Proteside for WooCommerce

ማብራሪያ

Proteside for WooCommerce connects your store to your existing Proteside account and loads the Proteside protection on the pages you select: checkout, order payment page, order confirmation and, optionally, cart, shop, my account, login or custom URLs.

Proteside is a client-side security service that monitors your checkout in the shopper’s browser for e-skimming / Magecart attacks, payment tampering (Pix, card, crypto), malicious script injection, form hijacking and overlay fraud. It is designed to support the payment page script controls in PCI DSS 4.0 requirements 6.4.3 and 11.6.1.

This plugin does not by itself make your store PCI DSS compliant: compliance covers your whole environment and is assessed by your acquirer or QSA.

What this plugin does

• Adds a settings screen under WooCommerce where you paste your public SDK key (pk_live_…).
• Validates the key against Proteside server-side and shows the connection status: Active, Grace period, Suspended, Inactive, Invalid key or Connection error.
• Prints the Proteside bootstrapper (bundled, version 1.1.3) inline and first in the page head, then loads shield.js asynchronously from the Proteside CDN — exactly the two tags the dashboard gives you, in the right order.
• Optionally embeds your active blocking rules and allowed Google Tag Manager containers in the page (inline config) so blocking starts from the first byte, before the SDK fetches its remote configuration.
• Follows the release channel chosen in your dashboard (stable/latest), with a manual override.
• Detects pages with WooCommerce conditional tags, so it works with translated or custom slugs and with the classic or block-based checkout.
• Stops loading the protection when your subscription is no longer active; keeps the last known status for up to 48 hours if Proteside cannot be reached.
• Re-checks status and rules periodically (WP-Cron, every 6/12/24 h) and on demand, caching everything locally: there is never a network call on a normal page load.
• Advanced “strict first position” mode that buffers the page and inserts the tags right after <head> when a theme or plugin prints scripts before wp_head.

You need a Proteside account. The SDK key comes from your Proteside dashboard (Settings → Pages and Domains). Don’t have one yet? Visit proteside.com.

External services

This plugin connects your site to the Proteside service (https://proteside.com). The connection is required for the plugin to function.

1. Entitlement check (server-side). When you save your SDK key, on each scheduled re-check (every 6/12/24 hours) and when you click “Check status”, your server calls https://app.proteside.com/api/sdk/status. It sends your SDK key, your site URL, the platform name (woocommerce) and the plugin version. No personal or visitor data is sent. The answer tells the plugin whether your subscription is active.

2. Remote configuration (server-side). In the same cycle, when the subscription is active, your server calls https://app.proteside.com/api/sdk/config with your SDK key to fetch the active blocking rules, the allowed Google Tag Manager containers and the release channel configured in your dashboard. The result is cached locally and, if “Embed blocking rules in the page” is enabled, embedded in the page as window.__PROTE_INLINE__.

3. Protection script (front-end). On the pages you select, the plugin prints the bundled inline bootstrapper and loads https://cdn.proteside.com/v1/shield.js (or /v1/latest/shield.js on the latest channel) into your visitors’ browsers.

4. Calls made by the Proteside SDK in the visitor’s browser, on the selected pages only:

   • GET https://app.proteside.com/api/sdk/config with your public SDK key, to load the protection settings of your store.
   • POST https://app.proteside.com/api/sdk/events with security events about the page (for example the type of event, the address of a script, the page URL, severity and timing). Card numbers, CVV, passwords and payment keys are removed before sending.
   • POST https://app.proteside.com/api/sdk/pix-location, only when a dynamic Pix charge is shown on the page: the charge URL contained in the Pix code, your SDK key and the page path, once per charge, so Proteside can check the recipient against the record signed by the payment provider.
   • To detect modified scripts, the SDK downloads the external scripts the page already loads (from their own addresses, without cookies) and computes their hashes. Nothing is sent to those addresses besides the normal request.

See the Proteside documentation (https://docs.proteside.com) for the details of what the SDK collects.

By using this plugin you agree to the Proteside Terms of Use (https://proteside.com/termos) and Privacy Policy (https://proteside.com/privacidade). As the store owner, you are responsible for informing your visitors as required by GDPR / LGPD.