Manila Stack Affiliate Boxes for Southeast Asia

Manila Stack Affiliate Boxes for Southeast Asia helps bloggers and review sites in the Philippines, Malaysia, Thailand, Vietnam, Indonesia, and Singapore show clean, fast product boxes with buy buttons for the shops their readers actually use.

This plugin is not affiliated with, endorsed by, or sponsored by Shopee, Lazada, or TikTok. Shop names are used only to describe links you paste in yourself.

Features

• Gutenberg block and shortcode. Insert a box with the “Manila Stack Affiliate Box” block or [sea_box id="123"]. Both use the same server-side template. The block picker searches your boxes (it does not stop at 100) and can list draft, pending, and private boxes when your account is allowed to edit them. Each non-public box is labelled.
• Multiple buy buttons per product. Shopee, Lazada, TikTok Shop, and custom links, each in the platform’s colour. Every saved button gets a stable key, so reordering buttons does not move old click stats.
• Local prices. ₱ (PHP), RM (MYR), ฿ (THB), ₫ (VND), Rp (IDR), S$ (SGD), and $ (USD), with an optional original (strikethrough) price. VND and IDR show the symbol after the amount (150,000₫, 150,000Rp).
• Rating, badge, short description, pros and cons.
• Shopee Affiliate Open API (optional). Add your own App ID and Secret, paste a Shopee product URL, and the plugin can fill empty fields and create a tracked short link with your Sub IDs. Filled fields are left alone until you choose Replace. A price range is shown in the status line and is not written into the original price. Results are cached. If the API fails you can still fill everything in by hand.
• SEO-safe links. Every affiliate link gets rel="sponsored nofollow noopener" and opens in a new tab.
• Affiliate disclosure. Optional text shown under every box. On a brand-new install it is on. A saved “off” stays off.
• Click counting. Buttons on published boxes go through a local redirect that counts clicks per box, post, and day. It only redirects to links saved on a published box, so it cannot be used as an open redirect. Draft, private, and password-protected referrers are not stored. No IP addresses, cookies, or other personal data are stored. Obvious bots and browser prefetches are not counted. The redirect sends Cache-Control: no-store and X-Robots-Tag: noindex.
• Lightweight. No jQuery on the front end, one small stylesheet loaded only on pages with a box, lazy-loaded images, and a mobile-first layout.

Lazada and TikTok Shop links are pasted manually (for example a deeplink from your affiliate network). The plugin never scrapes shop pages.

The Shopee request format below is covered by unit tests and a local mock. It has not been verified against a live Shopee Affiliate account.

External services

This plugin connects to the Shopee Affiliate Open API only if you save your own App ID and Secret, and only when a logged-in user who can edit posts clicks “Fetch from Shopee” on a box. Visitors never trigger it.

Endpoints (one host per country, POST /graphql):

• Philippines: https://open-api.affiliate.shopee.ph/graphql
• Malaysia: https://open-api.affiliate.shopee.com.my/graphql
• Thailand: https://open-api.affiliate.shopee.co.th/graphql
• Vietnam: https://open-api.affiliate.shopee.vn/graphql
• Indonesia: https://open-api.affiliate.shopee.co.id/graphql
• Singapore: https://open-api.affiliate.shopee.sg/graphql

The plugin chooses the host from the product URL. It does not fall back to the Philippines when the URL is a Shopee country this list does not include.

• What is sent: the Shopee product URL you pasted, the item and shop IDs taken from it, your Sub IDs (the Settings default, or a request value when the user is an administrator), and your App ID with a request signature. The Secret is not sent. It is only used to compute the signature. The default header is SHA256 Credential={App ID}, Timestamp={unix}, Signature={sha256}. If Shopee returns a bare signature error (code 10020) and no data, the plugin retries once with Signature before Timestamp, the same body, and a new timestamp. A product query that is rejected for priceMin / priceMax (or code 10010) is retried once asking for price instead. A short-link validation error other than 10020, 10030, or 10035 is retried once with the mutation inlined and no variables object. Code 10030 is not retried.
• What is received: the product name, image URL, price range, rating, shop name, product link, offer link, and a tracked short link. If the short link fails and the offer link is a valid https Shopee URL, that offer link is used and the editor is told it does not include Sub IDs.
• Caching and rate limit: a successful lookup with no warnings is cached (default 12 hours). Warnings are not cached. After a cache miss the plugin allows 30 lookups per user per 10 minutes and then returns HTTP 429. Changing the App ID or Secret clears cached lookups stored in the options table.
• Short links: if you paste a Shopee short link (for example s.shopee.ph/...), the plugin sends a HEAD request to that Shopee host to find the full product URL. It does not follow the redirect off Shopee.
• Images: the plugin does not download or proxy product images. It stores the https image URL Shopee (or you) provided. Visitors’ browsers load that URL directly. Shopee image hosts commonly look like cf.shopee.ph (and the same pattern on other country domains) or *.img.susercontent.com. Any other https host is allowed. The plugin itself does not call those image hosts.
• Who can trigger this: a user with edit_posts by default. Only a user with manage_options can override Sub IDs on the request. The Secret never leaves the server.

No shop data is sent when visitors view your pages. When a visitor clicks a buy button they leave your site for the URL saved on that box.

Service provider: Shopee (Shopee Affiliate Program / Shopee Affiliate Open API). The endpoints are defined in includes/functions.php and called from includes/class-seabox-shopee-client.php (product lookup and short link) and includes/class-seabox-rest.php (short-link HEAD request).

• Shopee Affiliate Program Terms and Conditions: https://help.shopee.ph/portal/4/article/77295
• Shopee Privacy Policy: https://help.shopee.ph/portal/4/article/77274

These are the Philippine documents. Shopee Malaysia, Thailand, Vietnam, Indonesia, and Singapore publish their own terms and privacy policy in that country’s Shopee Help Center; the one for the country of the product URL applies to that request.

Lazada and TikTok Shop are not contacted by this plugin. Buttons for those shops are ordinary links you paste in.

Source code

The block editor script in build/ is compiled from the unminified source in src/ (included in this plugin) with @wordpress/scripts: run npm install and npm run build.