Precision Live Rates for WooCommerce

Precision Live Rates brings real, account-accurate UPS, USPS, FedEx, DHL, and Stamps.com prices into WooCommerce’s cart and checkout. No flat-rate guesswork, no aggregator markups bolted on top of the carrier rate, no rate drift between cart and checkout. The numbers your customers see are the same numbers you’d see on the carrier dashboard for the same parcel.

Under the hood, the plugin packs each cart into the smallest viable parcel using a true 3D bin-packing algorithm (volume-then-SKU-then-product-id deterministic sort, ships-alone overrides honored, custom-packed dimensions for soft goods supported), POSTs the parcel to ShipEngine over HTTPS, dedupes the rate response by carrier+service, and caches the result on your server so identical carts don’t trigger redundant API calls. The same RateService::quote() entry point feeds Classic Checkout, Blocks Checkout, and the WP-CLI wp precision-rates test-rate command — so cart, checkout, and your terminal all return byte-identical rates within the cache TTL.

The diagnostic surface is built for real-world support load. The Rate Test admin screen captures every quote attempt’s full request and response from ShipEngine into a 1-hour transient and surfaces it inline (collapsible, color-coded by HTTP status) so when a customer reports “no shipping options,” you can see exactly which carrier returned what. The Services screen auto-discovers every carrier:service_code flowing through the rate filter and lets you uncheck the ones you don’t want shown. The Plugin Status panel on the Overview tab reports the running version, saved API key state, active carriers, cache TTL, and current markup at a glance — so verifying “is the new code actually live with my settings” is a glance, not an SSH dive.

Privacy and compliance are first-class. The plugin transmits only postal codes, country codes, and parcel dimensions to ShipEngine — never customer name, email, IP, billing address, or order ID. Suggested privacy-policy boilerplate auto-registers with WP’s Settings → Privacy editor on activation. Personal-data exporter and eraser hooks are wired so the WP Tools → Export/Erase Personal Data flows recognize the plugin as compliant. EU/UK merchants can flip on a Settings → Privacy toggle to render a “Shipping rates calculated using ShipEngine — Privacy policy” line under the cart and checkout shipping options.

Highlights

• Real carrier rates via ShipEngine’s /v1/rates endpoint — UPS, USPS, FedEx, DHL Express, Stamps.com all behind a single API key. Or connect UPS / USPS directly with your own developer credentials.
• True 3D bin-packing via the dvdoug/boxpacker library. Define your box catalog under WooCommerce → Box catalog and items pack into the smallest viable box, ships-alone items respected.
• Cart = checkout, byte-identical, within the cache TTL. Single quote pipeline shared by Classic Checkout, Blocks Checkout, and WP-CLI.
• Encrypted credentials at rest via sodium_crypto_secretbox, derived per-install from wp_salt('auth') . AUTH_KEY. The plugin refuses to encrypt anything when AUTH_KEY is missing or matches the WP install placeholder.
• Per-carrier markup to bridge negotiated rates to retail-equivalent prices. ShipEngine returns each carrier’s negotiated rate (UPS often runs 30-50% below ups.com retail); set “UPS markup %” to 65-75 to display retail-equivalent prices without overcharging USPS shipments.
• Rate Test diagnostic screen captures the raw request/response of every quote — when checkout shows a price you didn’t expect, this is the source of truth.
• Services whitelist auto-discovered from carrier responses; uncheck what you don’t want shown to customers.
• GDPR-compliant out of the box. Privacy policy boilerplate, WP exporter/eraser hooks, opt-in cart disclosure line.
• i18n-ready — English (source), Spanish (es_ES), French (fr_FR) bundled. Other locales contribute via translate.wordpress.org once the plugin lists, or via pull request to the repo.
• HPOS-required. No legacy order-table compatibility shims. Modern WC only.

Out of scope

The plugin is intentionally focused on rate calculation. It does not purchase shipping labels, generate manifests, schedule pickups, sync tracking webhooks back to order status, or integrate with multi-vendor marketplaces (Dokan, WCFM). For label printing and fulfillment, use ShipStation / ShipEngine’s own dashboard or a separate WC label plugin.

Privacy & data handling

This plugin transmits cart/shipment data to a third-party rate aggregator (ShipEngine, https://www.shipengine.com/) over HTTPS to calculate live carrier rates. Specifically, on each rate quote the following is sent:

• Origin postal code + country (and optionally street/city/state, as configured in plugin settings)
• Destination postal code + country (and street/city/state if the customer supplied them)
• Parcel weight and dimensions, computed from the cart contents

The customer’s name, email, phone, IP address, billing address, and order ID are NOT transmitted. Successful rate responses are cached on your server for a short, merchant-configurable duration (60–3600 seconds, default 60). The cache is keyed on parcel dimensions and origin/destination ZIP only — it is not keyed on or attributable to any individual customer.

EU/UK merchants should turn on Settings → Privacy → “Display privacy disclosure on cart/checkout” so a small “Shipping rates calculated using ShipEngine — Privacy policy” line renders under the cart and checkout shipping options. Suggested privacy-policy boilerplate is auto-registered with WP’s Settings → Privacy → Policy guide editor on plugin activation.

The plugin also registers no-op personal-data exporter and eraser hooks with WordPress so the Tools → Export Personal Data and Tools → Erase Personal Data flows recognise it as compliant — there is nothing per-customer to export or erase, but the hooks are present so the privacy admin’s audit trail correctly accounts for the plugin.

Full data-flow documentation, including the GDPR / CCPA / Quebec Law 25 compliance summary, is in PRIVACY.md at the repo root. ShipEngine’s own data-handling practices are at https://auctane.com/privacy-policy/ (Auctane is ShipEngine’s parent company).

External services

Precision Live Rates calls third-party shipping APIs to obtain live carrier rates. No external service is called until the merchant has explicitly enabled and configured at least one carrier source. The data sent is limited to what is needed to compute a shipping price — see the Privacy & data handling section above for the exact payload.

ShipEngine (https://www.shipengine.com/) * What it is: a rate-aggregation API that fronts UPS, USPS, FedEx, DHL Express, and Stamps.com. * What is sent: origin postal code, destination postal code + country, parcel weight + dimensions, and the configured ShipEngine carrier IDs. No customer name, email, IP, or order ID. * When it is called: on the cart and checkout pages when WooCommerce asks for shipping rates and the cached rate has expired (default 60 seconds). * Why: to compute live shipping prices that match what the carrier itself would charge. * Terms of service: https://www.shipengine.com/terms-of-service/ * Privacy policy: https://auctane.com/privacy-policy/ (Auctane is ShipEngine’s parent company)

UPS Developer APIs (optional, https://developer.ups.com/) * What it is: UPS’s official rate API. * What is sent: same shape as ShipEngine, plus the merchant’s UPS account number. * When it is called: only when the merchant has explicitly enabled UPS direct under Settings → UPS direct and saved valid UPS developer credentials. * Why: lets merchants who have a direct UPS contract bypass ShipEngine and quote against their negotiated rate sheet. * Terms of service: https://www.ups.com/upsdeveloperkit/agreement * Privacy policy: https://www.ups.com/us/en/help-center/legal-terms-conditions/privacy-notice.page

USPS Developer APIs (optional, https://developer.usps.com/) * What it is: the United States Postal Service’s official rate API. * What is sent: origin and destination postal codes, parcel weight + dimensions. * When it is called: only when the merchant has explicitly enabled USPS direct under Settings → USPS direct and saved valid USPS developer credentials. * Why: lets merchants who have a direct USPS account quote against USPS retail rates without ShipEngine in the path. * Terms of service: https://www.usps.com/terms-conditions/general.htm * Privacy policy: https://about.usps.com/who/legal/privacy-policy/welcome.htm