores.\n- **March 2026, CVE-2026-3589**: a [CSRF](https://www.wp-masquerade.com/glossary/csrf/) flaw in the Store API “batch” endpoint could create an administrator account if a logged-in admin opened a booby-trapped link, in some browsers. Versions 5.4 to 10.5.2, fixed in 10.5.3 and on each branch.\n- **October 2026, CVE-2026-106608**: published by Patchstack, a privilege escalation let a Shop manager become an administrator in versions 9.8.0 to 11.1.2 (CVSS 7.2). Fixed in 11.2.0.\n\nThe useful move: stay on the latest version, at least 11.2.0 today, and give the Shop manager role only to people you trust. The full history is in [our timeline of WooCommerce vulnerabilities](https://www.wp-masquerade.com/woocommerce-security-vulnerabilities/), and card fraud and customer accounts in our store security guide. Hiding WooCommerce fixes no flaw, but WP Masquerade removes the generator tag that announces WooCommerce and its version, a clue bots use to pick their targets.\n\n## WooCommerce frequently asked questions\n\n**Is WooCommerce really free?**\n\nYes, the plugin is free and has no paid edition. Your costs come from hosting, paid extensions and your payment provider’s fees.\n\n**Should an existing store switch to High-Performance Order Storage (HPOS)?**\n\nYes, eventually: it is the recommended storage and the default for stores created since version 8.2. Check that your extensions are compatible, turn on compatibility mode while the data syncs and test on a staging copy.\n\n**Is it better to allow checkout without an account?**\n\nFor most stores, yes: fewer accounts mean fewer logins to protect and less data to keep. An account is still needed for subscriptions or a customer area with order history.\n\n**Are WooCommerce and WooPayments the same plugin?**\n\nNo. [WooPayments](https://www.wp-masquerade.com/features/camouflaged-plugins/woopayments/) is a separate payment plugin, with its own updates and its own flaws, including [CVE-2023-28121](https://www.wp-masquerade.com/woocommerce-payments-cve-2023-28121-explained/), exploited in 2023.\n\n## Key facts\n\n- Category: E-commerce\n- Vendor: Automattic\n- Price: Free, with no paid edition; optional paid extensions on the WooCommerce Marketplace\n- Active installations (wordpress.org): 7 000 000+\n- Version: 11.2.1\n- Official page: https://wordpress.org/plugins/woocommerce/\n\n## What WP Masquerade hides\n\n- Handled by the free version of WP Masquerade\n- Removed by the free version: generator tag, signed HTML comments\n- With Pro: folder name, tag IDs\n- Still visible: file names, JavaScript variables, CSS classes, cookies, REST routes", "catalog": "woocommerce", "essentials": [ "Best for selling from your own WordPress site, with no platform subscription for the software.", "Main caveat: subscriptions, bookings and memberships need paid Marketplace extensions.", "Free, with no paid edition; the real cost comes from the paid extensions you add." ], "format": "application/json" }