Inclusive Forge – Accessibility Statement for WooCommerce

Inclusive Forge audits European online stores against WCAG 2.1 AA and EN 301 549, records what was found and what was fixed, and publishes an accessibility statement from that record. The audit, the evidence log and the statement live in your Inclusive Forge account. This plugin is the small piece that has to run on your site. It requires an Inclusive Forge account, works on any WordPress site and is built for WooCommerce stores.

What the plugin does:

1. Proves you own the site. It adds a <meta name="inclusiveforge-verify" content="…"> tag to your <head>. Our scanner reads that tag before it audits anything, so a site is never scanned on the word of whoever filled in a form.
2. Publishes your accessibility statement. The [inclusiveforge_statement] shortcode and the matching block render the statement you published in Inclusive Forge. English, German and French are available. The document is fetched over HTTPS and cached locally for 12 hours; the request times out after five seconds.
3. Shows your last scan in wp-admin. A “Last scan” card on the settings screen and a dashboard widget show the score, open and closed findings and the date, filled in automatically when a scan finishes.
4. Lets you ask for a re-test. The “Re-test now” button asks Inclusive Forge to scan the site again. Your account’s monthly allowance is enforced by Inclusive Forge, and the button tells you how many re-tests you have left.
5. Checks that verification really works. The settings screen fetches your own home page and confirms the verification tag is there, and it lists known cache and optimisation plugins that sometimes strip it.

What this plugin deliberately does not do

• No overlay. It never modifies, re-labels or “corrects” your pages in the browser. Real fixes belong in your theme and templates, and Inclusive Forge reports them there.
• No JavaScript and no CSS on your storefront. The statement is plain server-rendered HTML that inherits your theme. The only JavaScript in this plugin runs in the block editor.
• No scanning from inside your site. Nothing crawls your pages from your own server, and no background job competes with your store.
• No tracking and no analytics.

Honest scope

An automated scan detects a portion of WCAG 2.1 AA issues, not all of them, and no plugin can make a website accessible on its own. Inclusive Forge offers a documented process (scan, fix, re-test, evidence log, statement), not a compliance guarantee. This plugin and the Inclusive Forge service do not provide legal advice; talk to a qualified adviser about your obligations.

For developers

The plugin fires an inclusiveforge/scan_completed action every time a signed scan-completed notice is verified and stored, with the score, the finding counts, the finish date and the report URL.

Documentation: https://inclusiveforge.com/docs/

External services

This plugin connects to one third-party service. It is not optional: without it there is no statement to render and no store to connect.

• Inclusive Forge (https://inclusiveforge.com, run by Avakode) — hosts your accessibility statement, verifies site ownership, and runs the scans this plugin reports on. The plugin talks to its API at https://app.inclusiveforge.com: GET /public/statement/{site token}?locale=… for the statement and POST /public/rescan/{site token} for a re-test.
  • What is sent: your Inclusive Forge site token (in the request path) and your site address (in the User-Agent header of the request). When a webhook secret is saved, the statement request also carries an X-Inclusiveforge-Signature header: a signature over the text statement: plus your site token, with a timestamp and a one-time value, made with your webhook secret; the secret itself never leaves your site. When you press “Re-test now”, a signed, empty request authenticated with your webhook secret asking the scan to be run again. Nothing else — no post content, no order data, no customer data, no visitor IP addresses, no administrator details.
  • When it is sent: only once a site token is saved; with none, the plugin sends nothing. Then: when a page containing the shortcode or block is rendered, or the plugin’s settings screen is opened, and the cached statement is missing or older than 12 hours; when a failed request is retried (at most once every 15 minutes); when you press “Refresh statement cache”; and when you press “Re-test now”. Pages without the shortcode or block send nothing.
  • What comes back: the HTML of your published accessibility statement, or an error saying the site is unknown or not verified yet; a re-test request answers with an accepted scan or a named reason it was refused, including your remaining monthly allowance.
  • What this address sends back to your site, unprompted: when a scan it ran finishes, it calls your site’s own REST API (/wp-json/inclusiveforge/v1/scan-completed) with the score, the open/closed finding counts, the date, and a link back to the full report. This plugin verifies a cryptographic signature on that request, using the same webhook secret, before storing anything from it — an unsigned or incorrectly signed request is rejected and changes nothing on your site.
  • The link visitors may see: when your site token is fine but the plugin could not fetch the statement (a timeout, for example), visitors see a plain link, “View our accessibility statement”, to https://inclusiveforge.com/<language>/a11y/<site token>, the same statement on Inclusive Forge’s own site. The plugin sends nothing there; a visitor’s browser contacts inclusiveforge.com only if the visitor follows the link.
  • The endpoint address can be overridden for staging by defining INCLUSIVEFORGE_API_BASE in wp-config.php.
  • Terms: https://inclusiveforge.com/terms — Privacy: https://inclusiveforge.com/privacy

Your site token is also published in the verification meta tag in your site’s <head>, which is what makes ownership checkable from outside. It identifies the site to Inclusive Forge; it does not grant access to your Inclusive Forge account. The webhook secret is a separate value, used only to authenticate the scan-completed notice and the re-test request in both directions; it is never displayed anywhere on your storefront.

The plugin’s own “verification health” check on the settings screen fetches your site’s own home page — a request to your own site, not to a third party — to confirm the verification tag actually reaches visitors. The answer is kept for five minutes, so reopening the screen does not fetch again.