WooCommerce Integration Guide

This guide connects a WooCommerce store to Tajo. The integration has two halves that work together:

• Tajo for WooCommerce plugin — captures real-time engagement events (orders, carts, refunds, reviews, form submissions) inside WordPress and delivers them to Tajo through a durable, signed outbox.
• WooCommerce REST connection — Tajo reads your store’s customers, orders, products, coupons, refunds, and reviews for historical import and ongoing sync. See the WooCommerce connector reference for the REST-only setup.

Marketing automation itself (email, SMS, WhatsApp via Brevo and other providers) is configured in Tajo, not in the plugin. The plugin’s job is to get trustworthy events out of WordPress.

Prerequisites

• WordPress 6.3+ with admin access
• PHP 7.4+
• WooCommerce 7.0+ (the plugin also works on WordPress sites without WooCommerce — commerce adapters simply stay inactive)
• Tajo account with a WordPress connection created
• HTTPS on the Tajo endpoint (always true for hosted Tajo)

Step 1: Install the Tajo for WooCommerce plugin

Manual installation

# Download the plugin
cd wp-content/plugins
wget https://tajo.io/downloads/woocommerce/tajo-woocommerce-latest.zip

# Verify and unzip
unzip tajo-woocommerce-latest.zip

Then activate from WordPress admin:

1. Go to Plugins → Installed Plugins
2. Find “Tajo for WooCommerce”
3. Click Activate

You can also upload the zip directly via Plugins → Add New → Upload Plugin. A SHA-256 checksum is published alongside each release at tajo.io/downloads/woocommerce/. The plugin is not yet listed in the WordPress.org directory; manual installation is the supported path today.

Step 2: Configure the connection

Navigate to WooCommerce → Tajo (on sites without WooCommerce: Settings → Tajo) and enter the three values from your Tajo WordPress connection:

There are no API-key constants to add to wp-config.php. Events remain safely queued in the local outbox until all three values are saved.

Then verify the pipe end to end:

1. Click Queue test event, then Process now.
2. The delivery outbox table should show the event as delivered.
3. In Tajo, confirm the connection.test event arrived on the WordPress connection.

What the plugin sends

Every event is a compact, privacy-minimized envelope signed with HMAC-SHA256. Only engagement identity fields (email, phone, local IDs) plus bounded event metadata leave WordPress — never names, postal addresses, IP addresses, user agents, comment bodies, arbitrary form fields, order notes, or payment details.

WooCommerce events

Order events carry the order number, status, currency, totals, line items, and ready-to-use review/reorder URLs — enough for post-purchase and win-back automations without a follow-up API call.

WordPress events

• contact.created / contact.updated / contact.deleted for user accounts
• content.published / content.updated / content.unpublished for public content
• comment.created / comment.status_changed for visitor comments and product reviews (internal WooCommerce order notes, pingbacks, and trackbacks are never emitted)
• form.submitted for successful Contact Form 7, WPForms, Gravity Forms, and Fluent Forms submissions — only typed email/phone identity fields and form metadata are extracted; arbitrary submitted fields are discarded

Reliability: the delivery outbox

The plugin never fires events at Tajo directly from a page load. Every event is written to a local outbox table first, then delivered by WP-Cron with:

• Bounded exponential backoff (up to 8 attempts, honoring Retry-After)
• Dead letters with one-click Replay dead letters in the admin
• Retention limits so an unreachable endpoint can never hoard personal data (delivered: 7 days; queued: 30 days; dead letters: 30 days after last update)
• Idempotent event IDs, so retries and replays never duplicate downstream

If your host disables WP-Cron (DISABLE_WP_CRON), invoke wp-cron.php from a real scheduler at least once per minute.

Consent is never inferred

Account creation, checkout, purchase, and generic form submissions are not treated as marketing consent. Built-in events carry an empty consent list. To record explicit consent (for example from a checked newsletter box), emit it through the extension hook:

do_action(
    'tajo_engagement_emit',
    'consent.updated',
    array( 'email' => $email ),
    array( 'policyVersion' => '2026-07' ),
    array(
        array(
            'channel'  => 'email',
            'status'   => 'opt_in',        // or 'opt_out'
            'purpose'  => 'marketing',
            'source'   => 'newsletter_checkbox',
            'evidence' => array( 'formId' => 'newsletter-footer', 'field' => 'marketing_email' ),
        ),
    ),
    gmdate( 'c' )
);

The same hook lets any plugin or theme emit custom events; everything passes through the same sanitizer, outbox, and signature.

Step 3: Historical import

Real-time events cover everything from installation onward. For the history that predates the plugin, Tajo’s WooCommerce REST connection imports existing customers, orders, products, coupons, refunds, and reviews — configured entirely on the Tajo side with a WooCommerce REST API key (WooCommerce → Settings → Advanced → REST API, read permission). See the WooCommerce connector reference for details.

Privacy and GDPR

• The plugin registers with WordPress Tools → Export Personal Data and Tools → Erase Personal Data; retained outbox events for a matching email are exported or erased locally.
• Erasure and delivery share a fail-closed mutex, so an erasure can never report completion while a payload is mid-send.
• Local erasure covers the WordPress outbox only — submit the corresponding request in Tajo for downstream data.
• Deactivation pauses delivery but keeps configuration and queued events; deleting the plugin permanently removes the outbox, settings, secret, and schedules.

Compatibility

• HPOS: the plugin declares WooCommerce High-Performance Order Storage compatibility and uses only CRUD objects and public hooks.
• WooCommerce Subscriptions: subscription status changes are captured when the extension is active.
• Multisite: uninstall cleans up every site in the network.

Operations reference

Server-to-server discovery and outbox control are available to administrators via Application Password authentication:

Troubleshooting

Next steps

• WooCommerce connector reference — REST sync, webhook signature details, config keys
• Customer sync — mapping WooCommerce customers into your system of record
• Configure abandoned-cart, post-purchase, and win-back automations in Tajo using cart.updated, order.placed, and order.fulfilled events