WordPress and WooCommerce

If your store runs on WooCommerce, our WordPress plugin implements the whole webhook contract for you. Install it, paste your signing secret, and the AI can look up real orders.

What it gives the AI#

Once installed, the assistant can answer:

• "Do you have an account for me?" — customer lookup by email.
• "What have I ordered?" — the customer's orders, scoped to their verified email.
• "Where's my order?" — status, tracking carrier and number, a link to the carrier, and delivery events where available.

All of it scoped to the address the visitor verified.

Install#

1. Download the plugin zip.
2. In WordPress, go to Plugins → Add New → Upload Plugin and upload it.
3. Activate.
4. Open its settings and paste your workspace's signing secret.

The plugin exposes one endpoint at /wp-json/askvoro/v1/webhook and verifies every request's signature before doing anything.

Updates#

The plugin updates itself through WordPress's normal update screen — it checks for new versions the way any plugin from the directory does, so you get the one-click update you're used to. There's a Check for updates link if you don't want to wait for the scheduled check.

The plugin's current built-in update URL is a development fallback. Before relying on unattended updates on a production store, set ASKVORO_UPDATE_URL in wp-config.php to the stable AskVoro /api/wordpress/update endpoint (or configure the equivalent legacy filter). A manual zip upload remains the safe fallback until that production URL is configured.

Order notes#

Orders returned to the AI include customer-facing notes only. Private and admin notes are never included — they routinely contain internal references and payment identifiers that have no business reaching a chat window.

Tracking#

Tracking is read from your existing shipment tracking data, with a fallback that recognises tracking numbers left in order notes by common shipping tools.

Carrier links are built for USPS, UPS, FedEx and DHL. Other carriers return the number without a link, which is still useful — the visitor can paste it.

Security notes#

Keep the signing secret in WordPress, not in a template. The plugin stores it for you.

Every request is verified before anything is read. An unsigned or badly signed request is rejected without touching your order data.

Your store is the enforcement boundary. The plugin scopes lookups to the verified email for exactly the reason described in the webhook contract. If you modify the plugin, keep that property — it is the thing standing between a curious visitor and someone else's order history.

Not on WooCommerce?#

The plugin is a complete, readable implementation of the contract — signature verification, event dispatch, email scoping. It's a good template even if you're writing your handler in something else entirely.