Joryio – Marketing Automation for WooCommerce

Joryio connects any WordPress site to the Joryio marketing automation platform (a hosted service – you need a Joryio account). On every site it tracks page views, sends Contact Form 7 and Elementor Pro form submissions to Joryio, and shows Joryio in-app messages and web push. With WooCommerce active it also syncs your products, orders and customers and powers abandoned cart recovery.

(This plugin was called “Joryio for WooCommerce” before 1.6.2, “Joryio for WordPress” before 1.6.25 and “Joryio” before 1.6.40. It is the same plugin – same folder, settings and updates.)

Nothing is sent to Joryio until you connect the plugin with your Joryio API key. What is sent, and when, is listed under “External services” below.

Key Features

On any WordPress site:

• Page tracking – Page views and visitor activity reach Joryio through the tracking script
• Website forms – Send Contact Form 7 and Elementor Pro form submissions to Joryio: the contact is created or updated, a “Form Submitted” event is recorded, and each form decides whether it subscribes the contact to a list (always, for a signup form, or only when its consent box is ticked)
• In-app messages and web push – Show Joryio in-app messages (popups) on your site and let visitors subscribe to browser notifications

With WooCommerce:

• Abandoned Cart Recovery – Automatically track and recover abandoned carts with personalized email campaigns
• Customer Identity Tracking – Capture customer emails early in the shopping journey
• Real-time Data Sync – Products, orders, and customers sync automatically to Joryio
• Cart Recovery Links – One-click cart restoration for returning customers
• UTM Tracking – Capture marketing attribution data for better campaign analysis
• Marketing Consent Checkbox – Collect email (and optionally SMS) opt-ins on checkout and registration, with the evidence recorded on each order

How It Works

1. Install the plugin from Plugins > Add New (search for “Joryio”) and activate it
2. In your Joryio dashboard, go to Settings > Integrations > WooCommerce & WordPress and copy the server URL and API key
3. Paste them in the plugin settings (WooCommerce > Joryio on a store, Settings > Joryio on a site without WooCommerce) and click Connect
4. A store syncs automatically; a site without WooCommerce starts sending page tracking, forms, in-app messages and web push

Abandoned Cart Tracking

The plugin tracks cart contents in real-time. When a customer adds items to their cart, their session is tracked. If they leave without completing their purchase, Joryio can send automated recovery emails with a personalized link to restore their cart.

Customer Identity

The plugin captures customer emails from:
* Checkout form
* Account registration
* Newsletter signup forms
* Any email input field

This allows Joryio to associate cart data with customer profiles for personalized marketing. You can turn off “Recognise visitors by the email they type” in the settings so that only signed-in customers are recognised.

Your visitors’ privacy and consent

• The plugin contacts Joryio only after you connect it with your API key, and stops when you disconnect.
• The tracking script can be turned off in the settings (“Inject Tracking Script”); in-app messages and web push have their own settings, and web push is off until you turn it on. A visitor is asked by their browser before any push notification is shown.
• The marketing consent checkbox (checkout and registration, off until you turn it on) records what the shopper saw and chose on the order. A box ticked by default counts only after the shopper touches it, and by default the opt-in counts only when the order is placed.
• Website forms subscribe a contact to a list only as each form is set up: always (a signup form) or only when its consent box is ticked.
• You are the controller of your visitors’ data. Mention Joryio in your site’s privacy policy and, where your visitors’ law requires it, ask for cookie consent before the tracking script runs (for example with a cookie consent plugin that holds back scripts until consent is given).

The storefront sets these first-party cookies: joryio_client_id (an anonymous visitor id, 1 year), joryio_session (the cart session, 30 days), joryio_email (an email the visitor typed, kept in their own browser, 30 days), joryio_utm_*, joryio_jr_cid and joryio_jr_jid (the campaign and message ids of a Joryio link they followed, 30 days), joryio_li (a random value telling the storefront the sign-in changed, no user data) and joryio_pending (a short-lived flag for add-to-cart events).

Source code

The plugin ships as readable source, with no build step and nothing minified. The web SDK it loads from sdk.joryio.com is Joryio’s hosted JavaScript library for the service (see “External services”).

Requirements

• WordPress 6.0 or higher
• WooCommerce 5.0 or higher for the store features (cart, orders, products, coupons, checkout consent). Without WooCommerce the plugin still connects your site for website forms, the tracking script, in-app messages and web push
• Contact Form 7, or Elementor Pro, for website forms (optional)
• PHP 7.4 or higher
• A Joryio account

External services

This plugin connects your site to Joryio, a hosted marketing automation service run by Joryio. It is needed for everything the plugin does: the plugin is an interface to your Joryio account. Nothing is sent before you click Connect with your Joryio API key, and nothing is sent after you click Disconnect.

Joryio terms of service: https://www.joryio.com/legal/terms-of-service
Joryio privacy policy: https://www.joryio.com/legal/privacy-policy
Data processing agreement: https://www.joryio.com/legal/dpa – subprocessors: https://www.joryio.com/legal/subprocessors

1. Joryio API (your region’s server, for example https://api-eu1.joryio.com or https://api-us1.joryio.com)

The server URL you paste when you connect. Requests go from your site’s server, and from your visitors’ browsers for the storefront events:

• When you connect, test or disconnect: your API key, the site URL and name, the WordPress, WooCommerce and plugin versions, the site’s time zone and (on a store) currency. On a store, the plugin creates a WooCommerce REST API key (“Joryio Integration”, read/write) and sends it to Joryio, which uses it to read your products, orders, customers and coupons, to register its WooCommerce webhooks and to create the coupon codes your campaigns use. Disconnect deletes that key and the webhooks.
• When store data changes (WooCommerce): products (name, price, images, categories, stock), orders (items, totals, payment method and status, the customer’s name, email, phone and addresses, the consent the shopper gave (the wording of the box, the page and the shopper’s IP address)), customers (email, name, phone, addresses, order history) and carts (contents, the shopper’s email when known, the recovery link, and for a guest the anonymous visitor id from the shopper’s own cookie).
• On storefront pages (tracking script, when it is on): page views, product and category views, add to cart, checkout started, and the anonymous visitor id; an email address the visitor types in a form or at checkout (and the name typed with it at checkout), unless “Recognise visitors by the email they type” is off; for a signed-in customer, a signed proof of their customer id.
• When a website form is submitted (Contact Form 7, Elementor Pro): the fields you map in the form’s Joryio settings, the form’s name and page, the consent box when the form has one, (1.6.38) the channels you chose for the form’s consent, and (1.6.39) a signup form’s consent text with its options. When the form’s consent box is ticked, also the box’s wording and the submitter’s IP address, kept by Joryio as consent evidence. When the person submitting is a logged-in customer (1.6.34), a signed proof of their customer id, made for that one submission, so Joryio can let the form update that customer’s own phone number. The settings page and the Elementor editor also read your Joryio lists and attribute names (names and types only, no contact data) for the form setup.
• When a shopper ticks or unticks the checkout opt-in (with “Record consent immediately”): the box, its new value, the session’s email and the shopper’s IP address, kept by Joryio as consent evidence.
• With every request: your plugin settings that Joryio follows or shows on your store’s page: the checkout opt-in settings, “Recognise visitors by the email they type”, “Track guest carts” and the abandonment time.

2. Joryio web SDK (https://sdk.joryio.com)

When in-app messages (on by default) or web push (off by default) are on, the storefront loads Joryio’s JavaScript library from https://sdk.joryio.com/web/1/joryio.min.js in the visitor’s browser. It shows the in-app messages you publish in Joryio (with “Allow HTML in-app messages” on, messages built with the HTML editor are shown in a separate frame whose Content Security Policy blocks every script written into them; they can show images, fonts and video loaded over HTTPS, but cannot run code on your pages, fetch data or submit forms themselves) and, with web push on, asks the visitor for permission and registers the browser for push notifications. It sends the anonymous visitor id, the messages shown and clicked, and the browser’s push subscription to your Joryio API server. With web push on, the service worker at /joryio-sw.js on your site loads https://sdk.joryio.com/web/1/joryio-sw.js to show the notifications.

Links in the emails and messages Joryio sends (for example cart recovery and coupon links) point back to your site; when you set up click tracking in Joryio they pass through Joryio’s tracking domain first. The plugin itself does not contact that domain.