Free
Legal requirements
Withdrawal
Free implementation of Article 11a of Directive 2023/2673 for WooCommerce. Withdrawal button, two-step form, declaration on durable medium, operator panel. No limits, no hidden costs.
Features
What the plugin does
Withdrawal button (Art. 11a)
Visible button in order details in My Account. One click, two-step form with confirmation.
Variable product support
The customer selects exactly which items to return; the operator sees the same details in the admin panel.
Guest order support
Works without registration. Verification via email and order number.
Declaration on durable medium
Withdrawal declaration stored in accordance with Art. 11a(3) of Directive 2023/2673, available for download.
Operator panel
Complete list of declarations in the WooCommerce panel with audit history and wc-withdrawal order status.
GDPR-ready, no external APIs
All data stays on your server. No external services. WCAG 2.2 AA compliant.
What does the law require from your store?
From June 19, 2026, every online store selling to consumers in the EU must have a visible withdrawal button. A clause in the terms of service is not enough. The customer must be able to submit their declaration directly on the store’s website, in a few clicks, and immediately receive an email confirmation.
The obligation applies to every online seller, regardless of where they are based. Enforcement is handled by national consumer protection authorities.
The free version is a complete solution for the basic obligation under Directive 2023/2673. If you run a store with manual return handling and sell primarily physical or simple digital products — the free version is sufficient. The Pro version adds a workflow layer on top (automated refunds, PDF, reports) and support for complex orders (subscriptions, bundles). If none of that applies to your store, you don’t need Pro.
Comparison
Free vs Pro
What Pro adds on top of full compliance.
| Feature | Free | Pro |
|---|---|---|
| Withdrawal button from contract (Article 11a) | ||
| Two-step withdrawal form | ||
| Variable product support | ||
| Guest order support (without registration) | ||
| Article 16(m) consent for digital products | ||
| Confirmation email as durable medium (Art. 11a(3)) | ||
| Declaration as legal artefact | ||
| Withdrawal history in My Account | ||
| Declaration list in WooCommerce panel | ||
| Declaration details page with audit trail | ||
| Declaration registration metabox on order page | ||
| Admin notification email | ||
| wc-withdrawal order status with audit trail | ||
| Annex I(A) and I(B) page generator | ||
| Automatic refund on acceptance | ||
| PDF declaration generation | ||
| Declaration reports and CSV export | ||
| Webhook notifications and Slack integration | ||
| WooCommerce Subscriptions support | ||
| Active subscription cancellation on withdrawal | ||
| Proportional subscription period settlement | ||
| WooCommerce Product Bundles support | ||
| Refund calculation for partial bundle return |
Changelog
1.0.3
2026-05-20
- New Confirmed compatible with WordPress 7.0
- Sec Nonce is now verified before incrementing the rate-limit counter — attackers can no longer exhaust a guest's hourly budget with unauthenticated probes
- Sec Guest rate-limit buckets scoped per hashed IP instead of a shared pool — parallel guest sessions no longer share a single quota
- Sec Withdrawal form items validated against the actual order before processing — crafted requests cannot attach foreign line items to a declaration
- Sec Declaration items filter output re-validated — malformed entries from third-party plugins are stripped before the declaration is saved
- Sec Operator endpoints now explicitly block unauthenticated (user_id=0) requests regardless of order customer_id
- Sec Manual operator registration checks excluded order statuses at handler entry — the block cannot be bypassed by changing the status after the initial check
- Sec Declaration filing date validated for format and non-zero value — invalid date strings rejected before database write
- Sec Rate limiter returns a blocking value when its database table is unavailable — the limiter can no longer silently become a no-op
- Fix Fractional product quantities now sum correctly — IEEE-754 epsilon errors (e.g. 0.1 + 0.2) no longer cause quantity mismatches in declarations
- Fix Removed a spurious user_register hook from the Privacy Manager — no phantom calls on standard WordPress user registration
1.0.2
2026-05-14
- Fix All plugin identifiers (AJAX actions, script handles, nonce names, metabox IDs) renamed from the short bpw_ prefix to the full buddypilot_withdrawal_ prefix — satisfies WordPress.org unique-prefix requirement; no functional changes for stores not customising plugin internals
1.0.1
2026-05-12
- Sec All admin and AJAX handlers now check user capabilities before verifying the nonce — consistent with WordPress security guidelines
- Sec Operator AJAX handler uses check_ajax_referer() and returns a proper JSON error on nonce failure — correct behaviour for JavaScript error handling
- Sec Information-page creation button is now restricted to users with the required capability
- Sec Currency symbol and number separators escaped on the JavaScript side before DOM insertion — XSS protection in withdrawal form price display
- Fix Operator JavaScript moved to an enqueued file — better caching and separation from template markup
- Fix Removed manual load_plugin_textdomain() call — WordPress 4.6+ and WP.org handle translation loading automatically
1.0.0
2026-04-30
- New First stable release: two-step withdrawal form, guest verification, operator manual registration, declarations admin list, configurable withdrawal period and delivered statuses, Article 16(m) consent capture for digital goods, Annex I(A)/(B) page generator, customer and admin emails, My Account withdrawal history, HPOS support, GDPR hooks, WCAG 2.2 AA compliance, Polish and English translations
Frequently asked questions
Yes, for most stores. The plugin implements all requirements of Article 11a (withdrawal button and function), Article 11a(3) (confirmation on a durable medium), Article 16(m) (consent for digital products) and Annex I(A) and I(B) (information pages). Full compliance also requires appropriate provisions in the store terms of service and return policy – the plugin does not replace these. If the store sells subscriptions or complex product bundles, the Pro version is also required for full compliance in those scenarios.
19 June 2026. From that date, every online store selling to consumers in the European Union must have a withdrawal function compliant with Article 11a – regardless of the seller’s country of registration. This also applies to stores outside the EU if they sell to EU consumers. Enforcement is handled by national consumer protection authorities (UOKiK in Poland).
The plugin registers withdrawal declarations as legal documents and notifies the customer and operator. It does not automatically process money refunds (the operator does this using standard WooCommerce tools; auto-refund is available in the Pro version). It does not verify the physical return of goods. It does not enforce return deadlines. It does not generate credit notes (that is done by invoicing plugins). It does not replace legal consultation for questions specific to your store.
Yes. A guest customer verifies their identity on the public withdrawal page by providing their email address and order number. No login required, no account creation. After verification, they see the same two-step form as a registered user.
The free version treats subscriptions and product bundles like standard products – the withdrawal form works, the declaration is registered, the email is sent. What does not work automatically in the free version: cancelling active subscriptions upon withdrawal, proportional billing for the current billing period, calculating refunds for partial bundle returns. This is available in the Pro version. If you run a store with subscriptions or bundles, Pro is recommended for full compliance.
Typically 15-20 minutes. Activating the plugin, configuring the “General” section (withdrawal period, “delivered” statuses), filling in seller data (name, return address), clicking “Create withdrawal information page” (generates Annex I(A) and I(B) pages). After these steps the button appears automatically for customers eligible for withdrawal.
Yes. The plugin integrates with native WordPress privacy tools: personal data export (Personal Data Export) includes the consumer’s declarations, anonymization (Personal Data Eraser) removes or anonymizes data in declarations according to the WordPress process. Full minimum: we do not collect more data than is required to handle the withdrawal (email, order number, optional reason provided by the customer).
Very minimally. Most of the code is loaded only in the admin panel and on pages related to withdrawal (form, declaration detail page, Annex page). The order front-end in My Account has minimal overhead: one DB query to check if the customer is eligible for withdrawal, plus rendering the button. All admin operations run on native WP mechanisms.
Yes, through translations (Loco Translate, Poedit, etc.) or through the buddypilot_withdrawal_button_label filter. The default text is translated from PL/EN included with the plugin and comes from the literal wording of Article 11a – changing it is possible, but we recommend consulting with a lawyer to ensure the new text meets the requirement of a “clearly visible, easily accessible withdrawal function”.
Get started for free
Activation takes 5 minutes. Hosted on WordPress.org with native WordPress updates.