WooCommerce Overview

This content was generated with the assistance of AI and should be verified against the official documentation of each platform before being relied on in production.

This section’s bibliography lists the reference material consulted while preparing these pages.

This subsection documents how to build on WooCommerce, the e-commerce plugin for WordPress. It was written against WooCommerce 11.2.1 (published 2026-10-09) running on WordPress 7.1.3 (2026-10-06), with PHP 8.3.36 and MariaDB 11.8.9, the stack on which every command and example was run. WooCommerce 11.2.0 (2026-10-07) was a security release, and the next line, 11.3, was in beta (11.3.0-beta.1, 2026-10-26) with its final release planned for the week of 2026-11-09. Every fact was checked on 2026-10-27. The Versions, Requirements and Release Cadence page says which versions are supported, how often they ship and what each source claims about the minimum PHP, WordPress and database versions.

This page explains what WooCommerce is and how it is organised, the resources around it, the WordPress concepts that the other pages take for granted, how the pages fit together as a learning path, and then lists every page. It is the entry point of the WooCommerce subsection of the E-commerce section, which also covers Shopify, PrestaShop and Magento; a side-by-side view is on the Comparison page.

What WooCommerce is

WooCommerce is a plugin. It is not a standalone shop application: it is a folder of PHP, JavaScript and templates that WordPress loads like any other plugin, and it adds products, carts, checkout, orders, taxes, shipping, payment gateways, emails, reports and APIs to a WordPress site. The plugin is developed by Automattic and a community of contributors in the public repository github.com/woocommerce/woocommerce, it is licensed under the GPL (the readme.txt of 11.2.1 declares GPLv3), and its official distribution channel is the WordPress.org plugin directory, where it is installed with one click from wp-admin or with wp plugin install woocommerce.

The layers of a WooCommerce site: clients, extensions and themes, the WooCommerce plugin, WordPress core, and PHP with the database

The figure shows the consequence that shapes the whole subsection: everything below the WooCommerce layer is WordPress. A request is served by PHP and a web server, WordPress loads its core and then every active plugin, and WooCommerce registers its post types, tables, routes, blocks and hooks while loading. Extensions, themes and payment plugins then change WooCommerce by attaching to the same hooks. The database is shared: WordPress tables such as wp_posts, wp_options and wp_users sit next to WooCommerce tables such as wp_woocommerce_sessions, and since the High-Performance Order Storage (HPOS) feature orders live in wp_wc_orders and its sibling tables instead of in wp_posts.

That architecture has consequences that shape this subsection.

  • You extend it with hooks, not by editing it. WordPress calls it the plugin API: actions and filters that any plugin or theme can attach callbacks to. WooCommerce fires hundreds of them, and a customisation is almost always a small plugin of your own. The Hooks: Actions and Filters and Extension Development pages are the centre of the developer path.

  • WordPress releases and WooCommerce releases are separate. WooCommerce ships a minor release about every five weeks, WordPress a few times a year, and a version of WooCommerce supports a window of WordPress versions. Compatibility is a first-class concern: plugin headers, the L-1 support policy and compatibility declarations appear on several pages.

  • Operations are your job on a self-hosted store. Hosting, PHP and database versions, backups, caching, cron and security updates belong to the merchant or the agency unless a managed host takes them over. The Performance and Security page covers the production side.

  • The checkout moved from PHP templates to blocks. New stores get the Cart and Checkout blocks by default, and the PHP hooks and filters that books from the classic era use for the checkout page do not change the block. Pages that touch the checkout say which of the two they describe and give the block replacement.

  • The platform moves, and so do the books. The WooCommerce books of 2015 and 2018 describe orders stored as shop_order posts with post meta, shortcode-based cart and checkout pages, the Storefront theme with storefront_* hooks, WooThemes addresses and PHP 5. This subsection flags those approaches as legacy wherever a reader still meets them in an older store and gives the current replacement.

For market context, W3Techs reports WooCommerce on 7.8% of all websites and 47.4% of the sites whose e-commerce system it can detect (checked 2026-10-27), and Store Leads counted 4,321,090 live WooCommerce stores against a peak of 4,776,386 in the second quarter of 2024. The WordPress.org plugin page shows more than 7,000,000 active installations (the directory reports a rounded band) and 470,682,885 downloads, and the repository had 10,569 stars and 2,148 contributors. The Comparison page carries the dated figures and their sources.

The project ecosystem

WooCommerce is spread over several sites that belong together. The table lists the resources used throughout this subsection and what each is for.

WooCommerce core surrounded by the WordPress.org directory, the Woo Marketplace, WooPayments, the documentation sites and the HackerOne security programme
Resource What it is Notes

WordPress.org plugin page

The official release channel of core: version, download zip, changelog, support forum and the rounded active-installation band.

Pre-releases such as 11.3.0-beta.1 can be downloaded as zips from downloads.wordpress.org/plugin/. The directory also lists thousands of third-party plugins tagged woocommerce.

developer.woocommerce.com

The developer documentation (extensions, block development, themes, APIs, best practices, contribution and release policies), the release calendar and the developer blog.

The pages under /docs/ are generated from the docs folder of the repository; the blog posts announce every pre-release and security release.

woocommerce.com documentation

The merchant documentation: setup, server requirements, payments, shipping, extensions.

Some pages lag behind the code; the server requirements page still names WooCommerce 10.8, see the Versions page.

Woo Marketplace

The catalogue of extensions and themes sold or distributed through woocommerce.com, with vendor review.

A submission must pass the QIT managed tests and support the two latest major versions of WordPress and WooCommerce, see the Testing, Deployment and Marketplace page.

WooPayments

The official payments extension from Automattic (plugin slug woocommerce-payments, 11.2.0 on 2026-10-08).

Onboarding needs an account and cannot be run in a throw-away local store, so the Payment Gateways page documents it without executing it. Fees are published on woocommerce.com.

WordPress.org theme directory and the Storefront and Purple themes

Free themes, including block themes. Storefront 4.6.2 (2025-12-09) is the classic reference theme; Purple is a block theme for recent WooCommerce.

See the Themes page for the choice between block and classic themes.

Quality Insights Toolkit (QIT)

Managed testing service for extensions: activation, API, end-to-end, security, PHP compatibility, malware and validation tests.

Needs a Woo account; documented, not run.

HackerOne programme of Automattic

The private channel for vulnerability reports; never report a vulnerability in a public issue.

The security support policy is explained on the Versions and Performance and Security pages.

WP-CLI and the WordPress REST API

The command line and the HTTP interface of WordPress, which WooCommerce extends with wp wc commands and the wc/v3 and wc/store/v1 namespaces.

The WC-CLI and REST API pages build on them.

Community help comes from the support forums on WordPress.org, GitHub issues, hosting providers and agencies. Merchants who buy extensions or WooPayments get support from the vendor. The core plugin itself is provided without warranty, as its GPL licence states.

WordPress concepts used in this subsection

The table gives the minimum that the WooCommerce pages assume and points to the official WordPress developer handbook; the WordPress section of this site covers each concept in depth. A reader who builds WordPress sites can skip it.

Concept What it means for WooCommerce Official reference

Plugin and Plugin Name header

A plugin is a PHP file whose comment header (Plugin Name, Version, Requires at least, Requires PHP, Requires Plugins, WC requires at least, WC tested up to) tells WordPress and WooCommerce how to treat it. WordPress refuses to activate a plugin whose Requires at least or Requires PHP is not met. WooCommerce itself is one.

Plugin handbook

Hooks: actions and filters

An action runs code at a moment; a filter receives a value and returns a changed one. Both take a priority. Almost every WooCommerce customisation is a callback on a woocommerce_* hook.

Hooks

Options and post meta

get_option() and update_option() store settings as rows of wp_options; WooCommerce keeps its settings there (woocommerce_currency, woocommerce_default_country). Custom fields attach to posts as post meta, which is what products still use.

Options API

Post types and taxonomies

Products are posts of type product, product variations are product_variation, categories and tags are taxonomies (product_cat, product_tag). Orders used to be shop_order posts; with HPOS they are rows of dedicated tables.

Post types

Users, roles and capabilities

Customers are WordPress users with the customer role; shop managers have shop_manager. Code checks capabilities such as manage_woocommerce, never role names.

Roles and capabilities

Nonces

Short-lived tokens that tie a request to a user and an action. The Store API requires one (or a Cart-Token) on writes from the browser.

Nonces

WP-Cron

Pseudo-cron that runs when the site receives a visit. WooCommerce schedules its background work on Action Scheduler, which uses it as one of its runners.

Cron

The REST API and Application Passwords

WordPress serves JSON under /wp-json/. WooCommerce adds the wc/v3 namespace for administrators and the wc/store/v1 namespace for shoppers. Application Passwords give a script a revocable credential for a real user.

REST API handbook

Blocks, the block editor and the Site Editor

Pages are made of blocks stored as HTML comments in post content. WooCommerce ships product, cart, checkout and mini-cart blocks. Block themes can be edited in the Site Editor, and what is saved there is stored in the database and overrides the theme files.

Block themes

theme.json

The settings and styles file of a block theme: palette, typography, spacing, layout. It generates CSS custom properties such as --wp--preset--color--coffee.

Global settings and styles

WP-CLI

The wp command. WooCommerce adds a wp wc command group (products, orders, HPOS, tools) that runs through the REST API and needs --user.

WP-CLI commands

Abilities API

The registry of machine-readable abilities (wp_register_ability()) that AI agents and tools can discover. The WooCommerce AI and MCP page builds on it.

Abilities API

A few WordPress terms recur: mu-plugins are plugins loaded automatically from wp-content/mu-plugins, multisite is a network of sites on one installation, and a child theme inherits a parent theme’s templates. The pages that need them explain them where they first appear.

A first look at the running store

The commands below were run against the local test site (WordPress 7.1.3, WooCommerce 11.2.1, a block theme that is a child of Twenty Twenty-Five, HPOS enabled) with WP-CLI 2.12.0. They only read data.

The command line

wp core version
wp plugin get woocommerce --fields=name,version,status
wp wc hpos status
wp eval 'echo wp_is_block_theme() ? "block theme" : "classic theme";'

The outputs were 7.1.3, a table with name woocommerce, version 11.2.1 and status active, the HPOS report (HPOS enabled?: yes, Compatibility mode enabled?: no, Unsynced orders: 0) and block theme. HPOS was not on by default in a scripted install: on a fresh site installed with WP-CLI, wp wc hpos status first reported no, and wp wc hpos enable created the tables. The HPOS page shows how to check the setting and enable it.

The REST namespaces

WordPress lists every namespace its REST API serves at the root of /wp-json/. WooCommerce adds several, which is the quickest way to see which of its APIs a site exposes.

curl -s http://localhost:8081/wp-json/ | python3 -c "import json,sys; print([n for n in json.load(sys.stdin)['namespaces'] if 'wc' in n])"

The list on the test site was wc/v3, wc/v1, wc-admin, wc-analytics, wc/store, wc/store/v1, wc/private, wc/v2, wc-admin-email, wc-push-notifications, wc-telemetry and wccom-site/v3, including wc/pos/v1/catalog. wc/v3 is the administrator API authenticated with consumer keys, and wc/store/v1 is the shopper API (see the REST API and Webhooks and Store API pages). The wc/v1 and wc/v2 namespaces are older versions of the administrator API, and the Legacy REST API was removed from core in 9.0.

A plugin of your own

A customisation is a plugin. This small one, pocket-coffee-overview, is the smallest useful shape: a header that declares what it needs, and a WP-CLI command that prints the versions in play. The Versions page explains each header line.

<?php
/**
 * Plugin Name:       Pocket Coffee Overview
 * Description:       Prints the platform versions Pocket Coffee runs on.
 * Version:           0.1.0
 * Requires at least: 7.0
 * Requires PHP:      7.4
 * Requires Plugins:  woocommerce
 * License:           GPL-2.0-or-later
 * Text Domain:       pocket-coffee-overview
 */

defined( 'ABSPATH' ) || exit;

if ( defined( 'WP_CLI' ) && WP_CLI ) {
	WP_CLI::add_command(
		'pocket-coffee overview',
		function () {
			global $wp_version;
			WP_CLI::line( 'wordpress   ' . $wp_version );
			WP_CLI::line( 'woocommerce ' . ( defined( 'WC_VERSION' ) ? WC_VERSION : 'not loaded' ) );
			WP_CLI::line( 'php         ' . PHP_VERSION );
		}
	);
}

After copying the folder into wp-content/plugins and running wp plugin activate pocket-coffee-overview, the command wp pocket-coffee overview printed 7.1.3, 11.2.1 and 8.3.36 on three lines. The Requires Plugins: woocommerce line is the WordPress plugin dependency header, added in WordPress 6.5, which makes WordPress ask for the required plugin before this one can be activated.

Pocket Coffee across the subsection

All pages share one invented shop, Pocket Coffee, a small specialty-coffee seller. It has a "Single-origin beans" product with three options (origin, grind and size) giving 18 combinations and SKUs such as PC-ETH-WHL-250, a "Starter kit" product, a Coffee Club of members with 10% off beans, free shipping above 40 EUR in Spain, a flat 9.90 EUR rate for the rest of the European Union, and Spanish and English storefronts. On WooCommerce each page builds its own part.

Pocket Coffee need Built with

A running shop to develop against

WP-CLI or the browser installer, Docker, WordPress Studio or wp-env, see Installation and Local Environments

The business basics: country, currency, taxes, payments, emails

The settings tabs and the setup flow, see Store Setup and Launch

18 bean variants, categories Beans and Equipment, the filterable origin attribute

A variable product with attributes and variations, see Products and Product Types and Product Collection and Blocks

Coffee Club discount on beans

A role or user meta plus a pricing hook or coupon, see Hooks: Actions and Filters and Taxes, Coupons, Currencies and i18n

Spain and EU shipping, a weight limit per parcel

Shipping zones and methods, see Shipping Methods

Spanish and English storefronts, EUR and USD

Translations and currencies, see Taxes, Coupons, Currencies and i18n

Roast date badge on the product page

A small plugin with a product field and a hook, see Extension Development and Themes: Block and Classic

"Order placed" log

A hook on the order status transition and a background action, see Hooks: Actions and Filters and Action Scheduler

A gift-message field at checkout

The Additional Checkout Fields API, see Additional Checkout Fields and Cart and Checkout Blocks

Reading products and creating an order from outside

REST API v3, the Store API and wp wc, see REST API and Webhooks, Store API and WC-CLI

Learning path

The pages are ordered so that each depends only on earlier ones. Pick the track that matches the job, but read the foundation first.

Stage Goal Pages

1. Foundation

Know the versions and requirements, get a working store and configure the business basics

Versions, Requirements and Release Cadence, Installation and Local Environments, Store Setup and Launch

2. Architecture

Understand the plugin, its hooks, its data objects, order storage and background jobs

Architecture, Hooks: Actions and Filters, CRUD Objects and Data Stores, HPOS: High-Performance Order Storage, Action Scheduler

3. Extending

Write an extension, give it settings and admin screens, and work with products

Extension Development, Settings and Admin Pages, Products and Product Types, Product Collection and Blocks

4. Checkout, payments and fulfilment

Customise the block checkout, take payments, ship and tax orders

Cart and Checkout Blocks, Additional Checkout Fields, Store API, Payment Gateways, Shipping Methods, Taxes, Coupons, Currencies and i18n, Subscriptions, Memberships and Bookings

5. Storefront and communication

Theme the shop and its emails

Themes: Block and Classic, Emails

6. APIs and data

Integrate from outside, script the store and report on it

REST API and Webhooks, WC-CLI, Analytics

7. Production

Make it fast and safe, test it, ship it and connect agents to it

Performance and Security, Testing, Deployment and Marketplace, AI and MCP

8. Cloud deployment

Run the store on many pods: database, workers, caching, releases and the move from one server

Cloud: Deployment Overview, Cloud: Database, HPOS and Sessions, Cloud: Action Scheduler Workers on Kubernetes, Cloud: Caching, CDN and Checkout, Cloud: Releases and Database Updates, Cloud: Migrating a Store from a Single Server

Typical routes: a merchant’s technical lead reads stages 1, 4 and 7 and keeps the cheat sheet nearby; a plugin developer reads stages 1 to 3 and then testing; a theme developer reads stages 1, 2 and 5; an integrator reads stage 1 and the API pages of stage 6 together with the Store API page; a team that books paid extensions reads the subscriptions page and the Marketplace section of the testing page; a team moving to Kubernetes on AWS reads stage 1, the cloud overview and then the other cloud pages in order, after the production page of stage 7. Some knowledge outside this subsection helps: PHP and Composer (see the PHP section), React for blocks and admin screens (see the React section), Docker (see the Docker section), OAuth for the authorisation flows (see the OAuth section), Playwright for end-to-end tests (see the End-to-end testing section) and the Model Context Protocol (see the MCP section).

Subsection map

Foundation

  • Versions, Requirements and Release Cadence: the release cycle, the L-1 policy, the security backport window, the WordPress, PHP and database requirements and the PHP 8.1 minimum from 11.6.

  • Installation and Local Environments: wp-admin and WP-CLI installs, WordPress Studio, wp-env, the Playground CLI, the Beta Tester plugin and sample data.

  • Store Setup and Launch: onboarding, settings tabs, products, shipping, taxes, payments, emails, a theme and extensions, security and a launch checklist.

Architecture and data

Extending the platform

Checkout, payments and fulfilment

Storefront and communication

  • Themes: Block and Classic: block themes, theme.json, Woo block templates, template overrides and why they break.

  • Emails: WC_Email, templates and the block email editor.

APIs, tooling and data

  • REST API and Webhooks: v3 endpoints, keys and OAuth 1.0a, batch requests, webhooks and the removal of the Legacy API.

  • WC-CLI: the wp wc commands, the HPOS commands and blueprints.

  • Analytics: reports, extending columns and exports, and imports on Action Scheduler.

Production

Cloud deployment

What could and could not be run

The commands and code in this subsection were run on the local WordPress 7.1.3 and WooCommerce 11.2.1 stack. Parts that need an account or a paid service were read from the official documentation and are described in plain prose on the page concerned: the browser-based setup wizard, WooPayments onboarding, paid Woo Marketplace extensions, QIT and Marketplace submission, and the 11.3 beta, which was not installed.

References

Cloud deployment

The sources below were consulted for the cloud deployment pages; each entry links to its official website.