WooCommerce and personal agents: the plugin route, host by host Free & Pro

WooCommerce is the one mainstream platform where a store can be fully agent-ready under the Personal Agent Protocol without a provider in the middle. WordPress runs on your own server, so a plugin can publish the discovery file, run the OAuth server, show the customer a consent page on your own domain, and answer agents from your real catalogue, cart and customer accounts. That is what Agent Adapt does. This page is about the platform side: what the plugin gives you, and what each kind of WordPress hosting needs checked. The hosting facts are the ones the plugin’s own Site Health checks test for. Agent Adapt is not affiliated with or endorsed by WooCommerce or Automattic.

What "fully agent-ready" means here

With the free plugin active, a WooCommerce store:

• publishes /.well-known/poppy.json and the OAuth metadata it points to, generated from your settings;
• verifies every agent by its published identity and signs it into a Session bound to its key;
• lets a signed-out agent search the catalogue, read product details, read your returns, terms and privacy pages, and build a real WooCommerce cart with your prices, taxes and coupon rules;
• hands the cart to the customer as a single-use checkout link to your own checkout;
• lets the customer sign in on your own login page and approve what the agent may do with their account, after which the agent can read their orders and addresses, reorder, and cancel an unpaid order;
• shows you every agent under WooCommerce → Agents, with a Block button, and marks agent orders in WooCommerce’s own order attribution.

Pro adds customer-approved refunds, return requests and address changes, merchant policy, an MCP server, and agent insights with webhooks. See Free or Pro.

There is no feed, no account with anyone, and no key to issue. See Getting started.

Requirements

WordPress 6.8 or newer, WooCommerce 10.0 or newer, PHP 8.1 or newer, HTTPS, WordPress at the root of the domain, and pretty permalinks. Below a minimum the plugin stays inactive and names what is missing. Full detail in What Agent Adapt works with.

Host by host

The plugin runs the same everywhere. What differs is whether the host lets three kinds of request reach WordPress untouched: /.well-known/poppy.json, anything under /agent-adapt/, and anything under /wp-json/agent-adapt/. Tools → Site Health tests all of this from your store’s public address and tells you what is in the way.

Managed WordPress hosts

Most work with no change. Two things to check:

• The Authorization header. A few hosts strip it before PHP sees it, which stops every agent request. On Apache a one-line .htaccess rule fixes it, and Site Health prints the line. On nginx-based hosts the host has to pass it, and most already do; if not, it is a support ticket.
• Server-side caching and bot rules. Managed hosts cache pages aggressively and some challenge non-browser clients. Exclude the three paths. Agent responses are marked private anyway, so a cache that honours headers never stores them, but exclusions are the safe setting. See Caches, CDNs and security plugins.

Cloudflare and other proxies in front

Exclude the three paths from caching and from bot-fighting rules, as above. If the proxy hides your public address from WordPress (WordPress thinks it is http:// or on an internal hostname), the agentadapt_public_origin filter tells the plugin the address agents use, so the documents it publishes name the right origin. The Cloudflare page for serving a provider’s discovery document with a Worker does not apply to you: the plugin serves the file itself.

WordPress in a sub-folder

If your store lives at example.com/shop/, agents still ask example.com/.well-known/poppy.json. The plugin answers the document and the OAuth metadata under the folder as well, and Site Health lists the exact same-host redirects to add on your web server or CDN (the root path to example.com/shop/.well-known/poppy.json, and the metadata path likewise). A redirect that stays on your own host is allowed; everything else, including the issuer and the API, stays under /shop/. Site Health checks that the root path answers.

Multisite

Not tested. Nothing in the plugin is multisite-specific, but discovery must answer at the root of each store’s domain, so a sub-directory network would need the path forwarded for each site. A sub-domain network should behave like separate installs.

Local, staging and HTTP

The protocol is HTTPS-only and the plugin has no "allow HTTP" switch, on purpose. A staging site with a real certificate works; a plain-HTTP local site does not, and Site Health says so.

WooCommerce features that matter

Both checkouts (block and classic), high-performance order storage, order attribution, coupons, variable products, hidden products and coming-soon mode are tested on every release. Subscriptions, Bookings and product add-on plugins have no integration: agents see their products and orders as ordinary ones, and add-on fields are not part of the agent API. Multi-currency and translation plugins are untested. See What Agent Adapt works with.

What this looks like against other platforms

	WooCommerce with Agent Adapt	Hosted platforms through a provider
Discovery file	Served by the plugin	A provider’s document, served on your domain by a proxy
Customer sign-in	Your own WordPress login page	Depends on what the platform lets a provider do
Customer orders and addresses	The real account, with the customer’s approval	As the platform’s APIs allow
Checkout	Yours, by a single-use link	Yours, by a link
Who you depend on	Your host	Your host, your DNS provider and the hosted Company

The rest of this collection goes platform by platform.

Common questions

Do I need Pro to be agent-ready?

No. The free plugin does everything in the list above. Pro adds approvals for changes, policy, an MCP server and insights.

Will my host’s bot protection block agents?

It can, if a rule challenges non-browser clients on the three paths. Excluding the paths is enough; agents still face rate limits inside the plugin.

Can I run it on a WordPress site without WooCommerce?

Not this plugin; it needs WooCommerce and does nothing without it. For a WordPress site that is not a shop, see WordPress without WooCommerce.

How do I know it is working?

Site Health passes, poppy.json is JSON in a private window, and the five requests in Check that your store answers agents come back as described.