Holostep: 3D viewer

Holostep shows your products as 3D models, in augmented reality and as configurators that shoppers can build themselves. This plugin connects your WordPress site or WooCommerce shop to your Holostep account and loads the Holostep viewer on your pages.

You need a Holostep account. You can create one while connecting. The 3D models and configurators are made and managed in the Holostep app: app.holostep.io.

What the plugin does

• Connects with one button. Open WooCommerce > Holostep (Settings > Holostep without WooCommerce) and click “Connect to Holostep”. You log in to Holostep, confirm the shop, return and finish. There is no account ID to look up and no code to paste.
• Tells you whether it works. A status panel shows the connected account, whether Holostep can reach your site, and whether the 3D script was seen on your shop from outside.
• Looks after caches. When you connect, switch account or disconnect, the plugin clears the page cache of WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, WP Fastest Cache, SiteGround Speed Optimizer, Cache Enabler, Hummingbird, Breeze, Nginx Helper and WP-Optimize, and it keeps script optimisers away from the Holostep loader.
• Gives Holostep access to your products, if you want. “Connect WooCommerce” in the status panel lets Holostep read and update your products and orders through WooCommerce’s REST API. You approve it on WooCommerce’s own screen and can revoke it at any time.
• Keeps configurations with the order. When a shopper adds a configured product to the WooCommerce cart, the configuration (in words, with a link that reopens it) stays on the cart line, the order, the order emails and the admin order screen.
• Disconnects cleanly. “Disconnect” removes the account from this site, tells Holostep, and deletes the WooCommerce API key if you gave one to Holostep.

Who can do what

Seeing the Holostep page and its status needs the “manage WooCommerce” capability (administrators on a site without WooCommerce). Connecting, connecting WooCommerce, switching account, disconnecting, entering an account ID by hand, clearing the cache and changing the update setting need an administrator.

Third-Party Services

This plugin connects your site to Holostep (holostep.io). It cannot work without it. Below is every address that is called, when, and what is sent.

• Terms: https://www.holostep.io/terms-and-conditions
• Privacy policy: https://www.holostep.io/privacy-policy

1. Calls from your site’s server to the Holostep API

They are made only when an administrator clicks a button on the Holostep page, and once after an update of the plugin on a connected shop. No call is made on ordinary page loads.

• https://api.holostep.io/api/v1/app/wordpress/connect/start (on “Connect to Holostep”, “Switch account”, “Try again”): your site’s address, the plugin’s version, a one-time code and the hash of a second one-time value.
• https://api.holostep.io/api/v1/app/wordpress/connect/complete (when you return from Holostep): your site’s address, the one-time code, and the signed approval Holostep’s app gave your browser. Holostep answers with the account’s ID, name and email, which the plugin stores and shows you.
• https://api.holostep.io/api/v1/app/wordpress/status (after connecting, on “Test connection”, “Only verify the ID”, “Check and save”, and once after an update): your site’s address, the account ID and a one-time code. After connecting, on “Test connection” and after an update, Holostep also loads your shop’s home page from its own servers, to see whether its script runs there.
• https://api.holostep.io/api/v1/app/wordpress/site-check (on “Check and save” and “Only verify the ID”, when Holostep cannot reach your site): the account ID and your site’s host name.
• https://api.holostep.io/api/v1/app/wordpress/disconnect (on “Disconnect”, and when another account takes the shop over): your site’s address, the account ID and a one-time code.
• https://api.holostep.io/api/v1/app/woocommerce/connect/start (on “Connect WooCommerce” in the status panel): the account ID, your site’s address and a one-time code. After your approval on WooCommerce’s own screen, WooCommerce sends the new REST API key directly to https://api.holostep.io/api/v1/app/woocommerce/connect/callback.

To check that a request really comes from your site, Holostep calls your site back once per request at /?rest_route=/holostep/v1/connect-proof with the one-time code. That route answers only a code your site created moments before, once, and changes nothing.

2. Your browser, when you connect

“Connect to Holostep” sends your browser to https://app.holostep.io/connect/wordpress, where you log in and approve. The address carries a signed request made for your site and a one-time value that stays in your browser.

3. Your visitors’ browsers, while the shop is connected

Every page of your site loads the Holostep script. It is not loaded in wp-admin or on the login page, and not at all while no account is connected.

• https://onsite.holostep.io/serve/ (every page): the loader core-init.js, the script core.js and the files they need. The request carries your Holostep account ID. The same files may also be requested from the older address https://onsite-scripter.holostep.io/serve/, for example by pages your cache saved before version 2.0.2.
• https://cdn-layers.holostep.io/ (every page): your account’s published settings for this site. The request carries your account ID and your site’s host name.
• https://onsite-backend.holostep.io/api/v1/analytics (every page): a page view on every page, and events when a visitor uses the viewer or adds a configured product to the cart. Each event carries a random visitor ID, a random session ID, your account ID, your site’s host name and the time. If your site reports purchases to Google Analytics 4 through dataLayer, the script also sends each purchase’s order ID, total, currency, discount code, and the IDs and names of its items. When the viewer fails, an error report with the page address, browser and device details is sent to https://onsite-backend.holostep.io/api/v1/analytics/error.
• https://cdn.holostep.io/ and https://cdn-assets.holostep.io/ (pages that show 3D content): the 3D models, textures and styles.
• Google (pages that show 3D content): decoder files from https://www.gstatic.com/ and the Poppins font from https://fonts.googleapis.com/ and https://fonts.gstatic.com/. Google receives the visitor’s IP address and browser details, as with any file request. Google’s privacy policy, Google’s terms.
• Only if you switch them on in your Holostep account: Meta Pixel (https://connect.facebook.net/), Google Ads (https://www.googletagmanager.com/) and Segment (https://cdn.segment.com/) receive the viewer’s events. They are off unless you enable them in Holostep.

The script stores a random visitor ID in a first-party cookie named holoClientId for one year, and a random session ID in the browser’s session storage (holoSession). It does this for every visitor and does not check for consent. Asking visitors for consent, where your shop needs it, is done with your own consent tool.