sorraia.app<\/a>.<\/p>\n\nWhy use it instead of pasting the snippet yourself?<\/strong><\/p>\n\nTwo honest reasons, and only two:<\/p>\n\n
\n- Script tags survive.<\/strong> WordPress strips
<script><\/code> on save from anyone without the unfiltered_html<\/code> capability \u2014 always the case on multisite, and common on single sites where a security plugin has removed it. The block saves cleanly and the script is simply gone. This plugin renders the snippet when the page is displayed, so WordPress never stores it and never strips it.<\/li>\n- Site-wide launchers.<\/strong> The AI chat and WhatsApp launchers float in a corner of every page. Doing that by hand means editing your theme footer, which a theme update overwrites. Here it is a checkbox.<\/li>\n<\/ol>\n\n
If you only need one form on one page and you have unfiltered_html<\/code>, a Custom HTML block works fine and you do not need this plugin.<\/p>\n\nPlacing a widget<\/strong><\/p>\n\nEvery widget gets a shortcode you can paste anywhere, and a Sorraia widget<\/strong> block for the block editor. From the settings screen you can also add a widget to several pages at once by ticking them in a list, or draft a new page containing it. Each row tells you which pages already carry that widget, so you are not guessing.<\/p>\n\nEverything the plugin writes to a page is appended<\/strong> to the end of the content. It never rewrites, reorders or removes anything already there, and it saves a revision first, so the change is undoable from WordPress's own revision history.<\/p>\n\nWhat it does not do<\/strong><\/p>\n\n\n- It does not create or edit widgets. That happens in Sorraia.<\/li>\n
- It does not read your form submissions, bookings, orders or customer details, and it cannot \u2014 the key it uses can only list one site's widget names and types and check that site's verification.<\/li>\n
- It does not add tracking, analytics or any third-party asset of its own. What the widgets themselves send and load is listed under External services.<\/li>\n<\/ul>\n\n
External services<\/h3>\n\n
This plugin connects to Sorraia<\/strong>, a hosted widget service operated by Sado Labs, Inc. The plugin cannot work without it: the widgets are built, stored and served by Sorraia, and this plugin is a client for that service.<\/p>\n\nThere are three separate kinds of request, and they are worth telling apart. Two leave your site. One arrives at it.<\/p>\n\n
1. From your server, to list your widgets and to prove you control this site<\/strong><\/p>\n\nYour site makes HTTPS requests from PHP to the Sorraia API \u2014 https:\/\/api.sorraia.app<\/code> by default. The API address in Settings \u2192 Sorraia can point at another Sorraia environment if Sorraia support asks you to, but only at a sorraia.app<\/code> address; the plugin refuses any other host. Three endpoints are called, and no others:<\/p>\n\n\nGET \/v1\/site-catalog<\/code> \u2014 the widget list. Requested when you press Connect<\/strong>; when you press Refresh<\/strong>; when the Settings \u2192 Sorraia<\/strong> screen is loaded and the five-minute cached copy has expired; and when the block editor needs the widget list to populate the block's picker.<\/li>\nGET \/v1\/site-verification<\/code> \u2014 whether Sorraia considers this site verified. Requested when you press Connect<\/strong> or Refresh<\/strong>, and when you press Verify<\/strong> \u2014 before the check, and again after it succeeds.<\/li>\nPOST \/v1\/site-verification\/attempt<\/code> \u2014 asks Sorraia to run the check now. Requested only when you press Verify<\/strong>.<\/li>\n<\/ul>\n\nWhat is sent:<\/em> your Sorraia site key, in an x-sorraia-site-key<\/code> request header; and a User-Agent string identifying the plugin version and this site's home URL (for example Sorraia-WordPress\/1.2.4; https:\/\/example.com\/<\/code>). None of the three sends page content, form submissions or anything about your visitors.<\/p>\n\nWhat comes back:<\/em> from the catalog, the connected site's name and domain, and a list of your widgets \u2014 name, type, id, and whether each is paused. From the two verification endpoints, this site's domain, whether it is verified, which method verified it, when it was checked, and this site's verification token with the instructions for publishing it \u2014 while the site is not verified, and for as long as this plugin is what verified it, because Sorraia's daily re-check needs the plugin to keep serving it. No submissions, bookings, orders or customer data are returned, and the site key cannot request them.<\/p>\n\n2. From Sorraia's servers, to your site \u2014 the one that comes inward<\/strong><\/p>\n\nWhen you press Verify<\/strong>, Sorraia's servers make an HTTPS request to your own site's URL<\/em>, from outside, looking for the verification token. They try \/?rest_route=\/sorraia\/v1\/verify<\/code> first and, if that does not answer, \/wp-admin\/admin-ajax.php?action=sorraia_verify<\/code>. While the site is verified, Sorraia repeats the same check about once a day. This plugin answers both paths with the verification token and nothing else, and it has nothing to answer with until you have connected a site key.<\/p>\n\nThis is the only request here that your site receives rather than makes, which is why it is called out separately: it comes from a third party's servers, it happens when you press Verify<\/strong> and in that daily re-check, and it will show up in your access log and in any security plugin that reports unfamiliar visitors.<\/p>\n\nThe verification token is not<\/strong> a credential. It is a random, one-per-site string whose only job is to prove that whoever controls this site also controls the Sorraia account, so it is meant to be published \u2014 that is the entire mechanism, and there is nothing about it to keep secret. The site key is the opposite: it is a credential, and it never leaves your server.<\/p>\n\n3. From your visitors' browsers, to render a widget<\/strong><\/p>\n\nWhen a page containing one of your widgets is displayed, the visitor's browser loads that widget's script from the same Sorraia host (for example https:\/\/api.sorraia.app\/api\/embed\/12.js<\/code>), and the widget then talks to Sorraia to do its job \u2014 submit a form, look up booking availability, or start a checkout. This is the same script the embed snippet from your Sorraia dashboard loads; the plugin writes the widget's container and adds that script through WordPress's script queue.<\/p>\n\nThis means your visitors' browsers contact Sorraia, and Sorraia receives whatever the widget is for \u2014 for example the contents of a form a visitor submits. Nothing is sent to Sorraia from a page that has no Sorraia widget on it.<\/p>\n\n
Along with what a visitor submits, the widgets tell Sorraia which site they are on. The AI chat (with each message) and the WhatsApp launcher (on each tap) also send the page's address and any utm_<\/code> parameters in it. If the page runs WhatConverts call tracking, the widgets also pass along WhatConverts' visitor id (its wc_client_current<\/code> cookie), so a lead is credited to the right campaign. The AI chat keeps a conversation token in the visitor's browser storage, so reloading the page continues the same chat.<\/p>\n\nBy connecting a site key you agree to Sorraia's terms and privacy policy:<\/p>\n\n
\n- Terms of Service: https:\/\/sorraia.app\/terms<\/li>\n
- Privacy Policy: https:\/\/sorraia.app\/privacy<\/li>\n
- Sub-processors: https:\/\/sorraia.app\/sub-processors<\/li>\n<\/ul>\n\n
This plugin's own code contacts no service but Sorraia, and loads no fonts, analytics or assets from anywhere else. The widgets it places are served by Sorraia, and depending on how a widget is set up, a visitor's browser may also contact:<\/p>\n\n
\n- Google Fonts<\/strong>, when a widget's font is set to one of the Google fonts Sorraia offers (currently Inter, Roboto, Open Sans, Lato and Poppins). The stylesheet comes from
fonts.googleapis.com<\/code> and the font files from fonts.gstatic.com<\/code> as soon as the widget loads, which gives Google the visitor's IP address and browser details. Any other font setting loads nothing from Google. Privacy Policy: https:\/\/policies.google.com\/privacy<\/li>\n- WhatsApp<\/strong> (Meta), only when a visitor taps the WhatsApp launcher or Continue on WhatsApp<\/strong> in the AI chat. The browser then opens
wa.me<\/code> with your business number and the pre-filled message, which can include the page's title and a reference code. Privacy Policy: https:\/\/www.whatsapp.com\/legal\/privacy-policy<\/li>\n- Stripe<\/strong>, only when a visitor buys from a shop widget. They are sent to Stripe Checkout to pay, and Stripe \u2014 not Sorraia or this site \u2014 takes the card details. Privacy Policy: https:\/\/stripe.com\/privacy<\/li>\n<\/ul>\n\n\n
\n- Install and activate the plugin.<\/li>\n
- In Sorraia, open your site's card and copy the site key (it starts with
sor_site_<\/code>). On a site you have not verified yet it is under Show verification instructions<\/strong> \u2192 WordPress plugin<\/strong>; on a verified site it is on the Embed<\/strong> card.<\/li>\n- In WordPress, go to Settings \u2192 Sorraia<\/strong>, paste the key, and press Connect.<\/li>\n
- Your widgets are listed. Use the shortcode shown next to each one, add the Sorraia widget<\/strong> block to a page, or tick pages in the list and press Add to selected pages<\/strong>.<\/li>\n
- For AI chat or WhatsApp, tick the launcher under Site-wide launchers<\/strong> and save.<\/li>\n<\/ol>\n\n\n
\nDo I need a Sorraia account?<\/h3><\/dt>\nYes. The plugin lists and embeds widgets that live in a Sorraia account; it cannot create them. There is a free plan.<\/p><\/dd>\n
Where do I find my site key?<\/h3><\/dt>\nOn your site's card in the Sorraia dashboard. It starts with sor_site_<\/code>.<\/p>\n\nWhich part of the card depends on whether the site is verified yet. If it is not, the key is a step of this verification method: press Show verification instructions<\/strong> on the site's card and pick WordPress plugin<\/strong>. Once the site is verified, it moves to the Embed<\/strong> card in the expanded site.<\/p><\/dd>\nIs the site key safe to store here?<\/h3><\/dt>\nIt is scoped to one site. It can list that site's widget names, types and ids, read whether the site is verified, and ask Sorraia to run the verification check \u2014 nothing else. It cannot read submissions, bookings, orders or customer data, and it is not an API key. It is stored in your WordPress database and only ever sent from your server to Sorraia, never to a visitor's browser. If you think it has leaked, regenerate it in Sorraia; the old one stops working immediately.<\/p><\/dd>\n
I regenerated my key and the widget list broke.<\/h3><\/dt>\nIn Settings \u2192 Sorraia, press Disconnect<\/strong>, then paste the new key and press Connect<\/strong>. The old key stops working the moment you regenerate.<\/p><\/dd>\nMy widget does not appear on the page.<\/h3><\/dt>\nThree usual causes. First, the widget is paused in Sorraia \u2014 the list on the settings screen labels it. Second, a caching or optimisation plugin deferring, delaying or rewriting the loader script. Third, a Content Security Policy on your site that does not allow scripts from api.sorraia.app<\/code>.<\/p>\n\nOn the second one: the plugin already asks WP Rocket<\/strong>, Perfmatters<\/strong> and LiteSpeed Cache<\/strong> to leave the loader alone, by registering rocket_exclude_defer_js<\/code>, rocket_delay_js_exclusions<\/code>, perfmatters_delay_js_exclusions<\/code> and litespeed_optm_js_defer_exc<\/code> and adding both api.sorraia.app\/api\/embed<\/code> and \/api\/embed\/<\/code> to each list, the second so a custom API host is covered too. Those four filters are the whole of what is automatic. Anything else \u2014 Autoptimize, W3 Total Cache, WP Fastest Cache, Cloudflare's Rocket Loader, an optimiser built into your host, or any setting in those three plugins that the four filters above do not cover \u2014 still needs the widget script URL (api.sorraia.app\/api\/embed<\/code>) added to its JavaScript exclusion list by hand.<\/p><\/dd>\nCan I put the same widget on more than one page?<\/h3><\/dt>\nYes. Tick as many pages as you like and press Add to selected pages<\/strong>. Pages that already have that widget are marked, and you can still pick them \u2014 but a second copy of the same widget on one page renders only once, because both copies use the same container id and the loader mounts into the first one. The plugin warns you before doing it.<\/p><\/dd>\nHow do I know where a widget already is?<\/h3><\/dt>\nEach widget row says so \u2014 \"On: Contact (draft), About \u00d72\", with links to edit those pages, or \"Not on any page yet.\" Site-wide launchers show whether their switch is on instead, because they appear on every page rather than on particular ones.<\/p><\/dd>\n
Does it change my existing page content?<\/h3><\/dt>\nNo. Adding a widget appends it to the end of the page and leaves everything already there untouched, and a revision is saved first, so you can undo it from WordPress's revision history.<\/p><\/dd>\n
Does it work without the block editor?<\/h3><\/dt>\nYes. Every widget has a shortcode, shown next to it in Settings \u2192 Sorraia. The block is a convenience, not a requirement.<\/p><\/dd>\n
Does it add a \"Powered by\" link to my site?<\/h3><\/dt>\nThe plugin itself adds none. On Sorraia's Free plan, the shop widget \u2014 which Sorraia serves \u2014 shows a small \"Powered by Sorraia\" link. Paid plans do not show it, and no other widget type does.<\/p><\/dd>\n
What happens if I deactivate the plugin?<\/h3><\/dt>\nYour widgets stop rendering on this site: a Sorraia block shows nothing, and a [sorraia]<\/code> shortcode shows as plain text until you remove it or reactivate the plugin. If you verified this site with the plugin, Sorraia's daily re-check stops finding the verification token, and the site becomes unverified in Sorraia until you verify it again: reactivate the plugin, press Refresh<\/strong> in Settings \u2192 Sorraia, then Verify this site<\/strong> (or add the DNS record instead). Disconnecting has the same effect on verification. Nothing else in your Sorraia account changes. Uninstalling also removes the plugin's stored settings \u2014 including the site key \u2014 from your database.<\/p><\/dd>\n\n<\/dl>\n\n\n1.2.4<\/h4>\n\n\n- Verified sites keep serving the verification token so Sorraia's daily re-check can succeed; previously a verified site was un-verified the next day.<\/li>\n
- The token is removed only when you disconnect, connect a different site key, or uninstall the plugin.<\/li>\n
- Settings \u2192 Sorraia now warns when a site this plugin verified has no token to serve, and asks you to press Refresh when Sorraia has not reported the site's verification status yet, instead of showing nothing.<\/li>\n
- The FAQ now says that deactivating or disconnecting the plugin un-verifies a site it verified, and that a regenerated key is entered by disconnecting first.<\/li>\n<\/ul>\n\n
1.2.3<\/h4>\n\n\n- \"Used on\" no longer caches page titles or edit links: each user sees only the pages they can edit, and the notices shown after Connect, Refresh and Verify are kept per user.<\/li>\n<\/ul>\n\n
1.2.2<\/h4>\n\n\n- Widget loader scripts now load through WordPress's script queue (
wp_enqueue_script<\/code>) at the end of the page, instead of being printed straight after each widget. The script addresses are unchanged, and a widget placed twice on one page now loads its script once.<\/li>\n- The Sorraia block declares block API version 3, for the iframed block editor in WordPress 7.0 and later.<\/li>\n
- The API address in Settings \u2192 Sorraia now accepts only
sorraia.app<\/code> addresses.<\/li>\n- Fixes from WordPress's Plugin Check: translations are left to WordPress's own language packs, form input is sanitised as it arrives, and uninstall no longer leaves unprefixed variables behind. The Plugins screen now lists the plugin simply as \"Sorraia\".<\/li>\n
- Corrected the settings screen's note on the \"Powered by Sorraia\" link: only shop widgets on the Free plan show it.<\/li>\n
- The readme now says what the site key can do (list this site's widgets and check its verification), when the verification status is requested, that Sorraia re-checks a verified site about once a day, and what the widgets themselves load from third parties \u2014 Google Fonts, WhatsApp and Stripe.<\/li>\n<\/ul>\n\n
1.2.1<\/h4>\n\n\n- Corrected where this plugin says to find your site key. It said \"Site \u2192 Embed\", which was only true for a site you had already verified \u2014 and 1.2.0's whole point is verifying a site you have not. Sorraia now shows the key inside the WordPress verification method itself, and this plugin's settings screen, installation steps and FAQ say so.<\/li>\n
- Text only \u2014 apart from the version number, nothing but wording changed. The plugin behaves exactly as 1.2.0 did.<\/li>\n<\/ul>\n\n
1.2.0<\/h4>\n\n\n- Site verification from the settings screen. Sorraia can now confirm you control this site by fetching a token the plugin serves, so there is no DNS record to add and no meta tag to paste into your theme.<\/li>\n
- The plugin answers that check at two public paths \u2014
\/?rest_route=\/sorraia\/v1\/verify<\/code> and \/wp-admin\/admin-ajax.php?action=sorraia_verify<\/code> \u2014 returning the verification token and nothing else.<\/li>\n- Corrected the \"my widget does not appear\" answer. It said the plugin adds no optimiser exclusions of its own; it has registered exclusions for WP Rocket, Perfmatters and LiteSpeed Cache since 1.0.0. The FAQ now names the four filters it registers, and says plainly which optimisers are still yours to configure.<\/li>\n
- External services now documents the verification traffic in both directions \u2014 the two calls this site makes, and the inbound request Sorraia's servers make to your site when you press Verify.<\/li>\n<\/ul>\n\n
1.1.0<\/h4>\n\n\n- \"Used on\" \u2014 each widget row now says which pages it is already on, counting repeats (\"About \u00d72\"), with edit links. Site-wide launchers show their switch state instead.<\/li>\n
- Add to several pages at once: the single page dropdown is now a checklist with one \"Add to selected pages\" button. Pages that already carry the widget are marked and stay selectable.<\/li>\n
- A warning before adding a widget to a page that already has it, explaining that a second copy is saved but renders once per page.<\/li>\n
- Buttons on the settings screen now use the plugin's own styling instead of borrowing WordPress's default blue.<\/li>\n
- Uninstall now also removes the placement-cache settings introduced in this version.<\/li>\n<\/ul>\n\n
1.0.0<\/h4>\n\n\n- First release. Site key connection, widget list, shortcode, block, and site-wide launchers for AI chat and WhatsApp.<\/li>\n<\/ul>","raw_excerpt":"Place the forms, booking calendars, shops, AI chat and WhatsApp launchers from your Sorraia account on this site.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/tzm.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/378841","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tzm.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/tzm.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/tzm.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=378841"}],"author":[{"embeddable":true,"href":"https:\/\/tzm.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/sorraia"}],"wp:attachment":[{"href":"https:\/\/tzm.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=378841"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/tzm.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=378841"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/tzm.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=378841"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/tzm.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=378841"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/tzm.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=378841"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/tzm.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=378841"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}