YMKora Signed Order Webhooks — WooCommerce Pilot

Send minimal WooCommerce order-status events to your own public HTTPS receiver. Includes HMAC-SHA256 signatures, delivery logs, up to three attempts, retry handling for network errors/429/5xx and interrupted-worker recovery. Payloads exclude customer names, emails, addresses and line items.

Delivery is OFF until you configure a receiver and a signing secret. WP-Cron requires traffic or a server scheduler. Delivery is at-least-once: the receiver must verify the raw body signature and deduplicate event IDs. A soft 500-record limit can reject new events when all existing records are pending; the dashboard exposes a failure count.

No hosted receiver, chat-service adapters, workflow builder or high-volume/financial-grade delivery guarantee. The signing secret is stored in WordPress options, not an encrypted vault.

Pilot edition 0.1.0. English interface. Requires WordPress 6.5+, PHP 8.1+ and compatible active WooCommerce. Test on staging first. One-time purchase; no auto-renewal. Includes 90 days of defect-fix support, not custom development or lifetime updates. GPL-2.0-or-later source included; no telemetry or license server.

Support: ymktchic@outlook.com. Includes 90 days of defect-fix support, not custom development or lifetime updates.

Refunds: You may request a refund within 7 days of purchase by contacting the support email with your order reference. This does not affect your statutory rights.

Testing disclosure (9 October 2026): 236 automated checks passed across SQLite and MariaDB 11.8.6 with WordPress 7.1.3, WooCommerce 11.2.0 and PHP 8.5.11. Legacy and HPOS order storage tested. Five admin screens visually checked on desktop. Payhip free checkout and bundle download verified; actual payment not tested. No universal version/theme compatibility, load testing or independent security audit. See the attached TESTING-AND-SUPPORT.txt for the current scope; it supplements older reports inside the starter ZIP. Install on staging first. Interface images show an isolated test site with synthetic records.

Brand update: YMKora 0.1.1 is a naming-only release. Existing plugin folders, shortcodes and settings identifiers are retained for compatibility. Original 0.1.0 files remain available as a legacy version; install only one version of each plugin. 236 checks refer to 0.1.0; 0.1.1 passed 40 package/syntax/bootstrap checks. See YMKORA-RELEASE-NOTES.txt. Interface screenshots show the pre-rebrand test site.