Why this is safe to put on a real store.
The parts a serious merchant, agency or CTO will ask about — answered before they ask.
Your shoppers never talk to our API
Every request goes from the browser to your WordPress site, and only then to TryVue — signed server-side. The HMAC secret lives in your database, is never sent to a browser and never printed into a page.
Every request is signed and single-use
Each plugin→API call is HMAC-signed over the method, path, timestamp, a single-use nonce and a hash of the body, with a timestamp tolerance. A captured request cannot be replayed.
Entitlements are server-authoritative and fail closed
The cached status snapshot is signed with a key derived from your license secret and your site's own salts. A hand-edited wp_options row reads back as empty and locks everything down. Even a perfect forgery generates nothing — the platform re-checks on every call.
Activation cannot be stolen
Binding a license key to a new domain requires a six-digit code emailed to the account owner. A key on its own is not proof of ownership.
The plugin tells the truth about its own state
A twice-daily heartbeat syncs plan, entitlements and credits, and reschedules itself if the event is ever removed. A revoked account deactivates the plugin with a reason; a network blip or a 5xx never punishes a paying customer.
Page caches are handled
Full-page caching happily serves an expired security token for hours. Both the try-on and the assistant detect that, fetch a fresh token from an uncacheable endpoint and retry transparently.
No SSRF, no arbitrary media
Product images sent to the AI must genuinely belong to the selected product. Studio images import only from an allow-listed TryVue host, over HTTPS, size-checked and content-verified.
Clean uninstall
Deleting the plugin purges every license credential, cached entitlement and setting from wp_options, clears its cron event and releases the domain slot. The customer credit ledger stays — it is your financial data.
HPOS compatible
High-Performance Order Storage compatibility is declared and the plugin uses the WooCommerce CRUD API throughout.
Updates that behave like the .org directory
Update notices, the native auto-updates toggle, a working “View details” changelog modal and a “Check for updates now” button. Releases are verified before they ship.
Requirements
Install, click Connect your store, map your categories, and you are live. No developer required.
Create your account- WordPress 6.0 or newer (tested to 6.7)
- WooCommerce 7.0 or newer (tested to 9.4)
- PHP 7.4 or newer
- WooCommerce required — TryVue reads products, categories, variations and stock
- HPOS (High-Performance Order Storage) compatible
- Works with full-page caching
- Works with variable products, custom and global attributes
- Translation-ready; the assistant answers in the shopper's own language
- Brand resolution supports common WooCommerce brand plugins, with a Brand/Marca attribute fallback