I’ve lost count of how many times I’ve had to explain to a client why their store slows down the moment they hit 50,000 orders. Usually, it’s not the server—it’s the way WooCommerce handles data serialization. The WooCommerce 10.7 update finally addresses one of the most annoying bottlenecks we’ve been fighting: the N+1 query pattern on the REST API. If you’ve been putting off the switch to High-Performance Order Storage (HPOS), this release might be the reason you finally pull the trigger.
HPOS and the 51% Query Reduction
The headline for the WooCommerce 10.7 update is definitely performance. Specifically, the /wc/v4/orders endpoint. In previous versions, fetching orders was a database nightmare because of N+1 query patterns during serialization. One request could trigger 271 queries. With the new cache priming logic, that’s down to 132 queries—a 51% reduction. Furthermore, the Store API product endpoint now skips database hits entirely when the Last-Modified timestamp is cached.
If you’re running a high-traffic store, you can also leverage a new filter to skip redundant order count refreshes. This is particularly useful if you’re already managing these counts via an external cache like Redis or Memcached.
// Skip redundant order count refreshes in high-traffic scenarios
add_filter( 'woocommerce_pre_refresh_order_count_cache', '__return_true' );The Fulfillments API is Maturing
We need to talk about the Fulfillments API. It’s still in Beta, but it’s becoming a proper architectural piece. The move from Automattic\WooCommerce\Internal to Automattic\WooCommerce\Admin signals that it’s getting closer to a stable public API. Specifically, we now have typed PHP methods to handle tracking data, which is a huge relief for anyone building custom ERP integrations.
You can now interact with fulfillment tracking data using clean, typed methods rather than wrestling with raw meta keys:
<?php
function bbioon_update_fulfillment_tracking( $fulfillment_id, $tracking_number ) {
// Note: Fulfillments is currently a Beta feature
$fulfillment = wc_get_fulfillment( $fulfillment_id );
if ( $fulfillment ) {
$fulfillment->set_tracking_number( $tracking_number );
$fulfillment->set_shipping_provider( 'ups' );
$fulfillment->save();
}
}For more on how to optimize these endpoints, check out my guide on optimizing WooCommerce REST API performance.
Security and the Database Catch
This release includes a database update (wc_update_1070_disable_hpos_sync_on_read), so don’t just “Ship it” on a Friday afternoon without a staging backup. Security-wise, there’s some much-needed hardening. XSS protection via wp_kses_post() is now enforced on the v4 order notes endpoint, and CSRF validation has been added to the product ordering AJAX handlers.
One small but significant fix: payment gateway password fields now use trim() instead of sanitize_text_field(). I’ve seen this break many integrations where users had a % character in their password that got stripped out during the “sanitization” process.
Look, if this WooCommerce 10.7 update stuff is eating up your dev hours, let me handle it. I’ve been wrestling with WordPress since the 4.x days.
The Takeaway
The WooCommerce 10.7 update isn’t just another incremental release; it’s a massive refactor of how order data flows through the API. If you’re managing a large store, the performance gains on the orders endpoint alone make the update worth the effort. Just be sure to test the Fulfillments API changes if you have custom shipping logic, as the namespace changes could break legacy code. For the full technical breakdown, see the official WooCommerce 10.7 developer notes.
