{"id":11572,"date":"2026-06-29T16:06:43","date_gmt":"2026-06-29T08:06:43","guid":{"rendered":"https:\/\/aeosub.com\/wwu-withdrawal-button\/"},"modified":"2026-06-29T16:06:43","modified_gmt":"2026-06-29T08:06:43","slug":"wwu-withdrawal-button","status":"publish","type":"post","link":"https:\/\/aeosub.com\/zh\/wwu-withdrawal-button\/","title":{"rendered":"WWU Right of Withdrawal for Popular Ecommerce Platforms"},"content":{"rendered":"
\"WWU<\/div>\n
\n
LethaldiranMX Insight<\/div>\n
\n
\n

This plugin addresses a critical regulatory deadline for EU-facing e-commerce operations by automating compliance with the upcoming June 2026 consumer withdrawal mandate under Directive (EU) 2023\/2673. By integrating a standardized, two-step withdrawal flow directly into WooCommerce, FluentCart, and Easy Digital Downloads, it eliminates the operational friction of manual contract cancellations. The implementation of a tamper-evident, hash-chained log and durable-medium receipts provides store owners with robust, legally defensible audit trails. For digital operations managers, this is a proactive compliance asset that seamlessly bridges the gap between legal requirements and technical execution.<\/p>\n

Best Fit & Operational Role:<\/strong> This plugin is a critical addition for any WordPress-based e-commerce store selling to consumers within the European Union, particularly those operating under strict jurisdictions like Italy’s Codice del Consumo. It acts as a specialized compliance layer in the WordPress stack, integrating directly with existing checkout and customer account structures to handle guest lookups, partial refunds, and multi-language routing. It is best suited for merchants seeking a set-and-forget solution to statutory consumer rights without having to custom-engineer secure logging mechanisms or PDF generation workflows.<\/p>\n

Potential Limitations & Pitfalls:<\/strong> Operational overhead may arise from managing the storage of generated PDF receipts and maintaining the integrity of the hash-chained logs during database migrations or staging-to-production syncs. Additionally, store owners must ensure their transactional email infrastructure is highly reliable, as the delivery of the durable-medium receipt is a key legal requirement. No other technical limitations or security risks were identified based on the available information.<\/p>\n<\/div>\n<\/div><\/div>\n

\n
\n \"WWU <\/p>\n
\n
Plugin Specification<\/div>\n

WordPress.org Official Data<\/small>\n <\/div>\n<\/p><\/div>\n\n\n\n\n\n\n\n
Developer<\/th>\nEdoardo G.<\/a><\/td>\n<\/tr>\n
Version<\/th>\nv1.3.2<\/td>\n<\/tr>\n
Active Installs<\/th>\n0 +<\/td>\n<\/tr>\n
Requires \/ Tested<\/th>\n5.8 \/ 7.0<\/td>\n<\/tr>\n
Last Updated<\/th>\n2026-06-29 8:05am GMT<\/td>\n<\/tr>\n
Official Link<\/th>\nView Details -><\/a><\/td>\n<\/tr>\n<\/table><\/div>\n
EU statutory withdrawal button (Art. 11a) for WooCommerce, FluentCart & EDD: two-step flow, durable-medium receipt, tamper-evident log.<\/div>\n

Product page & documentation: https:\/\/webwakeup.it\/wwu-withdrawal-button\/<\/p>\n

From 19 June 2026, EU law (Directive (EU) 2023\/2673, new Art. 11a of the Consumer Rights Directive; Italy: Art. 54-bis Codice del Consumo) requires online stores to provide a withdrawal function<\/strong> that lets consumers withdraw from a distance contract as easily as they concluded it. WWU Withdrawal Button adds that function \u2014 and everything around it you need to run it and to prove you did it right \u2014 to WooCommerce, FluentCart and Easy Digital Downloads.<\/p>\n

How it works (in plain terms)<\/h4>\n
    \n
  1. An eligible customer opens their order and clicks the statutory “Withdraw from contract here”<\/strong> button \u2014 in their account, from a link in the order e-mail, or on a public page (no account needed: they look the order up with its number + e-mail).<\/li>\n
  2. A simple two-step form<\/strong> appears: they review what they are withdrawing from (optionally ticking only some items \u2014 partial withdrawal is allowed), then confirm. No reason required, no hoops.<\/li>\n
  3. The instant they confirm, the customer receives an acknowledgement of receipt on a durable medium<\/strong> \u2014 an e-mail, a PDF copy and a permanent verifiable link \u2014 showing exactly what was withdrawn and the precise date and time. The order is flagged “withdrawal requested”.<\/li>\n
  4. Every step is written to a tamper-evident, append-only log<\/strong> (hash-chained and timestamped) so you can prove what happened and when. You then handle the refund as usual \u2014 the plugin records that too.<\/li>\n<\/ol>\n

    That is the whole customer experience. Everything below exists to make it correct, easy to run, and defensible.<\/p>\n

    For your customers<\/h4>\n
      \n
    • A prominently displayed, legible button with the exact statutory wording per language<\/strong> (IT, EN, DE, FR, ES, SV \u2014 extensible).<\/li>\n
    • The button appears where customers actually look: the account area<\/strong> (order list, order detail, a dedicated “Right of withdrawal” tab), a link inside order e-mails<\/strong>, a public self-service page<\/strong> with guest lookup, and anywhere via shortcodes<\/strong> or the Gutenberg block<\/strong>.<\/li>\n
    • A short, reassuring step-by-step guide<\/strong> during the flow (timing, refund, returns); the wording and the withdrawal window (\u226514 days \u2014 you may grant more) are editable.<\/li>\n
    • When an order is genuinely exempt, a clear “why is the button not here” note<\/strong> explains the specific legal exception, instead of leaving the customer confused.<\/li>\n
    • A human-readable verification certificate<\/strong> for the receipt (integrity, order, date, hash) \u2014 not raw code.<\/li>\n<\/ul>\n

      For you (the merchant)<\/h4>\n
        \n
      • An onboarding Dashboard<\/strong> with a setup checklist (one-click fixes), a plain “how it works” walkthrough, and a “where the button appears \/ why it might not” explainer.<\/li>\n
      • A one-click e-mail delivery test<\/strong> that detects your SMTP plugin and proves the receipt actually reaches the inbox \u2014 the #1 cause of “nothing happened”.<\/li>\n
      • A Requests dashboard<\/strong> to manage every withdrawal: status (open \/ processed \/ refunded), a chain-integrity badge, and one-click mark processed<\/strong>, resend receipt<\/strong> and open the order to refund<\/strong> (the refund is logged as proof you met the 14 days). Subscription and partial-withdrawal requests are flagged.<\/li>\n
      • A Compliance page<\/strong>: a go-live countdown, the statutory labels in use, the document checklist with ready-to-paste clauses, and environment warnings (Complianz \/ cache \/ multilingual) to fix.<\/li>\n
      • Receipts are real WooCommerce e-mails<\/strong> (your logo, colours, header) with a preview. The withdrawal button and form inherit your theme’s typography and colour presets<\/strong> out of the box, so they blend in automatically; for finer control, restyle every part from Appearance \u2192<\/span> Customize \u2192<\/span> Additional CSS<\/strong> (built into WordPress), targeting the plugin’s documented CSS variables and classes.<\/li>\n<\/ul>\n

        Smart legal handling (so you don’t have to think about it)<\/h4>\n
          \n
        • Subscriptions<\/strong> \u2014 the law gives one 14-day right per contract, so the button shows on the initial order only<\/strong> and is hidden on renewals (WooCommerce Subscriptions, FluentCart, EDD Recurring). Fail-safe, with opt-in overrides.<\/li>\n
        • Partial withdrawal<\/strong> \u2014 customers can withdraw from only some items of an order.<\/li>\n
        • Art. 59 exemptions<\/strong> \u2014 tag products or categories by the specific statutory reason (events on a fixed date, digital content with immediate access, a service fully performed\u2026). For the conditional reasons the plugin captures the customer’s express consent at checkout<\/strong> (WooCommerce classic + block, FluentCart, EDD), stores it as evidence, sends the required durable-medium confirmation, and only then hides the button. Physical products always keep the right<\/strong> \u2014 never hidden by mistake.<\/li>\n
        • Applicability by country<\/strong> \u2014 EU\/EEA consumers only (default) or always; B2B (VAT) orders can be treated as out of scope.<\/li>\n<\/ul>\n

          Evidence, timestamps & integrity<\/h4>\n
            \n
          • The immutable log is append-only and hash-chained<\/strong> (HMAC-keyed with your site secret), so tampering is detectable.<\/li>\n
          • Recommended<\/strong> trusted timestamping (off by default \u2014 one click to enable): free, independently-verifiable OpenTimestamps<\/strong> (Bitcoin) anchoring, or a qualified eIDAS RFC 3161<\/strong> timestamp (a free Sectigo endpoint, or your national authority \u2014 Aruba, InfoCert, D-Trust, Universign, FNMT, SwissSign), for an independent “data certa”<\/strong> of when each withdrawal was received. The hash chain is the baseline evidence on its own; once you enable a provider, failed stamps retry automatically and any not-yet-anchored records are surfaced in the admin. (It is off by default only because WordPress.org requires external calls to be opt-in \u2014 the plugin prompts you to switch it on.)<\/li>\n<\/ul>\n

            Privacy & GDPR<\/h4>\n
              \n
            • The log commits to an anonymised IP<\/strong>; the full IP lives separately and is erased after a configurable retention<\/strong> (10 years by default).<\/li>\n
            • A Consent records<\/strong> screen lists and exports the exemption consents (CSV). Two ready-to-paste privacy clauses are generated (withdrawal log + exemption-consent), on a legitimate-interest basis. The uninstaller keeps the evidence log by default (legal hold) unless you opt to erase it.<\/li>\n<\/ul>\n

              Documents & compliance<\/h4>\n
                \n
              • Generates the Annex I-B model withdrawal form<\/strong> and ready clauses for pre-contractual information, Terms & Conditions and Privacy<\/strong> \u2014 and reminds you, clearly, that installing the button is not enough<\/strong>: your Terms and pre-contractual withdrawal article must be updated to describe the new button modality (the plugin gives you the exact text to paste).<\/li>\n
              • A single consolidated “Right of withdrawal” notice<\/strong>, assembled live from your settings and the Art. 59 exceptions you selected, published three ways: the [webwakeupwdb_policy]<\/code> shortcode<\/strong>, an auto-created page<\/strong> (one click to recreate it if you delete it) or a downloadable PDF<\/strong> \u2014 all managed from Compliance \u2192<\/span> “Informativa sul diritto di recesso”<\/strong> (preview \/ create \/ open \/ freeze<\/strong> to static HTML \/ download). Optionally, two opt-in toggles append the same clauses to your Complianz<\/strong> Privacy Policy and Terms & Conditions (EU-only, off by default, with a live preview). It complements \u2014 it does not<\/strong> replace \u2014 your own legal texts.<\/li>\n<\/ul>\n

                Integrations & automation<\/h4>\n
                  \n
                • A read-only REST API<\/strong> (authenticated with a standard Application Password) to list requests and check an order’s withdrawal status, plus an optional signed webhook<\/strong> (HMAC-SHA256) fired the moment a withdrawal is confirmed \u2014 for Zapier, Make, n8n, a CRM or a helpdesk. Privacy-first: the consumer’s IP is never exposed. 33 documented hooks\/filters<\/strong> for developers.<\/li>\n
                • Plays nicely with Complianz<\/strong>, TranslatePress<\/strong> and page-cache plugins (WP Rocket \/ LiteSpeed \/ W3TC).<\/li>\n<\/ul>\n

                  Platforms & licence<\/h4>\n
                    \n
                  • WooCommerce (HPOS + legacy), FluentCart and Easy Digital Downloads (3.0+)<\/strong> through a common adapter \u2014 one plugin for all three. On FluentCart it can step aside automatically if FluentCart ships its own native withdrawal add-on, so customers never see two buttons.<\/li>\n
                  • Free and open source<\/strong> (GPLv3) \u2014 no upsell, no tracking, no remote scripts or fonts loaded on your site. Passed a full multi-dimension security audit (0 critical \/ 0 high).<\/li>\n<\/ul>\n

                    This plugin is a technical aid to compliance and is not legal advice<\/strong>. Have your own counsel review your store’s documents.<\/p>\n

                    External services<\/h3>\n

                    This plugin makes no external calls by default<\/strong>. Every outbound connection listed below is opt-in<\/strong> and stays off<\/strong> until you explicitly enable it in the settings. The tamper-evident log works fully offline \u2014 it is append-only and hash-chained with your site secret \u2014 so timestamping only adds<\/em> an extra, independently-verifiable anchor; it is never required for the plugin to function.<\/p>\n

                    OpenTimestamps<\/strong> (opt-in, off by default) \u2014 only if you set the timestamp provider to “OpenTimestamps” (Settings \u2192<\/span> Receipt & evidence) does the plugin connect to the OpenTimestamps public calendar servers to obtain a free, trusted timestamp (a “data certa”) for the log.<\/p>\n

                      \n
                    • What is sent:<\/strong> only a SHA-256 hash (a one-way digest) of the immutable-log record, plus a random privacy nonce. No personal data, order content, names, emails or IP addresses are ever sent \u2014 only an opaque hash that cannot be reversed.<\/li>\n
                    • When:<\/strong> only while the provider is enabled \u2014 once when a withdrawal is confirmed (to submit the hash) and periodically via WP-Cron (to retrieve the Bitcoin-anchored proof). Nothing is ever sent while the provider is “None” (the default).<\/li>\n
                    • Where:<\/strong> the OpenTimestamps public calendars (a.pool.opentimestamps.org, b.pool.opentimestamps.org, a.pool.eternitywall.com, ots.btc.catallaxy.com).<\/li>\n
                    • Service info \/ privacy:<\/strong> https:\/\/opentimestamps.org\/<\/li>\n<\/ul>\n

                      RFC 3161 \/ eIDAS timestamp authority<\/strong> (opt-in, off by default) \u2014 if you instead set the provider to an RFC 3161 authority, the same one-way SHA-256 hash (no personal data) is sent to the authority URL you<\/strong> configure. This is a provider you choose and contract with directly (examples: a free Sectigo endpoint, or a national authority such as Aruba, InfoCert, D-Trust, Universign, FNMT, SwissSign); please review that provider’s own terms of service and privacy policy. No such call is made until you enable it.<\/p>\n

                      Outbound webhook<\/strong> (opt-in, off by default \u2014 Settings \u2192<\/span> Integrations) \u2014 if enabled, the plugin sends a signed POST to the endpoint URL you<\/strong> specify whenever a withdrawal is confirmed. The payload carries a verification hash and contract reference, never the consumer’s IP address.<\/p>\n

                      No other external services are used. The plugin does not load remote scripts, fonts or trackers on your site.<\/p>\n

                      Privacy<\/h3>\n

                      The plugin records withdrawal declarations (name, identified contract, email, IP address, date and time) in an append-only, tamper-evident log on your own server<\/strong>, because Art. 54-bis requires this as legal evidence (GDPR Art. 6(1)(c)\/(f)). It generates a ready-to-paste privacy clause for your policy. Data is retained for a configurable period (10 years by default), and the uninstaller keeps the evidence log by default (legal hold) unless you opt to erase it.<\/p>\n

                      For the conditional Art. 59 exemptions, the plugin also stores the consumer’s checkout consent + acknowledgement (the agreed wording, a hash, the date\/time and \u2014 unless you turn it off \u2014 the IP) as evidence to prove the exemption is valid. The lawful basis is legitimate interest<\/strong> (GDPR Art. 6(1)(f); defence of legal claims), not<\/strong> GDPR consent. The IP lives only on the order (never in the immutable log) and is automatically anonymised once the retention period lapses. A second ready-to-paste privacy clause is generated for this processing.<\/p>\n

                      Editorial note: This overview combines WordPress.org official plugin metadata with an AI-assisted LethaldiranMX editorial review. Plugin data should be verified on the official WordPress.org listing before installation.<\/div>\n","protected":false},"excerpt":{"rendered":"

                      EU statutory withdrawal button (Art. 11a) for WooCommerce, FluentCart & EDD: two-step flow, durable-medium receipt, tamper-evident log.<\/p>","protected":false},"author":1,"featured_media":11573,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[252],"tags":[1420,590,2821,1053,569,555],"class_list":["post-11572","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-trends","tag-fluentcart","tag-gdpr","tag-recesso","tag-right-of-withdrawal","tag-woocommerce","tag-wordpress-plugin"],"_links":{"self":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/11572","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/comments?post=11572"}],"version-history":[{"count":0,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/11572\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media\/11573"}],"wp:attachment":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media?parent=11572"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/categories?post=11572"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/tags?post=11572"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}