Verifactu for WooCommerce — AEAT invoicing records and the tax QR

Verifactu for WooCommerce turns a WooCommerce shop into a VERI*FACTU invoicing system under the Spanish anti-fraud rules. For every paid order the plugin creates an invoicing record (registro de alta), chains it to the previous one with a SHA-256 hash, submits it to the web service of the Spanish Tax Agency (AEAT) with your electronic certificate, and puts the tax QR code with the “VERI*FACTU” legend into the customer e-mail, the thank-you page and the account area.

Spain’s anti-fraud invoicing rules (Real Decreto 1007/2023, Orden HAC/1177/2024) require invoicing software to create a tamper-evident record for every invoice. In VERI*FACTU mode each record goes to the AEAT right away, and the customer can check the invoice from the QR code on the AEAT site. The obligation applies from 1 January 2027 to companies and from 1 July 2027 to everyone else (Real Decreto-ley 15/2025).

What the shop owner gets

• Order metabox — invoice number, AEAT status and the actions: send, correct, void (Pro).
• Order notes — the plugin writes into the order history which invoice was issued and what the AEAT answered, including the error code.
• “Check connection” — a separate button that proves the AEAT accepts your certificate while registering nothing.
• Test and production kept apart — separate record chains and separate invoice counters, so test invoices never disturb live numbering.

How it works, step by step

1. An order reaches the status you chose (Completed or Processing).
2. The plugin issues the invoice: it takes the next number from its own series (e.g. T2027-000001) and builds a RegistroAlta record — simplified (F2) or, with Pro, full (F1) with the customer’s NIF.
3. The tax breakdown comes from what WooCommerce actually charged: Spanish VAT (S1), exports with no tax (exempt, regime 02), EU distance sales through OSS (N2, regime 17), zero-rated domestic lines. For the Canary Islands the tax type is switched to IGIC in the settings.
4. The record is chained with a SHA-256 hash to the shop’s previous record, exactly as the AEAT specifies. The chain is guarded by a lock, so two simultaneous orders cannot break the order of records.
5. The record goes to the AEAT over SOAP with your electronic certificate. The plugin respects the waiting time between submissions that the AEAT itself returns.
6. The answer is split per record: accepted, accepted with errors, rejected — with the AEAT error code in the log and in the order notes.
7. If the AEAT is unreachable, the record stays queued and is retried with increasing delays (2, 4, 8 minutes… up to 256 minutes). The invoice and its QR code are valid from the moment the record is created.
8. A rejected record is corrected in one click: the plugin creates a new chained record with the Subsanacion and RechazoPrevio flags set the way the AEAT expects. Records are never edited after the fact — a correction is always a new record.

Under the hood

• The hash follows the AEAT specification (huella document, v0.1.2) exactly: field order, amount formatting, uppercase SHA-256. All three examples from the AEAT document are reproduced byte for byte.
• The chain is locked: the number and the previous hash are taken under a database-level lock, so parallel orders cannot leave gaps or duplicates in the chain.
• Records are immutable: no record is edited after it is created. A correction, a corrective invoice and a voiding are always new records in the chain.
• The QR follows the AEAT document (v0.5.0): an own ISO 18004 encoder with no external service, the ValidarQR URL for the chosen environment, and the image in e-mails served through a signed URL — someone else’s invoice cannot be opened from the link.
• The certificate: the private key is re-encrypted with a key derived from your site salts and kept in a randomly named folder. The safer option is constants in wp-config.php with files outside the web root; the plugin supports both.
• A queue that does not lose records: up to 1,000 records per submission, retries with increasing delays, and a separate admin banner if delivery keeps failing.
• An AEAT mock for staging: the CCVF_AEAT_MOCK constant returns answers that follow the AEAT schema and nothing leaves the site. It is ignored in production.
• Uninstalling does not erase tax data: records stay unless you deliberately define CCVF_DELETE_DATA.

Installation

1. Plugins → Add New → Upload Plugin: choose catcode-verifactu-for-woocommerce-1.0.0.zip and activate it.
2. WooCommerce → Verifactu → Settings: the issuer NIF and name exactly as registered at the AEAT, the order status that issues the invoice, and the invoice series.
3. Upload the .p12/.pfx certificate with its password, or define CCVF_CERT_FILE, CCVF_KEY_FILE and CCVF_CERT_PASSWORD in wp-config.php.
4. Staying on “Test portal”, press “Check connection”, switch “Generate Verifactu records” on and place a test order.
5. When the test records are accepted, move to production.
6. For Pro: paste the licence key from the e-mail you got after payment into the Licence tab, or start the 7-day trial.