README

Legal Pages Lite

The standard legal pages, done right. Dutch / English / German legal page templates with configurable merge fields for company details — accessible, SEO-ready, per-sales-channel. Drop in, fill in the admin fields, ship.

License: MIT · Shopware: 6.7.x · PHP: 8.2 or newer

🇬🇧 English · 🇳🇱 Nederlands · 🇩🇪 Deutsch

📖 More context: Why we built this · How it compares

⚠️ IMPORTANT — this plugin provides TEMPLATE legal text. Have a legal professional (Dutch / German / EU consumer law) review your configured text before it's exposed to real customers. Templates are a starting point, not a guarantee.

Free edition — frozen. This free edition stays available and keeps working, but gets no new features. It receives security and Shopware compatibility fixes until at least December 2032. New features go into the paid edition of this plugin, coming to the Shopware Store; your data and settings carry over when you switch. The two cannot be active together: once the paid Legal Pages plugin (2.0 or later) is active, this plugin refuses to activate. Questions or help with switching: tenbruggencatedevelopment.nl/en/contact

Screenshots

Privacy page on desktop — branded title, locale-aware 'Last updated' date below the heading, sectioned body content with merge-field-resolved company details.

_{Privacy page with its "Last updated" timestamp}

Privacy page on mobile — fully responsive, last-updated line wraps below the heading, body sections stack cleanly.

_{Privacy page — mobile (responsive)}

What it does

Every Shopware store needs imprint, privacy, shipping, returns, and a disclaimer. Most shops either (a) copy-paste text from another site (legal risk) or (b) leave them as Lorem Ipsum until launch day (worse legal risk). This plugin ships sensible nl/en/de defaults based on Dutch EU-compliant consumer-law templates, with your company details merged in from the admin at render time.

Five pages, routable out of the box
Merge-field pattern — admin fills in company details once; every page picks them up
Three locales — nl-NL, en-GB, de-DE
Per-page toggle — disable pages you don't need (e.g. if you already have a custom privacy page elsewhere)
Per-page "Last updated" timestamp — five optional datetime config fields let you record when each page was last reviewed. Renders below the page heading as a localised line (Last updated 9 May 2026 / Laatst bijgewerkt op 9 mei 2026 / Zuletzt aktualisiert am 9. Mai 2026) using Twig's format_date('long'). Wrapped in <time datetime="YYYY-MM-DD"> for machine readers and Schema.org. Empty config hides the line

Install

composer require tenbruggencate/legal-pages-lite
bin/console plugin:refresh
bin/console plugin:install --activate TenBruggencateLegalPages
bin/console cache:clear

Pages

Route	Path	Content
`legal.voorwaarden`	`/legal/voorwaarden`	Algemene Voorwaarden (Terms & Conditions)
`legal.privacy`	`/legal/privacy`	Privacyverklaring (Privacy Policy)
`legal.verzending`	`/legal/verzending`	Verzendinformatie (Shipping Info)
`legal.retour`	`/legal/retour`	Retourbeleid (Return Policy)
`legal.disclaimer`	`/legal/disclaimer`	Disclaimer

Configuration

Configurable per sales channel from Extensions → Legal Pages.

Field	Purpose
`companyName`	Company name (e.g. "Mijn Webshop B.V.")
`companyAddress`	Full postal address
`companyEmail`	Contact email
`companyPhone`	Phone number
`kvkNumber`	Chamber of Commerce number (KvK)
`btwNumber`	VAT / BTW number
`returnDays`	Return period in days (EU minimum: 14)
`shippingCost`	Standard shipping cost
`freeShippingThreshold`	Free shipping above this amount
`enableVoorwaarden` / `enablePrivacy` / `enableVerzending` / `enableRetour` / `enableDisclaimer`	Per-page kill switches

Merge fields

The following placeholders are replaced with your configured values at render time:

{companyName}, {companyAddress}, {companyEmail}, {companyPhone}, {kvkNumber}, {btwNumber}, {returnDays}, {shippingCost}, {freeShippingThreshold}

To override any page's template, copy src/Resources/views/storefront/page/legal/<slug>.html.twig into your theme and edit. The merge-field resolver runs against whatever HTML/Twig you ship.

Standards

Performance — static template rendering; no DB queries at request time. Merge-field substitution is a single strtr() call.
SEO — proper <title> and <meta description> derived from the page content, stable URLs, a self-referencing canonical, and one sitemap.xml entry per enabled page. Indexing is gated on configuration: for as long as companyName or kvkNumber is empty on a sales channel, that channel's legal pages are served with <meta name="robots" content="noindex,follow">, emit no canonical, and are withheld from the sitemap — an unconfigured shop renders empty merge fields, and thin legal text is worse in the index than no legal text. The rule lives in a single service, src/Service/LegalPagesReadiness.php, which both LegalPageController and LegalPagesUrlProvider read, so the meta tags and the sitemap can never disagree. Fill both fields in and the pages are indexable again on the next uncached request.
GDPR — the privacy page template explicitly documents what you collect, why, and how long you keep it. Adapt the template to match your actual processing; don't leave the defaults unread. The plugin itself stores no visitor data — full data-flow documentation in GDPR.md.
WCAG 2.2 AA — semantic heading hierarchy (h1 / h2 / h3), proper lists for enumerated terms, keyboard-accessible <a> tags, no colour-only information. Live axe-core audit output + desktop + mobile screenshots: docs/ACCESSIBILITY.md.
Security — merge-field substitution is done on server-side; no user input reaches the templates. All admin-supplied values are escaped via Twig.
Uninstall — plugin:uninstall --keep-user-data preserves every TenBruggencateLegalPages.config.* row (company name, VAT, KvK, per-page toggles); without the flag the destructive path clears them all. No owned tables.

Production-readiness checklist

A deliberately short list of things to verify before enabling the plugin on a customer-facing storefront. Not legal cover — the MIT license already disclaims warranty AND the templates ship with a "have a lawyer review before going live" disclaimer in their getting-started copy — but practical guidance an experienced operator would want anyway.

[ ] Have a legal professional review the rendered text for your jurisdiction. The defaults are based on Dutch / EU consumer-law templates; UK shops post-Brexit, Swiss shops, and shops outside the EEA need adjustments. The plugin's intro banner in admin already says "TEMPLATES, not legal advice" — heed it.
[ ] Fill every merge field that appears on a page you've enabled. Blank optional fields have their line dropped from the rendered page, but companyName and kvkNumber are load-bearing: while either is empty the pages are held back with noindex and kept out of the sitemap. The configuration UI flags blanks but doesn't block save.
[ ] *Set per-page `lastUpdated` dates the moment you ship the reviewed text** — visible "last reviewed" dates are a soft trust signal for visitors and a hard one for consumer-protection authorities. Date-pickers in the admin take seconds.
[ ] Decide which pages you actually want. The five toggles (enableVoorwaarden, enablePrivacy, etc.) default to on; turn off any you have a custom version of elsewhere (e.g. an existing privacy CMS page) so the plugin's route returns 404 instead of competing.
[ ] Test on staging that the routes resolve. The plugin's routes are at /legal/voorwaarden, /legal/privacy, etc. — make sure your theme's footer links point at them (or your custom URLs, if you remap).

Compatibility

Core platform

Shopware	PHP	Status
6.7.x — tested with Shopware 6.7.15	8.2 or newer	Stable
6.6.x	—	Not supported
6.5.x and earlier	—	Not supported

Database

Engine	Version	Notes
MySQL	8.0+	Primary target; JSON functions used for config-row manipulation in migrations
MariaDB	10.11+	Tested end-to-end; earlier versions lack some JSON operator support

Browsers (storefront)

Evergreen browsers only — the two most recent stable releases of each:

Browser	Desktop	Mobile
Chrome / Chromium	✅	✅
Firefox	✅	✅
Safari	✅ (macOS)	✅ (iOS 16+)
Edge	✅	—

Internet Explorer and legacy Edge are not supported. The plugin emits no runtime JS (where applicable) so graceful degradation on older browsers usually still renders content, just without progressive enhancements.

Admin browsers

Same evergreen matrix — the Shopware admin is Vue-based and has its own compatibility baseline that this plugin doesn't extend or narrow.

Development

Tool	Version	Scope
PHP	≥ 8.2	Runtime + test suite
Composer	2.x	Dependency management
Node.js	≥ 18	Only needed if you edit SCSS and re-run the theme compile
Python	≥ 3.9	Only needed for the repo's asset-pipeline scripts (`scripts/*.py`)

Accessibility

WCAG 2.2 level A + AA — see docs/ACCESSIBILITY.md for axe-core audit output and per-page violations.

What we test before each release

Full PHPUnit unit suite against PHP 8.2 (source-inspection tests don't need a kernel)
PHPStan level 8 + PHP-CS-Fixer (@PSR12 + @Symfony)
Composer validate on every plugin
Live-DB smoke tests (plugin install → activate → route render → uninstall cycle)
axe-core audit on the primary storefront surfaces (see ACCESSIBILITY.md)

Related plugins

Multi-Brand Lite — per-brand configuration: each sales channel carries its own companyName / kvkNumber / etc., so a multi-brand store renders each brand's legal pages with its own entity details
Maintenance Lite — legal footer links render in the maintenance footer so visitors can still reach imprint / privacy during downtime
Newsletter Lite — /legal/privacy is the natural target for the privacyPageUrl config in Newsletter Lite

Support

Email: guy@tenbruggencatedevelopment.nl
Docs & news: tenbruggencatedevelopment.nl
Source / issues: Bitbucket repo

Security updates and support period

Support period: the latest 1.x release receives security updates until at least December 2032. Fixes ship in the newest 1.x release; updating within 1.x is free and needs no configuration change. Before support ends, the README and CHANGELOG say what comes next.
Free of charge: security updates cost nothing, and are released separately from feature updates where possible (a patch release with only the fix).
How to install them: Plugin Manager → Update, or composer update tenbruggencate/legal-pages-lite followed by bin/console plugin:update TenBruggencateLegalPages and bin/console cache:clear. Shopware does not install plugin updates automatically; check the CHANGELOG Security section after each release.
Report a vulnerability: guy@tenbruggencatedevelopment.nl, never a public issue. Rules: SECURITY.md.
SBOM: a CycloneDX bill of materials is produced for every release and published on the repository's Downloads page; see SECURITY.md.
Removing it securely: uninstall with Delete all app data (or bin/console plugin:uninstall TenBruggencateLegalPages without --keep-user-data) to remove all of the plugin's settings (company details, page toggles and dates).

Made by Ten Bruggencate Development — tenbruggencatedevelopment.nl.

License

Legal template text in snippets is provided under MIT for reuse, but template text alone does not constitute legal advice. You are responsible for adapting it to your business and jurisdiction.

More from Ten Bruggencate Development

Shopware 6.7 plugins in nine families. Analytics, Legal Pages, Maintenance (Launch), Newsletter, Product Encyclopedia and Stock Alert are becoming paid plugins in the Shopware Store; Multi-Brand, Seasons and Social Login stay free on Packagist. Overview: tenbruggencatedevelopment.nl/en/initiatieven/shopware-plugins

Analytics — Matomo or Plausible, cookieless, with e-commerce events
Legal Pages — terms, privacy, shipping and returns pages from templates
Maintenance (Launch) — a branded, SEO-correct (HTTP 503) maintenance page
Multi-Brand — several brands on one Shopware, recognised by domain
Newsletter — GDPR-safe sign-up with double opt-in
Product Encyclopedia — educational content pages linked to your products
Seasons — scheduled theme variants (colours, typography, hero)
Social Login — passwordless login link, Google and Facebook
Stock Alert — "notify me when it's back" with double opt-in

tenbruggencate / legal-pages-lite

Package info

Security

Statistics