PDF Invoice for WooCommerce

1. Overview

PDF Invoice for WooCommerce creates a PDF invoice for WooCommerce orders and a PDF packing slip on request. An invoice is made when an order reaches one of the statuses you choose, and also whenever it is attached to an email or downloaded, so it always shows the order as it is now. You choose which WooCommerce emails carry the invoice. Customers can download it from their order pages, guests through the secure order link, and shop staff can download invoices and packing slips from the WooCommerce Orders list.

The plugin is free. The PDFs are made on your own server with a PDF library that is bundled in the plugin's vendor/ folder (Dompdf). That library turns the plugin's HTML templates into PDF files. It makes no calls to an outside service. The plugin is listed on the Plugins screen as "PDF Invoice for Woocommerce" and in the WordPress.org directory under that name.

A separate paid plugin, Advance Invoices for WordPress & WooCommerce, covers PDF invoices and estimates that customers pay online with Stripe or PayPal. This plugin has no such features.

How it works

1. You enter your company details and choose three things under WooCommerce → Settings → PDF Invoice: the order statuses that generate an invoice, the statuses that mark it as paid, and the emails it is attached to.
2. When an order moves to a "Generate Invoice" or "Mark as Paid" status, the plugin builds the invoice HTML from a template, turns it into a PDF and saves it in wp-content/uploads/wphub-invoice/ under a file name that cannot be guessed.
3. When WooCommerce sends one of the emails you selected, the plugin makes the invoice again for the order's current state and attaches the file.
4. Customers and staff download through links that check who is asking. The files are only a cache: a daily job deletes PDFs older than 7 days, and they are made again when needed.

At a glance

What it does not do

• It does not take or record payments. "Paid" and "amount due" follow the order status you chose, not the payments on the order. Refunds do not change the amount due.
• It does not offer other designs. There is one invoice design (Template 1, A4). You can replace its markup by copying the template into your theme.
• It does not add a prefix such as INV- to invoice numbers. The number is the plain order ID or the sequential number. A filter can add a prefix.
• It does not print the shipping address on the invoice (only on the packing slip), and it has no estimates, reminders or recurring invoices.
• It does not keep a history of invoices. Only the latest PDF of an order is stored, for up to 7 days.
• It has no shortcodes, blocks, REST routes or WP-CLI commands.

2. Requirements

3. Installation

1. Make sure WooCommerce is installed and active.
2. In WordPress open Plugins → Add New Plugin, search for "PDF Invoice for Woocommerce", click Install Now and then Activate. You can also upload the plugin zip under Plugins → Add New Plugin → Upload Plugin.
3. Open WooCommerce → Settings → PDF Invoice. A Settings link on the Plugins screen goes there too.
4. Enter your company details and choose when invoices are generated, marked as paid and attached to emails (see Settings).
5. Click Preview Template to check the layout, then Save changes.

What activation creates

• The folder wp-content/uploads/wphub-invoice/ with a protection file index.php and an .htaccess file that denies direct access. If the folder cannot be created or written, the plugin tries again whenever it needs it.
• The daily WP-Cron event wphub_invoice_daily_cleanup, which deletes old PDFs. It is also re-created on any request if it is missing.
• The option wphub_invoice_version (written on the first request after activation).

It creates no database tables, roles or pages. The settings option _wphub_invoice is written the first time you save the settings tab. Until then the plugin uses its defaults. The invoice number counter _wphub_last_invoice_number appears when the first sequential number is issued.

Updating

Update from the Plugins screen as usual. The plugin compares the stored version with the code on every request and runs its upgrade once. When it upgrades from a version before 1.6, it deletes all PDF files in uploads/wphub-invoice (version 1.6 and later protect that folder; earlier versions stored PDFs there under names built from the invoice number, which could be guessed) and removes a stray option called wphub-invoice. Your settings, the invoice counter and the invoice numbers stored on orders are kept.

Multisite

The plugin loads on a site of a network when WooCommerce is active on that site or network-wide. Settings, the counter and PDFs are per site (each site's own uploads folder). The cleanup event is created on each site on its first request. uninstall.php works only for the site on which it runs.

4. Quick start

1. Open WooCommerce → Settings → PDF Invoice.
2. Fill in Company Name, Company Address, Company Email and Company Phone, and paste the address of your logo into Company Logo.
3. Under Generate Invoice and Mark as Paid add Completed next to Processing if you attach the invoice to the Completed order email or want customers to keep the Download Invoice button after the order is completed (see the note below).
4. Under Attach to Emails keep the emails you want (the defaults are New order, Processing order, Order details and Completed order).
5. Click Save changes, then Preview Template to open a sample invoice with your company details in a new tab.
6. Place a test order and move it to Processing. Check the email and the Invoice icon in WooCommerce → Orders.

5. Features

When an invoice is made

The plugin makes (or re-makes) an order's PDF invoice in these cases:

• A status change. When an order moves to a status listed under Generate Invoice or Mark as Paid, the plugin renders the invoice (on woocommerce_order_status_changed at priority 999). If an email attachment already rendered it for that status earlier in the same request, it is not rendered twice. The actions wphub_before_pdf_invoice and wphub_after_pdf_invoice fire around this rendering, and only here.
• An email attachment. When WooCommerce prepares one of the emails you selected, the invoice is re-rendered for the order's current state (unless it was already rendered for this status in this request) and attached. Because the invoice is re-made at that moment, an email never carries an old PAID or due state.
• A download. Every explicit download re-renders the invoice so it reflects the order as it is now.

The rendering happens inside the request that triggers it: a status change during checkout, an email being sent or a download. There is no queue and no background job, and the plugin has no error handling around the PDF library, so a PDF library error is a PHP error in that request.

If you clear every choice under Generate Invoice, Mark as Paid or Attach to Emails and save, the plugin stores an empty list for it and does not silently restore the defaults. Defaults apply only to settings that have never been saved.

Email attachments

Attach to Emails lists every email that WooCommerce knows, by its title. Select the ones that should carry the invoice. The plugin hooks woocommerce_email_attachments at priority 999 and attaches the invoice only when the email's ID is one you selected and the email belongs to an order. Account emails (for example a new account or a password reset) have no order, so nothing is attached to them even if you select them.

The titles are the ones WooCommerce 11.1.2 gives these emails with its default settings; when WooCommerce's Block Email Editor (alpha) feature is switched on, some titles differ (for example Processing order becomes Order confirmation), but the IDs stay the same. The Refunded order choice only covers full refunds: for a partial refund WooCommerce sends the email with the ID customer_partially_refunded_order (WooCommerce 11.1.2, class-wc-email-customer-refunded-order.php), which is not in the list and so never gets the invoice.

The attachment path is the invoice file for that order. If the file cannot be made or written, the email is sent without an attachment and nothing is reported.

Selecting an email does not check the order's status. An invoice is attached to a Cancelled or Failed order email in whatever state the order is in at that moment, and with sequential numbers on it takes a number (see below).

Invoice numbers

• Sequential Invoice Numbers off (default). The invoice number is the WooCommerce order ID (the internal post or order ID, not the order number a plugin may show to customers). The invoice also prints Order Number: with the order's number as WooCommerce reports it.
• Sequential Invoice Numbers on. Each order gets one number the first time an invoice is made for it, stored on the order as _wphub_invoice_num. The first invoice gets exactly the Starting Invoice Number (default 1000) and each new invoice the next number. The number never changes for an order once stored.

How the counter works, from the code: the option _wphub_last_invoice_number holds the last number issued. It is created with the starting number minus 1. Each new number is made by one database statement, UPDATE of the option to the larger of "last number plus 1" and "starting number". Raising the starting number later therefore takes effect with the next invoice, and lowering it never re-issues a number. The new value is then read back with a separate query. A start value that is blank or not a number is treated as 1000 when numbers are issued.

A number is taken the first time an invoice is made for an order, by any of the routes under When an invoice is made. That includes a download by an administrator from the Orders list, which has no status check, and an email you attached for a status such as Cancelled. Only customer downloads are limited by status.

The filter wphub_invoice_number can change the number that is printed and used in file names, for example to add a prefix (see Filters). The settings screen gives INV-1001, INV-1002 as an example of sequential numbering, but the plugin itself adds no prefix.

Paid invoices and amount due

If the order's status is one of the Mark as Paid statuses, the invoice shows a green PAID badge and the amount due is zero. Otherwise there is no badge and the amount due is the order total. This follows the status only: the plugin does not look at payments or refunds. The amount due appears twice: in the header as Amount Due: and as the last row of the totals.

VAT number field

With VAT Number Field ticked (off by default) the plugin adds an optional field labelled VAT Number to checkout:

• Classic checkout. A billing field named company_vat, not required, shown at priority 130 of the billing section. The value is saved as the order meta wphub_company_vat when the order is processed.
• Checkout block. A field registered through WooCommerce's Checkout Fields API with the ID wphub/company-vat, in the Contact information step, labelled VAT Number (optional), plain text, at most 40 characters, autocomplete off. WooCommerce stores it as _wc_other/wphub/company-vat, and the plugin copies the value to wphub_company_vat too, including when it is edited in the admin, so invoices and integrations read one key. If registering the field fails (for example the ID is already registered), checkout is left alone.

The value is printed on the invoice and the packing slip as VAT NO: value (the classic key first, then the block key) and, for the classic field, on the admin order screen as VAT Number: value under the billing address (WooCommerce lists block fields there itself). Turning the setting off removes the field from checkout but keeps values already saved on orders, and they still print.

What the invoice shows

Template 1 prints, in this order:

1. Header. Your logo on the left and the word INVOICE on the right, then your company name, address, phone and email on the right.
2. Bill to. The customer's first and last name, company, billing address (without repeating the name and company), phone, email and VAT number.
3. Invoice details. Invoice No:, Order Number:, Invoice Date: (the date the order was created, formatted d/m/Y unless you change it with wphub_invoice_date_format), the PAID badge when it applies, and Amount Due:.
4. Items. A table with #, Item, Qty, Unit Price and Total. Each item shows its name, its SKU when it has one, and its item details (variation attributes, product add-ons and other item meta). Unit Price is the line subtotal divided by the quantity, before discounts. Total is the line subtotal as WooCommerce formats it. A line whose product has since been deleted is still printed (without a SKU). Lines that are not products, such as fees, are not listed in the item table, and appear in the totals instead.
5. Totals. The rows WooCommerce returns for the order's totals (as in its own emails: subtotal, discounts, shipping, fees, taxes, payment method, refunds and total, as they apply), then Amount Due:.
6. Footer. Your Footer Note and Copyright Text, and Page X of Y at the bottom right of every page (a filter changes or removes that text).

The paper is A4 portrait (the filter wphub_invoice_paper_size changes it). Amounts use the order's currency. The bundled DejaVu Sans font is used for currency symbols and for non-Latin text such as Cyrillic and Greek, which print correctly. All customer and company values are escaped before they go into the PDF HTML, and PHP and JavaScript inside templates are switched off in the PDF library.

Company logo

Paste the full address of an image into Company Logo. The settings screen recommends PNG or SVG, at most 200 pixels wide. The plugin accepts any image type it can read, including PNG, JPG and SVG, and embeds the picture in the PDF so the PDF library does not have to fetch it. It is printed at no more than 250 by 120 pixels.

1. If the address is a Media Library file of this site, the file is read from disk.
2. Otherwise, if it points to this site's URL, it is mapped to a file below the WordPress folder and read (never outside it).
3. Otherwise, if it begins with http:// or https://, the plugin downloads it with the WordPress HTTP API (15 second timeout, 5 MB limit; only an HTTP 200 answer is used).

The image type is detected from the file (a text or XML file is treated as SVG), and the picture is turned into a data: address. When that address is under 700 KB (an image of roughly half a megabyte) it is cached in a transient for one day; larger images are read or downloaded again for every PDF. If the picture cannot be read, the address itself is put in the page and the PDF library tries to fetch it. If the logo field is empty, nothing is printed in its place.

Packing slips

A packing slip is a PDF without prices. Staff download it with the packing slip icon in the Orders list (see Downloads). It shows:

• the title Packing Slip and your company details,
• BILL TO with name, company, billing address, phone, email and VAT number,
• SHIP TO with the shipping name, company and address, only when the order has a shipping address,
• Order Number: and Order Date:,
• a table with #, Item (name, SKU, item details) and Qty,
• Shipping Method : (only when the order has one) and Payment Method :, and
• your Copyright Text (the footer note is not printed on packing slips) and Page X of Y.

A packing slip is made fresh for each download and streamed to the browser. It is never saved as a file in the uploads folder. The Packing Slip Button setting (on by default) switches the icon in the Orders list on or off. It does not affect the download endpoint itself.

Downloads: who can get a PDF

PDFs are never served by a direct file address. Every download goes through admin-ajax.php with a link that carries a nonce and, for customers, the order key. The link checks, in this order: the nonce (Security check failed., HTTP 403), an order ID (Invalid request., 400), that the order exists and is a real order, not a refund (Order not found., 404), and then permission (You are not allowed to do this., 403).

There is no download button on the single order edit screen; use the Orders list.

Which orders customers can download

A customer sees the button, and can download, only when the order's status is in Generate Invoice or Mark as Paid, or the order already has a sequential invoice number. That stops customers pulling invoices for pending, failed or cancelled orders and using up sequential numbers. The filter wphub_invoice_customer_can_download can change the decision. Staff (edit_shop_orders) are not limited by status.

Link lifetime

The links contain a WordPress nonce. In WordPress 7.1.2 a nonce is valid for between 12 and 24 hours (the nonce_life filter changes the lifespan). The customer buttons are built each time the page is shown, so a button on a freshly loaded page works. A link that someone copied or bookmarked stops working after that time, and the customer opens the order page again. For a guest, the nonce is not tied to a login.

What the browser receives

The PDF is sent with Content-Type: application/pdf and Content-Disposition: attachment, the file name invoice-<number>.pdf or packing-slip-<order id>.pdf, no-cache headers and X-Robots-Tag: noindex, nofollow. The invoice is read from disk through WordPress's file system API; if that cannot be used (some hosts ask for FTP credentials), the download fails with Invoice could not be generated. If a packing slip cannot be made, the message is Packing slip could not be generated.

Preview Template

On the settings tab, the Preview Template link next to the template list opens a sample invoice (a made-up customer, Blue Sky Marketing Limited, two products and a PAID badge) in a new tab, shown inline in the browser, with your company details, logo, footer note and copyright text filled in. It uses the settings that are saved, not unsaved changes in the form, so save first. It needs the manage_woocommerce capability and a valid nonce, and works only for logged-in users. If you copy template-1.php into your theme (see Templates), the preview loads your copy too and passes it no order, so a copy that uses $order without checking it will not render in the preview.

Where PDFs are stored and who can reach them

• Folder. wp-content/uploads/wphub-invoice/ (the site's own uploads folder on multisite), with an index.php and an .htaccess file. The .htaccess denies all direct access on Apache 2.4 (Require all denied) and on 2.2 (Deny from all); LiteSpeed reads it too.
• File name. invoice-<invoice number>-<16 characters>.pdf. The 16 characters are taken from a hash that WordPress makes with your site's secret keys from the order ID and the invoice number, so a name cannot be worked out from the invoice number alone.
• Font cache. The PDF library's font folder and font cache are a sub-folder, wphub-invoice/fonts, and its temporary files go to WordPress's temp folder. That keeps them out of the plugin folder, which can be read-only and is replaced on update.
• Retention. The daily event deletes .pdf files older than 7 days, going through sub-folders, judged by the file's modification time (the filter wphub_invoice_cleanup_days changes the 7, never below 1). Fonts are left. PDFs are re-made on demand, so deleting them is safe. Because PDFs hold customer name, address, phone, email and VAT number, you can lower the number of days.
• On nginx. nginx does not read .htaccess, so there the unguessable file name is the only barrier. To block the folder entirely, add a rule such as location ^~ /wp-content/uploads/wphub-invoice/ { deny all; } to your server configuration. This is a suggestion; the plugin does not do it.
• A recorded address. After each invoice is written, the plugin saves its direct file address as the order meta wphub_invoice_url. On Apache or LiteSpeed that address is blocked by design. It is not used for downloads; it is there for other code to read.

The plugin never stores a packing slip file.

When each feature arrived

From the readme's changelog:

• 1.1: a packing slip for the Advance Partial Shipment plugin.
• 1.4: packing slip PDFs, the Invoice and Packing Slip icons in the Orders list, the Download Invoice button on the order details page, and the daily cleanup of old PDFs.
• 1.5: safe placeholder replacement, an atomic invoice-number increment, and a capability check on the preview.
• 1.6: protected PDF folder and unguessable file names, escaped customer data, VAT Number field for the Checkout block, the Invoice action in My Account → Orders, customer downloads limited to eligible orders, invoices re-made when attached or downloaded, item details on invoices, page numbers, non-Latin text, the first sequential invoice getting exactly the starting number, the new filters and the placeholders {billing_address_only} and {shipping_address_only}.

Safety measures

• Customer and order values placed into the PDF HTML are escaped, so checkout input cannot inject markup into the PDF renderer. Placeholder values are replaced as plain text (str_replace), so characters such as $1 in an address cannot corrupt the document.
• Embedded PHP and JavaScript are disabled in the PDF library. Remote resources are enabled (so a custom template can load an image by address). The standard templates load none, and your logo is embedded.
• The preview checks the capability and the nonce and only accepts a template name that exists as a file in the plugin's preview/ folder, else it uses template-1.
• All settings are sanitised as they are saved: the logo address as a URL, the email as an email address, the starting number as a whole number (or empty), the template name restricted to letters, digits, hyphens and underscores, and every other text with sanitize_textarea_field, which removes HTML tags and keeps line breaks.

6. Settings

All settings are on WooCommerce → Settings → PDF Invoice (admin.php?page=wc-settings&tab=wphub_invoice), under the heading "PDF Invoice for Woocommerce". The tab needs the manage_woocommerce capability. They are saved with WooCommerce's Save changes button into one option, _wphub_invoice (not autoloaded). Fields appear in the order of the table. Until the first save, the defaults below apply; the form shows them too.

The option also stores the lists as arrays of status keys without the wc- prefix (for example processing), and checkboxes as 1 (checked) or yes; older versions stored yes or no, and the plugin accepts 1, yes and true as on. Everything read from the option passes through sanitize_textarea_field again.

7. Reference for developers

AJAX endpoints

All three are admin-ajax.php actions. There are no REST routes, shortcodes, blocks or WP-CLI commands.

Helper methods that build the links: wexphub_invoice()->get_invoice_download_url( $order, $admin = false ) and get_packing_slip_download_url( $order, $admin = false ).

Filters

The plugin also applies two core filters itself: woocommerce_order_formatted_billing_address and woocommerce_order_formatted_shipping_address (the same ones WooCommerce applies) when it prints an address without the name lines, and active_plugins when it checks whether WooCommerce is active.

// Add a prefix to invoice numbers.
add_filter( 'wphub_invoice_number', function ( $number, $order_id, $settings ) {
	return 'INV-' . $number;
}, 10, 3 );

// US Letter paper.
add_filter( 'wphub_invoice_paper_size', function () {
	return 'letter';
} );

// Let customers download invoices of completed orders as well.
add_filter( 'wphub_invoice_customer_can_download', function ( $allowed, $order ) {
	return $allowed || $order->has_status( 'completed' );
}, 10, 2 );

// Add a placeholder that your copy of the template can print.
add_filter( 'wphub_invoice_placeholders', function ( $replacements, $order ) {
	$replacements['{customer_note}'] = esc_html( $order->get_customer_note() );
	return $replacements;
}, 10, 2 );

// Keep PDFs for 2 days only.
add_filter( 'wphub_invoice_cleanup_days', function () {
	return 2;
} );

These work because each filter runs when the PDF is made (or, for the cleanup, when the daily event runs). For the placeholder example, the text {customer_note} must appear in your template copy.

Actions

WooCommerce and WordPress hooks the plugin attaches to

Templates and placeholders

The invoice and the packing slip are built from the template files templates/template-1.php and templates/packing-slip.php with WooCommerce's template loader. A copy in yourtheme/invoice-for-wc/ (child theme first) replaces the file. The templates receive $order (the WC_Order) and $settings (the settings array). After the template has run, the plugin replaces these placeholders in its output:

Replacements run in the order of this map, so the footer note and copyright text may contain {your_company_name} and {current_year}. The filter wphub_invoice_placeholders can add to it. The preview file preview/template-1.php contains only the company placeholders ({invoice_logo}, {invoice_footer_note}, {invoice_copyright_note}, {your_company_name}, {your_company_address}, {your_company_phone} and {your_company_email}) and fixed sample text for the rest. The preview also fills {current_year}, which can appear inside the copyright text.

Only the file name template-1 can be chosen: the selected name must exist in the plugin's templates/ folder, otherwise template-1 is used. To restyle the invoice, override template-1.php in your theme.

Classes other plugins use

The plugin's code says these are kept under their names because other plugins, such as Advance Partial Shipment for WooCommerce, use them to make their own packing slips and delivery notes with your PDF Invoice settings. They are not documented as a stable API beyond that.

• wexphub_invoice() returns the main object (WEXP_Hub_PDF_Invoice) when WooCommerce is active. Its get_settings() returns the settings merged with defaults.
• WEXP_Hub_Invoice: render_pdf( $html ) (static, returns the PDF as a string, A4 portrait with page numbers), get_dompdf() (static), preview_invoice( $template, $get_template = true, $filename = '' ) (streams a PDF inline and exits), get_invoice_path( $order, $refresh = false ), get_invoice_num( $order_id ).
• WEXP_Hub_Invoice_Format::format_invoice( $html, $order, $settings ) fills the placeholders above.
• WEXP_Hub_Packing_Slip::get_packing_slip_pdf( $order ) returns the packing slip as a PDF string.
• WEXP_Hub_PDF_Invoice::get_pdf_dir() (static) returns the PDF folder path and creates it with its protection files.

Constants: WPHUB_INV_VER (the version) and WPHUB_INV_FILE (the main file), both defined only if not already defined, and the class constants PDF_DIR (wphub-invoice) and BLOCK_VAT_FIELD (wphub/company-vat).

Cron events

Options, order meta and transients

The plugin creates no database tables. The bundled PDF library lives in vendor/ and is loaded only when a PDF is made. File layout: invoice-for-wc.php (hooks and downloads), classes/ (invoice, format, packing slip, settings), templates/, preview/, includes/setting-fields.php, assets/ (an Orders-list style and the preview script), languages/ (a translation template, text domain pdf-invoice-for-woocommerce), uninstall.php.

8. Privacy and data

The plugin sets no cookies, does no tracking and makes no calls to an analytics or invoicing service. PDFs are made on your own server. It does not register a privacy policy text, a personal data exporter or an eraser.

What is stored

• Settings (your company details and choices) in the option _wphub_invoice, plus the invoice counter and the plugin version in two more options.
• On each order: the sequential invoice number (_wphub_invoice_num), the VAT number the customer typed (wphub_company_vat and, for the block checkout, WooCommerce's own _wc_other/wphub/company-vat) and the direct file address of the PDF (wphub_invoice_url).
• PDF files containing personal data in uploads/wphub-invoice/: the customer's name, company, billing address, phone, email and VAT number, the order contents and the totals. Each file stays until the daily cleanup deletes it, 7 days after it was last written by default, or until you uninstall the plugin. Packing slips are never saved.
• Font cache files of the PDF library in uploads/wphub-invoice/fonts.
• A cached copy of your logo as a transient for one day.

What is sent anywhere

No customer, order or visitor data is sent to any service. The only request the plugin can make is to download your company logo with a plain GET request (15 second timeout, 5 MB limit) when the logo cannot be read from your own site's files: normally an address on another site, but also an address of your own site that does not map to a readable file. It goes to the host in that address, carries no order data, and happens when a PDF is made and the logo is not cached. WordPress adds its usual user agent to that request, which contains the WordPress version and your site address. The PDF library is allowed to fetch remote images that a custom template references; the standard templates reference none.

If you installed the plugin from the WordPress.org directory, WordPress itself contacts WordPress.org to look for updates, as it does for every plugin there. The plugin makes no update request of its own.

Deactivation and uninstall

• Deactivating clears the daily cleanup event. Everything else stays: settings, counter, order meta and the PDF files (nothing deletes them while the plugin is off).
• Deleting the plugin runs uninstall.php, which clears the cleanup event, deletes the whole uploads/wphub-invoice folder with its PDFs, fonts and protection files (through the WordPress file system API, so it does nothing if that API needs FTP credentials), and deletes the option wphub_invoice_version. On multisite this applies to the site where the uninstall runs.
• It keeps on purpose the settings option _wphub_invoice, the counter _wphub_last_invoice_number and the invoice numbers and VAT numbers on orders, so that reinstalling never re-issues an invoice number that was already used. The logo transient expires within a day. To remove the settings and counter, delete those options yourself.

9. Troubleshooting

10. FAQ

11. Changelog

1.6 - 2026-09-29

• Fix - Checkout, order emails and other front-end requests could stop with a fatal error ("Call to undefined function wp_tempnam()") the first time a remote company logo was downloaded.
• Fix - The customer's name and company were printed twice on invoices and packing slips (once on their own and again inside the formatted address).
• Fix - Packing slips showed an empty "Ship to" block and "Shipping Method" row for orders without a shipping address or shipping method.
• Feature - Invoices now list item details (variation attributes, product add-ons and other item meta) under each line, like the packing slip.
• Dev - New template placeholders {billing_address_only} and {shipping_address_only} (the formatted address without the name and company lines).
• Tweak - Updated the bundled libraries: masterminds/html5 2.11.0 and sabberworm/php-css-parser 9.5.0. Dompdf 3.1.6, php-font-lib 1.0.2 and php-svg-lib 1.0.2 are the latest releases.
• Fix - Sequential numbering: the first invoice got the starting number + 1 instead of the configured starting number. Raising the starting number later now takes effect; lowering it never re-issues a used number.
• Security - Generated PDFs were stored as uploads/wphub-invoice/invoice-{number}.pdf, i.e. publicly downloadable by guessing the number. Files now carry an unguessable site-specific hash, the folder is protected (index.php + .htaccess) and old files are removed on update. PDFs are always delivered through the permission-checked download links.
• Security - Customer checkout data (company, name, phone, email, VAT number) was inserted into the PDF HTML unescaped, allowing markup (e.g. remote images) to be injected into the PDF renderer. All values are now escaped.
• Feature - VAT Number field now also works with the WooCommerce Checkout block (Checkout Fields API); the value appears on the invoice, packing slip and the admin order screen.
• Feature - "Invoice" download action in My Account > Orders.
• Fix - Customers could download an "invoice" for pending, failed or cancelled orders (and use up sequential numbers). Customer downloads are now limited to orders in a "Generate Invoice" / "Mark as Paid" status or that already have an invoice.
• Fix - Emails and downloads could deliver an outdated invoice (e.g. without the PAID label, or before an order edit) for up to 7 days; the PDF is now re-rendered for the current order when attached or downloaded.
• Fix - Fatal error when the email attachments filter ran for an email without an order (e.g. account emails) or was applied with three arguments.
• Fix - "Page X of Y" was never printed (embedded PHP is disabled in Dompdf); page numbers are now drawn natively on invoices and packing slips.
• Fix - Bold text in the templates fell back to a serif font; Cyrillic, Greek and other non-Latin customer names printed as "?" (DejaVu Sans fallback added).
• Fix - Fatal error on invoices containing a deleted product or a zero-quantity line.
• Fix - PHP warnings on fresh installs before the settings were saved; clearing all "Generate Invoice", "Mark as Paid" or "Attach to Emails" choices silently restored the defaults.
• Fix - Plugin did not load on multisite when WooCommerce was activated per site instead of network-wide.
• Fix - The settings screen also wrote a redundant autoloaded "wphub-invoice" option (removed on update).
• Fix - Advance Partial Shipment documents were streamed with an invalid file name; {shipping_phone} placeholder added.
• Tweak - Settings are sanitized per type (URL, email, number); the company logo is cached instead of being downloaded for every PDF.
• Tweak - Removed unused Dompdf files and the DejaVu Sans Mono / DejaVu Serif fonts (plugin size 11 MB to 7 MB). Bundled Dompdf is 3.1.6 (latest; includes the 2026 security fixes).
• Tweak - Tested with WordPress 7.1 and WooCommerce 11.1 (HPOS and Checkout block) on PHP 8.2 - 8.5. Minimum PHP lowered to 7.4 (the code and the bundled libraries support it).
• Dev - New filters: wphub_invoice_dompdf_options, wphub_invoice_placeholders, wphub_invoice_number, wphub_invoice_customer_can_download, wphub_invoice_page_number_text, wphub_invoice_paper_size, wphub_invoice_date_format, wphub_invoice_cleanup_days.

1.5 - 2026-09-16

• Fix - Placeholder replacement in invoice/packing-slip templates used order and customer data (billing address, company name, VAT number, etc.) as a preg_replace() replacement string; a value containing "$1" or similar could be interpreted as a regex backreference and silently corrupt the generated PDF. Switched to a plain, safe string replacement.
• Fix - Sequential invoice numbering read-then-wrote the "last invoice number" option non-atomically, so two orders changing status at nearly the same time (e.g. a bulk status update) could be assigned the same invoice number. The increment is now atomic.
• Fix - The admin-only invoice preview AJAX endpoint accepted a "template" value that was used to build a filesystem path without validation, and had no capability check beyond the nonce. Added a capability check and restricted the value to known template files.
• Fix - The CSS/JS cache-busting version constant was stuck at an older value than the plugin version across the last two releases, so updated assets could be served from a stale browser cache. It now matches the plugin version.
• Tweak - Removed a leftover unused debug variable from the invoice preview script.

1.4 - 19/08/2026

• Tweak - Text domain renamed to "pdf-invoice-for-woocommerce" to match the plugin slug and improve translation loading reliability.
• Tweak - Improved escaping, security, and WordPress coding standards for better Plugin Check compliance.
• Feature - Added daily background cleanup to automatically delete generated PDF invoices and packing slips older than 7 days from the uploads directory.
• Feature - Added Download Invoice and Download Packing Slip icons to the WooCommerce Orders list action column.
• Feature - Added a Download Invoice button to the front-end order details page for customers.
• Feature - Added Packing Slip PDF generation.

1.3 - 01/03/2026

• Fix - Packing slip PDF preview fix.

1.2 - 14/03/2024

• Fix - HPOS Compatibility.

1.1 - 25/03/2023

• Fix - Packing Slip added for advanced partial shipment plugin.

1.0 - 10/11/2022

• Initial Release.

12. Support

Open a topic in the WordPress.org support forum, or email support@wpexpertshub.com. Please include:

• your order ID, if you have one,
• the plugin version (1.6 or whichever you run), your WordPress, WooCommerce and PHP versions, and whether you use HPOS and the classic or block checkout,
• the order status, the email involved and the exact message shown, and
• what you already tried, and any error from your PHP error log.