Surf7 Simple Catalog

Surf7 Simple Catalog is a clean, focused catalog plugin for WordPress built by Surf7.net.

If you sell by enquiry, quotation or conversation rather than checkout — auto parts, machinery, furniture, jewellery, wholesale, custom manufacturing, made-to-order, property, vehicles, boats — this plugin is built for you. There is no cart, no checkout, no payment and no stock, by design.

Core features

• Catalog post type scat_product — REST-enabled, revisions, featured image, gallery, custom REST endpoints, WP_Query friendly.
• Three taxonomies: hierarchical Categories (thumbnail image, long description, display order, hide-from-filters), flat Labels (colour chips, display order), and Brands (logo, website URL, exactly one brand per product, with an A–Z brand index at /brand/).
• Product meta from a single typed schema: gallery, price, a price range derived from the product’s own options, price mode (show / on request / hide), availability (Available, Reserved, Sold, Coming soon) with configurable text and colour per status, featured star with an AJAX toggle, a specifications table with paste-from-spreadsheet, files and downloads, video URL, stock note, custom badge text, and per-product enquiry overrides.
• Five enquiry channels — WhatsApp, Email, Phone, Telegram and a custom link. Email either opens the visitor’s mail client or uses the built-in enquiry form. One message template drives every channel, with placeholders including {product_name}, {product_code}, {product_url}, {price}, {selected_options}, {visitor_message} and {site_name}. Optional enquiry log in its own table, with CSV export, BCC copies and an auto-reply to the visitor carrying a configurable Reply-To address.
• Spam guard: hidden honeypot field, three-second time trap, hourly per-IP rate limit, and optional Google reCAPTCHA v3 or Cloudflare Turnstile.
• Options engine: up to 10 global option sets, 100 values each, in five display types — dropdown, swatch, checkbox, package and free text. Per-value price adjustment or absolute price, and per-product groups that update the displayed price without a reload. Options are informational and enquiry-affecting only; they never create variations or touch stock.
• Front-end templates, every one overridable from your theme’s simple-catalog/ folder. Archive as grid, list or masonry; category, label and brand archives; product page with gallery, lightbox, breadcrumbs, tabs and related products; filters for category, label, availability, price range and sort order; classic pagination or an AJAX Load more button. Responsive and RTL-aware, and verified to render with full site chrome on block themes as well as classic ones.
• Six blocks and seven shortcodes, plus a shortcode generator under Catalog → Settings that builds a shortcode from real controls and copies it to the clipboard.
• Admin UX: drag-to-reorder gallery via wp.media, quick edit, bulk actions (draft, publish, sold, available, featured, duplicate), CSV import and export, and a JSON full-site export/import for staging → production deployments.
• WooCommerce migration: bring an existing WooCommerce catalogue across in place. Non-destructive, re-runnable, preserves category hierarchy, brands, term images and every affiliate link.
• External shop buttons: per-product links to Shopee, Lazada, Amazon and anywhere else, each with its own colours and inline SVG icon.
• REST API at wp-json/simple-catalog/v1/ — products, enquiry, taxonomy-index, nonce.
• WP-CLI: wp simple-catalog activate|deactivate|flush|version|purge-enquiries|export|import|export-csv-products|import-csv-products|caps|regenerate-thumbs.
• Security: map_meta_cap capabilities granted to administrators and editors, a nonce and a capability check on every write path, REST permission callbacks, a sanitise callback on every registered meta key, escaping at the point of output, and prepared statements on every custom-table query.
• SEO friendly: configurable permalink bases, Product JSON-LD, BreadcrumbList, ItemList on archives, and Open Graph / Twitter cards that step aside when Yoast, Rank Math or SEOPress is active.
• Performance: CSS and JS enqueued only on catalogue pages, five configurable image sizes, lazy loading with an optional blur-up placeholder, CSS custom properties instead of repeated inline styles, and an enquiry nonce that can be fetched at interaction time so full-page caching cannot serve a stale one.
• Internationalisation: full surf7-simple-catalog text domain with a bundled .pot, an RTL stylesheet, and default button labels that re-translate when the site’s locale changes.

Privacy

The optional enquiry log stores the name, email address, phone number and message a visitor submits. It is off by default. IP addresses are never stored in the clear — only a salted SHA-256 hash, used for rate limiting. Retention is configurable (never, 90, 180 or 365 days) and enforced by a daily job.

The plugin registers with WordPress’s own privacy tools, so Tools → Export Personal Data returns a visitor’s enquiries and Tools → Erase Personal Data anonymises them — clearing the name, email, phone, message, originating page, browser and IP hash while leaving the date and product, which identify nobody. Both work whether or not logging is currently switched on, because turning it off never deletes what was already stored. Suggested policy wording is offered under Settings → Privacy.

The plugin makes no outbound requests except the ones described under External services below, each of which you choose to enable. Nothing phones home, and no data is sent anywhere by default.

External services

Out of the box this plugin contacts no external service. The following are used only after you deliberately switch them on, and each is listed with what is sent and when.

Google reCAPTCHA v3 — used only if you select it under Catalog → Settings → Spam and enter a site key and secret key.

• On any page showing the enquiry form, the visitor’s browser loads https://www.google.com/recaptcha/api.js. Google receives the visitor’s IP address, browser details and the page they are on, as with any third-party script.
• When an enquiry is submitted, your server sends your secret key, the reCAPTCHA token produced by the visitor’s browser, and the visitor’s IP address to https://www.google.com/recaptcha/api/siteverify to confirm the submission is not automated.
• Terms of service: https://policies.google.com/terms — Privacy policy: https://policies.google.com/privacy

Cloudflare Turnstile — used only if you select it under Catalog → Settings → Spam and enter a site key and secret key.

• On any page showing the enquiry form, the visitor’s browser loads https://challenges.cloudflare.com/turnstile/v0/api.js. Cloudflare receives the visitor’s IP address, browser details and the page they are on.
• When an enquiry is submitted, your server sends your secret key, the Turnstile token, and the visitor’s IP address to https://challenges.cloudflare.com/turnstile/v0/siteverify.
• Terms of service: https://www.cloudflare.com/website-terms/ — Privacy policy: https://www.cloudflare.com/privacypolicy/

Image sideloading during import — used only if you tick “Download remote images” on the Import screen. Your server then fetches the image URLs contained in the file you uploaded, so the destinations are whichever hosts those URLs point to. No third party is involved beyond the hosts you supplied.

JSON import from a URL — used only if you call the simple-catalog/v1/import-export/import/json REST endpoint with a url parameter, which requires an administrator or editor login. Your server downloads that address and imports it. No such request is made from the admin screens.

Outbound links (no data is sent)

Two features render ordinary links to other websites. The plugin makes no request to any of them: nothing is contacted unless a visitor clicks, and when they do it is their own browser that navigates, exactly as with any link you place in a post. No data is transmitted by this plugin, and nothing is embedded, tracked or loaded from these hosts.

Enquiry channels and share buttons. If you switch on WhatsApp or Telegram enquiries, the button is a link to https://api.whatsapp.com/send or https://t.me/. If you switch on share buttons under Catalog → Settings → Display, each is a link to that network’s own share page — Facebook, X, WhatsApp, Telegram, Pinterest, LinkedIn, or a mailto: link. The product title and its URL travel in the link’s query string, which is what the network needs to prefill the share; both are already public.

Terms and privacy for the networks involved:

• WhatsApp — https://www.whatsapp.com/legal/terms-of-service and https://www.whatsapp.com/legal/privacy-policy
• Telegram — https://telegram.org/tos and https://telegram.org/privacy
• Facebook — https://www.facebook.com/terms.php and https://www.facebook.com/privacy/policy
• X — https://x.com/en/tos and https://x.com/en/privacy
• Pinterest — https://policy.pinterest.com/terms-of-service and https://policy.pinterest.com/privacy-policy
• LinkedIn — https://www.linkedin.com/legal/user-agreement and https://www.linkedin.com/legal/privacy-policy

External shop buttons. Per-product links to marketplaces such as Shopee, Lazada or Amazon. Every destination is a URL you enter yourself on the product; the plugin ships no addresses of its own and contacts nothing.

If you select a CAPTCHA provider, tell your visitors: sending their IP address to Google or Cloudflare is a disclosure you are responsible for under GDPR and similar laws. The suggested privacy-policy text under Settings → Privacy does not cover it, because whether it applies depends on a setting only you can see.