Name: Well Done Suite Connector
Author: welldonesuite

Well Done Suite is a hosted console a business runs its day from: enquiries, quotes, invoices, support requests, bookings and the website. This plugin connects a WordPress site to it, so the site and its WooCommerce shop are managed in the same place as the rest of the work.

What the console can do with your site

Pages and posts. Read posts, pages and other public content types, create and update them, and move them to the trash.
WooCommerce catalogue. Read products and variations, create draft products — including hidden virtual products that stand for services sold through quotes and bookings — and update names, descriptions, prices, SKU, stock, status, categories, tags, images and their alt text, attributes, cross-sells, upsells, bundles and the SEO title and description.
Shop orders. See WooCommerce orders next to the orders kept in the console and move them along: change the status, add order notes and record tracking. WooCommerce sends its usual customer emails.
Media. Add images and PDF files to the media library.
Forms. Place enquiry forms, bookings, reservations and quote calculators built in the console on any page with the [welldosu_form slug="…"] shortcode.
Customer portal. Optional and off by default. Choose the Well Done Suite customer portal, which My Account links to, or your own My Account page connected to Well Done Suite, which shows a customer’s shop orders next to the quotes, invoices, support requests and bookings the business keeps in the console. Sign-in, registration and passwords stay in WordPress.

What it never does

The connector answers a fixed set of REST endpoints and nothing else. It never:

creates, reads or changes other WordPress users;
changes WordPress settings;
installs, activates or updates plugins or themes, or downloads and runs code;
creates, refunds, reprices or deletes orders;
deletes anything permanently. Content can only go to the trash, and products and variations are never deleted.

Every change is checked against the WordPress permissions of the administrator who approved the connection. The connector does not log in as that administrator or anyone else. New content is attributed to them; existing content keeps its author.

Two screens under Settings

Well Done Suite connects or disconnects the site and chooses how your customers get the customer portal.
Well Done Suite — Overview lists every REST endpoint, the data it returns and how it is protected.

Nothing is sent anywhere until an administrator clicks Connect to Well Done Suite.

External services

This plugin connects to Well Done Suite, a hosted service operated by Well Done Suite Ltd. The service is required: connecting the site to it is the plugin’s only purpose.

Pairing. When an administrator clicks Connect, the browser opens https://app.welldonesuite.com/wp-connect with the site address, a WordPress administrator return address and a random, single-use code that expires after five minutes. The administrator signs in to Well Done Suite and approves the connection. https://api.welldonesuite.com then sends a tenant identifier and a site-specific shared secret to the site’s POST /wp-json/wds/v1/pair endpoint. WordPress accepts them only when the code is valid and unused and the administrator who started pairing still has the manage_options capability.

Signed requests. After pairing, the service sends HTTPS requests to the connector’s endpoints. Each carries a current timestamp and an HMAC-SHA256 signature made with the shared secret, and every write is locked against replay. Depending on the console screen in use, the service receives:

The connector, WordPress, PHP and WooCommerce versions, and which features the site supports.
Content from public, REST-enabled post types: title, body, excerpt, status, author ID, dates and address, including drafts and private or trashed items when a signed request asks for them.
The site name, tagline, address, language, time zone, date and time format and first day of the week.
The login, display name, roles and a fixed list of permission flags of the administrator who approved the connection (no email address).
With WooCommerce active, the product catalogue (names, descriptions, SKUs, prices, stock, categories, tags, images with alt text, variations, attributes, cross-sells, upsells, bundles, SEO titles and descriptions, and addresses) and orders. Order data includes order and customer identifiers, status, totals, payment-method labels, billing name, company, email address, country, city and postcode, line items, dates, customer notes, order notes and tracking, but never payment card, bank-account or gateway credential data.

The service can also save the cookie notice settings and publish a privacy & cookies notice page (see Cookie notice below), create and update content, move content to the trash, create draft products, update product details, upload an image or PDF to the media library, and change an order’s status, add an order note or record its tracking. A product image given as a web address outside the site is downloaded by WordPress into the media library, using WordPress’s own safe download and image checks, and reused afterwards. An optional idempotency key lets the service safely retry a successful write for up to 24 hours.

Disconnecting. When the administrator clicks Disconnect, the plugin sends the tenant identifier and a signed revocation request to https://api.welldonesuite.com, then deletes the local connection credentials.

Forms. Only pages that contain the [welldosu_form slug="…"] shortcode are affected:

When such a page is shown, WordPress asks https://api.welldonesuite.com/m/{tenant identifier}/{form name}/status whether the form is switched on. Only the tenant identifier and the form name are sent. The answer is cached for five minutes.
The visitor’s browser loads the form in an iframe from https://api.welldonesuite.com/m/{tenant identifier}/{form name}, together with the address of the page the form is on so the site owner can see where a submission came from. Like any web request, this sends the visitor’s IP address and browser details to the service.
When the visitor sends the form, the answers they typed — which may include their name, email address, phone number, message, a chosen appointment time and a consent choice — are sent to Well Done Suite and stored for the site owner. The IP address is used, as a keyed hash, only to limit repeated submissions. The service emails the site owner and, if the site owner switched it on, sends the visitor a confirmation email.

Cookie notice. Off by default. Only when the business switches it on in the console under Settings Privacy:

The notice is shown to visitors who have not answered it yet. Their answer is kept in a welldosu_consent cookie in their own browser: a random identifier, the purposes they accepted and the time.
The visitor’s browser sends that random identifier, the purposes they accepted and the path of the page to this site’s POST /wp-json/welldosu/v1/consent. WordPress passes them on, with the wording the notice showed and the page address, to https://api.welldonesuite.com/v1/connector/outbox as a request signed with the shared secret, where they are kept in the business’s consent log. No name, email address or IP address is sent.
The console can publish a privacy & cookies notice page written for the business and set it as the site’s privacy policy page. A page the connector did not create is never changed.

Customer portal. Off by default. Only when an administrator chooses one of the two options under Settings Well Done Suite (the Well Done Suite customer portal, or their own My Account page connected to Well Done Suite) and the business has the portal switched on in the console:

WordPress asks https://api.welldonesuite.com/v1/p/{tenant identifier}/connector-config for the portal design, the address of the hosted portal and whether the portal is switched on. This signed request sends the My Account page address, the plugin version, whether WooCommerce is active and which of the two options was chosen. The answer is cached for five minutes. With the first option, My Account gets a menu item and one sentence linking to the hosted portal; nothing else is sent or changed.
When a signed-in customer opens My Account with the second option, their browser asks this site’s POST /wp-json/welldosu/v1/portal/handoff for a token signed with the shared secret. It contains the tenant identifier, the customer’s WordPress user ID, email address and display name, and whether this site can prove the customer reads that mailbox (they set their password through the link e-mailed to that address), and expires after two minutes; the service accepts it once. When this site cannot prove it, the portal asks the customer a quick question before it shows anything. The browser exchanges it at https://api.welldonesuite.com/v1/p/{tenant identifier}/auth/wp-handoff for a portal session and then loads that customer’s own records — shop orders (read from this site through the signed orders endpoint, narrowed to that customer), quotes, invoices, support requests and bookings — from https://api.welldonesuite.com/v1/p/…. Like any web request this sends the customer’s IP address and browser details.
Support requests and replies the customer writes in the portal, and a quote they accept there, are sent to Well Done Suite and kept for the site owner.
Customers who are not signed in see a sign-in form that posts to this site’s POST /wp-json/welldosu/v1/portal/login (WordPress’s wp_signon()), and, when WooCommerce allows registration on My Account, a registration form that posts to POST /wp-json/welldosu/v1/portal/register (WooCommerce’s wc_create_new_customer()). Neither sends anything to Well Done Suite; passwords never leave WordPress.

Google Analytics 4 tag. Off by default. Only when the business enters its GA4 measurement ID in the console and switches the tag on:

The connector’s own assets/analytics/analytics.js loads Google’s tag, https://www.googletagmanager.com/gtag/js?id={measurement ID}, in the visitor’s browser. Google then receives the pages visited and the usual browser details, including the visitor’s IP address, and sets its analytics cookies. This data goes to the business’s own Google Analytics property, not to Well Done Suite.
When the connector’s cookie notice is switched on and lists analytics, nothing is loaded until the visitor accepts analytics.
If Site Kit by Google, MonsterInsights or ExactMetrics already adds a Google tag, the connector adds nothing.
Google’s Terms of Service and Privacy Policy apply.

Apart from Google’s tag described above, which loads only while the business has switched it on, the plugin loads no remote scripts or stylesheets into WordPress. Its only front-end files are its own assets/css/mechanism.css and assets/js/mechanism-frame.js, which fits the form frame to the height the form reports, assets/analytics/analytics.js while the tag is on, and — only on My Account with the customer portal switched on — assets/portal/portal.js and assets/portal/portal.css.

The service never receives WordPress passwords or password hashes, other users’ details, payment card or bank-account data, private keys, gateway credentials or WordPress options other than those listed above.

Source code

assets/portal/portal.js and `assets/portal/portal.css` are compiled. Their complete, readable source is shipped in `assets/portal/src/`. The build bundles `assets/portal/src/portal/embed.jsx` with React 18.3.1 into one script and one stylesheet, using Vite 6.4.3 with @vitejs/plugin-react 4.3.4 in library mode with IIFE output. Every other file in the plugin is shipped as written.<h3>Credits</h3>