Thenia for developers

Technical documentation for installing and running Thenia on WooCommerce stores. Review system requirements, compatibility, frontend assets, data handling, connection security, and uninstall behavior before deploying the plugin.

This information applies to Thenia WordPress plugin version 1.2.9.

System requirements

The store must use HTTPS. URLs beginning with http:// are not accepted.

If WooCommerce is not active, the plugin displays an admin notice and does not load its other functionality.

Updates are delivered through the standard WordPress update mechanism. The plugin checks for a new version no more than once every 6 hours.

WooCommerce compatibility

Order storage

Thenia declares compatibility with HPOS (High-Performance Order Storage). It also supports orders stored as WordPress posts.

Checkout

Both classic WooCommerce checkout and block-based checkout are supported. Checkout Blocks integration uses Store API hooks.

Caching and REST

Signup form visibility and browsing tracking are determined in the browser. These features therefore work on pages served from cache.

The signup form does not use a nonce because a nonce embedded in a cached page may expire. Instead, it uses a honeypot and per-IP rate limiting.

All storefront requests use REST endpoints under /wp-json/thenia/v1/. The plugin does not use admin-ajax.

Coexistence with other email marketing tools

The plugin detects known abandoned cart and email marketing plugins, including CartFlows, Cart Abandonment Recovery, Retainful, Klaviyo, Omnisend, Mailchimp for WooCommerce, MailPoet, AutomateWoo, FunnelKit, Brevo, ActiveCampaign, and YITH.

Before the merchant enables Thenia's abandoned cart automation, the application asks them to disable cart emails in the other tools to prevent customers from receiving duplicate messages.

What Thenia loads on the storefront

The plugin does not load any CSS files. It uses three small JavaScript files with no dependencies on other scripts.

Each file loads only when its corresponding automation is enabled and the relevant page and visitor conditions are met.

Data queue and background tasks

Data is not transmitted to the application while the page is loading.

Events are first stored in the {prefix}thenia_queue table and sent at the end of the request, after fastcgi_finish_request where available.

• Up to 50 records per batch.
• A 4-second timeout.
• Failed transmissions are retried later with progressively increasing delays.
• One scheduled background task, thenia_heartbeat, runs hourly.

The plugin does not use Action Scheduler.

Cookies and consent

Thenia supports the WP Consent API, used by consent management tools such as Complianz, CookieYes, and Cookiebot.

Without consent for the relevant category, the corresponding cookies are not set and product views are not tracked.

All cookies use SameSite=Lax and Secure on HTTPS.

Store connection and security

Connection flow

1. The administrator selects "Connect to Thenia" in the plugin.
2. They confirm the connection at app.thenia.io.
3. They return to the store with a single-use code valid for 10 minutes and restricted to that specific site.
4. The plugin exchanges the code with the application through a server-to-server request.

For a new store, the plugin creates a WooCommerce REST key with the description Thenia and read_write permissions for the administrator initiating the connection.

Application passwords are not used.

Request signing

Communication between the plugin and the application is signed in both directions using HMAC-SHA256.

The signature headers are:

• X-Thenia-Store
• X-Thenia-Timestamp
• X-Thenia-Signature

Requests with a timestamp deviation greater than 5 minutes are rejected.

Secret storage

In WordPress, the connection secret is encrypted using sodium or AES-256-GCM through openssl. The encryption key is derived from the site's wp_salt.

The secret is never stored in plaintext. It is stored in wp_options with autoload disabled.

Within the Thenia application, keys and secrets are encrypted using AES-256-GCM.

REST endpoints

The plugin uses the thenia/v1 namespace.

The /wc and /sale-check endpoints are limited to operations involving coupons and shipping methods.

The plugin never creates, modifies, or deletes shipping zones.

What data is sent to Thenia

Store operational data

The plugin sends:

• Orders, including new orders, updates, and refunds.
• Products and inventory information.
• Carts associated with a known email address.
• Signup submissions, including email address, name, and the exact consent text.
• Product views from known visitors, subject to the relevant consent requirements.

Order payment details are never sent to Thenia. Only the payment type is sent: cash on delivery, bank transfer, check, or online.

Hourly synchronization

Once per hour, the plugin sends:

• Thenia plugin, WooCommerce, WordPress, and PHP versions.
• Store timezone and currency.
• Store name and logo.
• Store email address and phone number.

Data use and AI

Customer data is used only to operate Thenia for the connected store. It is not sold or shared for advertising purposes.

Only product information is provided to AI, not customer data.

Hosting and processing locations

The application and database are hosted in the United States. Emails are sent from Ireland.

Further details are provided in the Privacy Policy and Data Processing Agreement (DPA).

DPA

Coupon creation and management

Coupons are created directly in WooCommerce shortly before the corresponding email is sent.

Each coupon has:

• The format PREFIX-XXXXXX, with six characters in the unique code.
• The characters 0, O, 1, I, and L excluded to avoid confusion.
• A single-use limit.
• A restriction to the recipient's email address.
• The individual_use setting.
• An expiration date.

Unused coupons created by Thenia are automatically deleted from WooCommerce 7 days after expiration.

Coupons that have been redeemed, or that were not created by Thenia, are never deleted by this process.

Email sending and deliverability

Emails are sent from a Thenia domain using SPF, DKIM, and DMARC.

No changes to the store's DNS records are required.

• Sender name: The store's name is displayed, never Thenia.
• Replies: Customer replies go to the store's email address.
• Unsubscribe: Every email includes one-click unsubscribe support through List-Unsubscribe and one-click.

Deactivation, disconnection, and uninstall

These three actions have different effects.

Plugin deactivation

Deactivation stops the hourly thenia_heartbeat task.

It does not delete data or disconnect the store from Thenia.

To disconnect the store, use the plugin's "Disconnect" option or uninstall the plugin.

Disconnecting through the plugin

The "Disconnect" option:

• Deletes the WooCommerce REST key created by the plugin.
• Clears the event queue.
• Removes the stored connection secret.

Full uninstall

During uninstall, uninstall.php notifies the Thenia application and removes the specified local data.

The following are deleted:

• The WooCommerce REST key created by the plugin.
• The {prefix}thenia_queue table.
• The {prefix}thenia_carts table.
• The thenia_settings option.
• The thenia_table_version option.
• The thenia_sale_check_off option.
• The thenia_update_info transient.
• The scheduled thenia_heartbeat task.

What remains after uninstall

The following are retained:

• Coupons created by Thenia.
• The _thenia_click and _thenia_cart_token order meta.
• Transients that expire automatically.

API and third-party integrations

Thenia does not currently offer a public API or webhooks for third-party integrations.

The Thenia plugin is the only supported way to connect a WooCommerce store to the application.

The plugin's internal REST endpoints are not a public third-party API.

Developer support

For technical questions about installation, compatibility, or plugin behavior, contact:

hello@thenia.io