Secure Guest Order Access

1. 1

   Back up your WordPress database and installed plugin files. Keep the previous ZIP and test restoration before changing a live shop.

2. 2

   In the Novelience customer area, open Mes produits et licences (My products and licences). Download secure-guest-order-access-1.2.1.zip (version 1.2.1) and compare its SHA-256 with the product page: b0bfea00db45c6562d59d7b8f33cf1a670cc47072646be63debe4b95d0b81bb4.

3. 3

   In WordPress, open Plugins › Add New › Upload Plugin, select the ZIP, and activate it. For an update, choose to replace the existing plugin in place; do not uninstall the old version first.

4. 4

   Check existing settings and run the product-specific checks below on your own theme, checkout and integrations.

1. 1

   Activate WooCommerce. Activation creates the token table and a public access page with a shortcode. In WooCommerce › Guest order access, choose that page or another published, public, unprotected page containing the Guest order access block or [secure_guest_order_access]. The older [wc_guest_order] shortcode is retained.

2. 2

   Exclude the access page and its link parameters from shared caches and CDNs. Check the privacy response headers on your actual stack.

3. 3

   Create a synthetic guest order, request access with its displayed order number and checkout email, and capture the message in a local test mailbox. Test single use, expiry, explicit close and the limited summary.

Request a link for a synthetic guest order, open it once and inspect the limited summary. Then test replay, expiry, explicit close and the generic response for a nonmatching request.

• The public request response does not reveal whether an order reference and email match. An eligible match triggers a short link to the checkout mailbox.
• A hashed token is consumed atomically on first use, then a short HTTP-only session shows only products, quantities, status and totals. Billing and shipping addresses, customer notes, downloads and payment actions are omitted.
• The default link lifetime is fifteen minutes and the default session is thirty minutes. Rate limits, a honeypot and extension hooks restrict abuse; they do not prove the mailbox owner’s identity beyond email access.
• If WooCommerce is unavailable, a request cannot disclose order data and an unused link is not consumed solely because of that outage; it can still expire at its original deadline.
• A custom order number, CAPTCHA or mail template needs the corresponding plugin hooks. The access page must be publicly reachable but excluded from shared caches.