=== ThemeChum Checkout Monitor for WooCommerce ===
Contributors: themechum
Tags: woocommerce, checkout, monitoring, uptime, testing
Requires at least: 6.5
Tested up to: 7.1
Stable tag: 1.2.3
Requires PHP: 8.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Catch a broken WooCommerce checkout early. A real test order runs on your schedule and alerts you when it fails, not when your sales stop.

== Description ==

Your homepage loads. Your ads are still spending. Your uptime monitor is green. And nobody has bought anything for six hours, because the checkout is throwing an error that only appears at the payment step.

That is the outage nobody catches. A broken checkout does not look broken from the outside. Everything that normally tells you something is wrong keeps saying everything is fine, because none of those tools ever tries to actually buy something.

This plugin fixes that. Together with the Checkout Monitor service it places a **real, complete test order on your store on a schedule** — add to cart, checkout, simulated payment, order created — and emails you when a step stops working. By default we alert after two failed checks in a row, so a single network blip does not wake you up. That means you hear within about two check intervals of the break (within about six minutes on a 3-minute interval, up to an hour on the free plan's 30 minutes), not when you check your sales figures the next morning. If you would rather hear after the first failure, you can lower the threshold to one check on your store's Edit page.

And it does this without touching your real business data. Every test order is flagged and kept out of WooCommerce Analytics and your transactional emails, and on stores using High-Performance Order Storage (HPOS) it is hidden from your orders list and order counts as well. Your reports stay clean. Your inbox stays quiet.

**What you get**

* A real test checkout, start to finish, on your own store — not a ping, not a page load, an actual order going through the same path a customer takes.
* An alert when checkout fails two checks in a row, or on the first failure if you lower the threshold, with the error and a plain-English explanation of the likely cause.
* A second alert when it starts working again, so you know it is genuinely fixed.
* A warning when your storefront is hidden behind a coming-soon or maintenance page, so you find out before a day of traffic hits a splash screen.
* A check on whether your order-confirmation emails are even configured to send, so a broken SMTP setup shows up before a customer complains that no receipt arrived.
* Test orders kept out of Analytics and every WooCommerce email, and hidden from the orders list and status counts on HPOS stores.

**Why uptime monitoring is not enough**

An uptime monitor asks your server whether a page loads. It does not add to cart, it does not submit a payment, and it does not create an order. A plugin conflict on the checkout page, a shipping or tax rule that throws an error, a fatal error that only fires when an order is written, a coming-soon page left switched on — every one of those leaves an uptime monitor perfectly green while your store takes no orders at all. The only way to know checkout works is to complete a checkout.

== How it works ==

**1. Install and activate this plugin.** It generates a shared secret for your store automatically.

**2. Create your account on your own site.** Go to **Settings → Checkout Monitor**, enter your name, email and a password, then click the confirmation link we email you. Your site connects itself, with nothing to copy. Already have an account? Press **Sign in instead** on that screen. As a manual fallback, you can add the store in your dashboard at [checkoutmonitor.app](https://checkoutmonitor.app/) and paste the shared secret there.

**3. We test your checkout.** Checkout Monitor runs a real test checkout on your store on your plan's schedule and alerts you when one fails.

== Security and privacy ==

The technical detail, for anyone who wants it before installing something that can place orders on their store.

* Every incoming request is verified with an HMAC signature, a timestamp and a single-use nonce, so only Checkout Monitor can trigger a test. Any mismatch is refused with an identical response, giving an attacker nothing to learn from.
* The test product is hidden from your catalog, your search results, the Store API, the classic REST API and the admin product list. Only the verified bot can see it.
* The test payment gateway is available **only** to the verified bot. It never contacts Stripe, PayPal or any real payment provider, and no money ever moves. Real customers cannot see or select it, whatever the enabled toggle in WooCommerce says — availability is decided per request by the signature check.
* Every test order is flagged at creation and suppressed across WooCommerce Analytics and all transactional emails, including the admin new-order notification. On stores using HPOS it is also hidden from the orders list and the status counts; see the HPOS question in the FAQ.
* A signed cleanup endpoint deletes old test orders. While your store is connected, Checkout Monitor calls it every hour to remove test orders older than 24 hours.

**What it does not do**

* It does not take payments, and it does not place orders for real customers.
* It does not modify your theme, your checkout page or any of your existing products.
* It does not send any of your data anywhere on its own. See *External services* below.

A Checkout Monitor account is required, because the service is what runs the checks. You can create one from **Settings → Checkout Monitor** on your own site, or at [checkoutmonitor.app](https://checkoutmonitor.app/). The free plan does not expire and does not ask for a card.

== External services ==

The plugin is inbound by default. It exposes three authenticated REST endpoints that the Checkout Monitor service at **checkoutmonitor.app** calls, authenticated with a shared secret that lives on your own site. Every request without a valid signature is refused.

Checkout Monitor is a service run by ThemeChum at **app.checkoutmonitor.app**. The plugin contacts it only when a site administrator uses the **Settings → Checkout Monitor** screen. It makes no request when you activate it, none on a schedule and none from your store's front end, and it contacts no other external service.

The requests it makes from that screen, all over HTTPS:

* **Create account** — when you press Create account, we receive your name, email address and password.
* **Sign in instead** — when you sign in to an existing account, we receive your email address and password.
* **Connect this site** — once the account's email is confirmed, the plugin asks for the account's list of stores, so it can tell whether this site is already connected, then adds this site, sending its name, its WordPress home URL and its shared secret. Both requests carry the temporary access token.
* **Status checks** — while a sign-up is waiting for you to click the confirmation link, the settings page asks us every 10 seconds whether the email is confirmed, up to 30 times (about five minutes). The **Check now** button asks once. Each check sends only the stored access token. These checks run only while that page is open in your browser.
* **Sign out** — when the site is connected, the plugin asks us to revoke the access token and then deletes it from your site.

Your password is sent once, over HTTPS, and is not stored on your site. While setup is in progress the plugin keeps the access token, encrypted, and the email address you entered; both are deleted when the site is connected or when you start over. After that the plugin holds no session and goes back to answering signed requests only.

Data your store returns when the service calls, and only then:

* **Status endpoint** — whether your WooCommerce order-confirmation emails are enabled, the admin notification recipient address, your store's "from" email address and name, a hint identifying which SMTP plugin is active (if any), and the timestamp of the last plugin, theme or core update. The two email addresses are the only personal data involved; they are needed so the service can tell you whether order emails are actually configured to reach anyone.
* **Payment health (1.2.0)** — for each payment gateway on your store: its id, whether it is enabled, and whether it is available right now. Plus whether an enabled shipping method covers your store's own base country, whether the checkout page uses the block or shortcode checkout, and which of those gateways are offline methods (cash on delivery, bank transfer, cheque). **No settings values, no keys, no customer or order data.** This exists because our test order pays through a test gateway only our bot can use, so a passing check would otherwise say nothing about whether a real customer can pay.
* **Order counts (1.2.0)** — three numbers and a timestamp: how many real orders your store took in the last hour, the last 24 hours and the last 7 days, and when the most recent one came in. Orders created by this plugin's own test checkouts are excluded. **No order contents, no customer names, no addresses, no products.** The counts exist so the service can tell you when a shop that normally sells at this hour goes silent — the one failure that no page-load check can see.
* **Test product endpoint** — the id, slug, SKU, permalink, status and visibility of the hidden test product.
* **Cleanup endpoint** — the number of test orders removed and the number remaining. It requires an explicit confirmation flag in the request body and only ever touches orders this plugin created.

Your customer records, order contents, payment details and site credentials are never read or returned by any of these endpoints.

Using the Checkout Monitor service is subject to its [Terms of Service](https://checkoutmonitor.app/terms/) and [Privacy Policy](https://checkoutmonitor.app/privacy/).

== Installation ==

1. Install and activate WooCommerce, if it is not already active.
2. Install and activate **ThemeChum Checkout Monitor for WooCommerce** from **Plugins → Add New Plugin**.
3. Go to **Settings → Checkout Monitor**. A shared secret is generated for you automatically on activation.
4. Under **Checkout Monitor account**, create your account — name, email, password. We email you a confirmation link; click it and this page connects your site by itself, with the secret already in place.
5. Already have an account? Press **Sign in instead** on that screen and this site connects to your account. Or connect manually: add your store in the [checkoutmonitor.app](https://checkoutmonitor.app/) dashboard and paste the shared secret from this page (under **Connect manually with a shared secret**) into its **Shared secret** field.

That is the whole setup. Monitoring begins on the schedule you choose. Treat the shared secret like a password: anyone who has it can trigger a test checkout on your store.

== Screenshots ==

1. Dashboard: a store whose checkout is failing is flagged DOWN, with the reason in plain language.
2. Store detail: uptime, response-time chart and the latest error at a glance.
3. Slack message when a checkout fails, and another when it recovers.
4. Email alert the moment a checkout fails.
5. Recovery email that says how long the checkout was down.
6. Settings → Checkout Monitor: create your account from your own site. Your name and email are prefilled from this WordPress account; the site connects itself once you confirm your email.
7. Already have an account? Switch to **Sign in instead** and this site attaches to it — your other stores and your plan are untouched.
8. Everything stays visible for support: the shared secret (under **Connect manually with a shared secret**), the endpoint we call, and a **Regenerate secret** button.

== Frequently Asked Questions ==

= Does the plugin read my orders or my customers? =
No. It counts orders — the totals for the last hour, day and week, and the time of the most recent one — and it reads your payment/shipping configuration (which gateways are enabled and available, whether shipping covers your own country). It never reads order contents, customer names, addresses, products, the amounts, or any payment credentials. The counts and statuses are what let the service tell you "nobody has bought anything for an hour" or "no payment method is usable", neither of which a page-load check can see.

= How often is my checkout tested? =

You choose the interval in your Checkout Monitor dashboard, and your plan sets how fast it is allowed to go. The free plan checks as often as every 30 minutes, Pro as often as every 3 minutes, and Agency as often as every minute. You can always run a check by hand from the dashboard as well.

= Is there a free plan, and what does it include? =

Yes, and it does not expire. The free plan covers one store, checks as often as every 30 minutes, sends email alerts, and keeps 7 days of check history. No card is required to start.

= Where do alerts arrive? =

Email on every plan, including free. Pro and Agency add Slack and custom webhooks, so you can route alerts into your own tooling or an on-call system. You can set the alert address per store, and if you leave it blank it falls back to your account email.

= Will it slow down my store? =

No. The plugin adds no CSS or JavaScript to your front end, makes no outbound HTTP requests, and does very little on a normal visitor's page load. When WordPress queries products, it adds the hidden test product to the exclusion list so it stays out of your catalog and search, and the signature check stops immediately when a request is not a signed test. The test checkout itself arrives like one additional visitor on the schedule you choose, which for most stores is a handful of requests an hour.

= Does it work with the block checkout and the classic checkout? =

Yes, both. The test order is placed through WooCommerce's own Store API, which works the same way whichever checkout you use. The page check that looks at your rendered checkout recognizes both the block checkout and the classic shortcode checkout.

= Does it work with my payment gateway? =

The test does not use your real payment gateway, and this is worth being clear about. It uses its own simulated gateway that only the verified bot can reach, so no money moves and nothing is charged. That means a test checkout proves your cart, your checkout, your shipping and tax calculation and your order creation all work — but it does **not** prove Stripe or PayPal is up. If your real gateway has an outage, this test can still pass. Testing with a real gateway would mean taking real payments on your store on a schedule, which we are not willing to do to your books.

= Does a test order reduce my stock or affect my reports? =

No. The test only ever buys its own hidden test product, never one of your real ones, and that product is created without stock management, so no stock count changes. Every test order is flagged and removed from WooCommerce Analytics, so your reports show your real trading and nothing else. On HPOS stores it is also hidden from the orders list and the order status counts.

= What if my store is in maintenance or coming-soon mode? =

Checkout Monitor recognizes a coming-soon or maintenance overlay and tells you your storefront is hidden from shoppers, rather than reporting it as a checkout failure. That distinction matters: your checkout backend may be perfectly healthy while customers are seeing a splash page. It is a common and expensive mistake to leave coming-soon mode on after a redesign, and this is how you find out the same day.

= Do I need a Checkout Monitor account? =

Yes. The plugin only answers signed requests; it never starts anything on its own, so on its own it does nothing. A free account is enough to get started.

= Will test orders appear in my orders list, reports or emails? =

Not in your reports or emails, on any store. Every order created by a verified test is flagged and kept out of WooCommerce Analytics and all transactional emails, including the admin new-order notification.

In the orders list it depends on your order storage. With High-Performance Order Storage (HPOS), test orders are hidden from the list and the status counts. With the older WordPress posts storage they appear there until our hourly cleanup deletes them, once they are 24 hours old and while your store is connected to Checkout Monitor. See the HPOS question below.

= Can a real customer see or use the test payment gateway? =

No. The gateway's availability is decided per request by the signature check, not by the enabled toggle in WooCommerce settings. A request without a valid signature never sees it. It also never contacts a real payment provider, so no money can move through it.

= Is a real payment taken during a test? =

No. The test gateway simulates a successful payment and marks the order paid without contacting any payment provider. Nothing is charged and nothing is captured.

= Why does the test product show a price? =

The test needs a purchasable product to complete a real checkout flow. The product is hidden from your catalog, search, the Store API, the classic REST API and the admin list, so customers cannot find or buy it.

= What happens if I deactivate the plugin? =

Monitoring stops answering and your store will show as unreachable in Checkout Monitor. Your shared secret and settings are kept, so reactivating resumes where you left off.

= What happens if I delete the plugin? =

The shared secret, the stored settings and the replay-protection records are permanently removed. The hidden test product and any test orders this plugin created are moved to the trash, so they leave your lists but can still be restored if you need them. Nothing belonging to WooCommerce or any other plugin is touched.

= I regenerated the shared secret and monitoring stopped working. =

That is expected. Regenerating invalidates the old value immediately. Copy the new secret from **Settings → Checkout Monitor**, then in Checkout Monitor open your store's Edit page, paste it under **Store connection secret** and press **Verify & replace**. Monitoring resumes on the next check.

= Does this work with High-Performance Order Storage (HPOS)? =

Yes, and HPOS is what we recommend. Test checkouts, alerts, email and Analytics suppression, and cleanup all work with either order storage. The one difference is the orders list: test orders are hidden from **WooCommerce → Orders** and its status counts only when HPOS is on. With the older WordPress posts storage they show there until our hourly cleanup deletes them, once they are 24 hours old and while your store is connected to Checkout Monitor.

To check which storage your store uses, go to **WooCommerce → Settings → Advanced → Features** and look at **Order data storage**. To switch from WordPress posts storage, first tick **Enable compatibility mode** and wait for WooCommerce to finish syncing your orders, then choose **High-performance order storage** and save. WooCommerce greys out the HPOS option while any active plugin is incompatible with it, so that plugin has to be updated or deactivated first.

= Does it support multisite? =

Yes. Each site in the network gets its own shared secret and is added to Checkout Monitor separately. On a newly created site the secret is generated the first time an administrator loads the dashboard.

== Upgrade Notice ==

= 1.2.3 =
The sign-up password minimum is now 8 characters, matching the dashboard, and the setup instructions are clearer. Update optional.

= 1.2.2 =
Security hardening, plus a fix that keeps checkout monitoring working. Update recommended.

= 1.2.0 =
Adds payment-health and order-count reporting so the service can spot "no payment method is usable" and "no orders are coming in" — two failures a page-load check cannot see. Counts and statuses only; no customer or order data. No change to your checkout.

== Changelog ==

= 1.2.3 =
* The sign-up password minimum is now 8 characters, matching the dashboard.
* Corrected the External services disclosure, and the earlier 1.1.0 note, to list every request the plugin makes.
* Clearer setup instructions: we now describe creating your account from Settings → Checkout Monitor, with the shared secret only as a manual fallback.

= 1.2.2 =
* Security hardening of the test checkout path and the connection flow.
* The plugin now talks to our API over HTTPS only.
* Uninstall now removes all leftover connection data.
* Test orders are also hidden on stores that still use posts-based order storage.
* Fix: the signed checkout test works again after the hardening.

= 1.2.0 =
* **Payment health.** Every check now also reads your real payment setup: which gateways are enabled, whether each one is actually available, and whether a shipping method covers your own country. The synthetic test order pays through a test gateway only our bot can use, so a passing check used to say nothing about whether a customer could pay. Now it does, and you see it on the store page (PAYMENT / SHIPPING badges) and as an incident if it breaks.
* **Cash on delivery is not card payment.** If the only usable method is offline (cash on delivery, bank transfer, cheque), the badge says so instead of a green "available".
* **Orders stopped.** The plugin reports real order counts (1 hour / 24 hours / 7 days, our test orders excluded). If your shop normally takes orders at this hour and takes none, you get an incident — the one failure no page-load check can see.
* Both new reports are **counts and statuses only**: no customer data, no order contents, no settings values leave your site.
* No change to the checkout, the order flow or the payment path: the plugin reads what WooCommerce already knows.

= 1.1.0 =
* Create your Checkout Monitor account from **Settings → Checkout Monitor** — no need to open the website first.
* Already have an account? **Sign in** from the same screen — it attaches this site to your existing account instead of creating a second one.
* The settings screen now walks through the steps (create/sign in → confirm → connected) and shows the live status of this site.
* The shared secret moved into a **Connect manually with a shared secret** section, collapsed by default: the in-plugin flow never asks you to copy it.
* Confirming your email connects this site automatically: the store is added with this site's URL and shared secret, then the temporary session is revoked.
* The plugin now makes exactly one outbound request, and only when you press **Create account**. External services below describes it.

= 1.0.0 =
* First public release.
