Relvato — Continuous Monitoring

by relvato

Description

Relvato is a website monitoring platform. It runs monitors against your site in a real
browser: checkout, logins, sign-ups, contact forms, page speed, search visibility and security. This plugin connects
your WordPress site to your Relvato account, so the monitors run again the moment something changes, and can see
what a monitor running from outside can’t.

What the plugin adds:

Runs after every change (Pro and up). A plugin, theme, WordPress or WooCommerce update tells Relvato to re-run
the monitors that change can affect, so a broken checkout is caught minutes after the update, not days later. On
the free plan you start the runs yourself, from WordPress or the Relvato app, or run them weekly.
Monitors that need to be inside. Logged-in checkout and account pages through a dedicated test customer,
test orders that never touch your stock, stay out of your analytics and ad platforms (and move themselves to
the Trash), form tests that don’t email your
team, WooCommerce health, backups, Site Health, PHP errors and failed emails.
Security from the inside. File integrity against WordPress.org checksums, signs of a hack in themes,
uploads and options, new administrators, leftover backup files, and hardening you can switch on and off.
Fixes you apply. When a run proposes a fix (rolling back a plugin update, turning search indexing back on,
clearing a cache…), it appears under “Relvato suggests” in WordPress Relvato, and an administrator applies it
there with one click. Relvato then re-runs its monitors to verify it, and every fix can be undone. Relvato never
applies a fix or changes a plugin on its own.
AI assistants. On WordPress 6.9+, Relvato’s abilities (site status, monitors, the brief for fixing a
failure) are available to AI assistants through the WordPress Abilities API, for administrators only.

The plugin needs a Relvato account; there is a free plan (plans). Nothing is sent
to Relvato until you connect the plugin.
Every request between your site and Relvato is signed with your site’s own secret.

Five features are off until you turn them on in Relvato Settings: the activity log (sign-ins, key changes,
PHP errors and failed emails), the test login, form tests, real-user Web Vitals and the outside-services map. When
you set up monitoring in the plugin, its last step lists the ones your chosen monitors need, with what each does:
test login and form tests are ticked, the activity log and real-user Web Vitals are not, and only the ticked ones go
on with the monitors. A monitor that needs one that’s off tells you which, in Relvato, instead of running.

External services

This plugin connects your site to Relvato, a website monitoring service run by Relvato
(terms, privacy policy). Nothing below happens
until you connect the site, by clicking “Connect with Relvato” or pasting your connect token.

Relvato (app.relvato.com). Used to run your monitors and show their results.

When you click Connect with Relvato, your browser goes to app.relvato.com with your site’s address, the way
back to your WordPress admin, a one-time check value, the active theme and the well-known plugins it runs, by name
(for example WooCommerce, Yoast SEO, Wordfence, WP Rocket, Elementor), so you can sign in and confirm the site. When you come back, the plugin sends a
one-time code, the matching secret and your site’s address to app.relvato.com to receive your connect token.
When something changes on the site, the plugin sends a signed event about the change: plugin, theme, WordPress
and WooCommerce updates, activations and theme switches; new administrators and role changes; and, while
quarantine mode is on after a hack, new scheduled tasks and uploaded executable files. Each event names the
WordPress user who made the change.
While the activity log is on (off until you turn it on): administrator and editor logins (with the login name,
role and the first part of the IP address) and counts of failed logins (never the usernames tried); changes to key
settings (site address, registration, search visibility); edits made in the theme and plugin file editors;
application passwords created or deleted; deleted administrators; and new PHP fatal errors and failed emails (the
recipient’s domain only). With it on, the plugin also keeps when each administrator last signed in (on the site)
and includes that time in the security review of accounts below, so Relvato can point out administrators nobody
uses; switching the activity log off deletes those times.
While the outside-services map is on (off until you turn it on): for each server-side request a plugin or
theme makes to another server, the plugin’s or theme’s folder name and the host name it called (never the full
address, what was sent or what came back), with the day it was first and last seen. Kept in your site’s options
and read by Relvato’s Exposure scan; switching it off deletes it.
Every six hours the plugin sends its version, which well-known plugins are active, by name (for example Yoast SEO,
Wordfence, WP Rocket, WooCommerce, a form or caching plugin), the active theme, the search visibility setting,
whether its REST routes can be reached (and if not, which plugin blocks them) and which of the features above are on.
When you open the Relvato pages in WordPress, the plugin fetches your monitors’ status and Relvato’s suggestions,
and sends the actions you start there (such as running a monitor).
When an administrator applies a suggestion there, the plugin first asks app.relvato.com to start a plugin update or
deactivation (so Relvato can verify it), then reports what was applied: which suggestion, whether it worked (and
WordPress’s error if not), the hardening settings now on, and the WordPress user who applied it. A quarantine’s
auto-update pause, a released update hold and an undo are reported the same way.
Relvato’s monitors call the plugin’s own REST routes, signed with your site’s secret, to read results such as
WooCommerce health, file checksums and installed plugin versions. None of them can change plugins, themes,
settings or code; the only things they create or change are Relvato’s own test data (the test customer below, test
orders, form-test entries and test emails). The security
review of accounts reads the administrator and other privileged accounts (login name, display name, roles, when the
account was created, the domain of its email address and the names of its application passwords), and the ways in that skip the login form: WooCommerce REST API keys (their description,
owner, access and the last characters WooCommerce shows) and OAuth clients. Administrator passwords and API keys
are never sent.
While Test login is on (off until you turn it on), the plugin keeps one dedicated test customer account (it
creates it as a customer, or a subscriber without WooCommerce; never an administrator, and it refuses any account
that can do more than shop). For logged-in monitors, a request signed by Relvato signs Relvato’s browser in as that account (a session
cookie, nothing stored). To test the real login form, Relvato can ask for that account’s login: the plugin sets a
new random password on it and returns the username and that password over the signed connection. Relvato can also have WordPress send that account’s
lost-password email (to the Relvato test inbox), to check the reset email goes out. No other account’s password is
set or sent.
While AI assistant abilities are on, an AI assistant working in your WordPress admin (as an administrator) can
ask the plugin for the site’s status, its monitors or the fix brief for a run, or start monitors; each request goes
to app.relvato.com, and nothing is sent until an assistant asks.
While connected, your homepage carries <meta name="relvato-site"> with your Relvato site’s ID, so Relvato can
confirm the connection from outside. It isn’t a link and shows nothing to visitors.

Relvato real-user speed measurement (app.relvato.com). While real-user Web Vitals is on (off until you turn it on), a small script on
your public pages measures how fast each page loads for a sample of visitors and sends the timings, the page type,
whether the device is a phone or a computer, and (for slow pages) the slow element and resource to
app.relvato.com/api/vitals. It sets no cookies and doesn’t identify visitors. The script is part of the plugin
(assets/vitals-beacon.js); nothing is loaded from Relvato.

Relvato test inbox (verify.relvato.com). During a contact-form test (while form tests are on) or an email
monitor, the test message goes to a Relvato address for your site instead of to your team, so Relvato can confirm it
arrived.

WordPress.org (api.wordpress.org, downloads.wordpress.org). File integrity compares your WordPress core and
plugin files with WordPress.org’s published checksums. Rolling a plugin back or reinstalling it downloads that
version from WordPress.org. See the WordPress.org privacy policy.

Installation

Install and activate the plugin.
In WordPress, open Relvato Settings and click Connect with Relvato. Sign up or sign in (free, no card),
confirm the site, and you come straight back to WordPress, connected.
Or, if you already have a connect token from the Relvato app (the site’s Settings Connection), paste it on the
same page and save.

Screenshots

Once connected, Relvato can monitor your critical site flows, SEO / AEO readiness, site security, performance, domain, legal pages or accessibility.
Choose when your monitors run: on a schedule, and again automatically after WordPress, theme or plugin updates.
The Relvato dashboard in WordPress: every monitoring group at a glance — what passes, and what needs a look.
Relvato suggests safe, reversible fixes. You apply each one in WordPress with one click, switch it back off any time, and Relvato re-runs its monitors to confirm.
Performance in WordPress: lab Core Web Vitals against Google's "good" limits on one radar, with the biggest wins to fix first.
Legal compliance: Relvato checks for a privacy policy, terms and an accessibility statement, and flags cookie consent and tracking problems — with a suggested fix for each.
Every run in WordPress: what ran, what it found, and when — with the full details one click away in Relvato.
The Relvato app: each site at a glance — monitors passing, what's ready to run, results over time and every run, for all your sites in one place.

Faq

Is Relvato free? What does the free plan include?

Yes, and it stays free: one site, 100 runs a month and every monitor except custom monitors and AI-feature monitors,
with no card. On the free plan you start the runs, from WordPress or the Relvato app, or schedule them weekly. Paid
plans re-run the monitors by themselves after every update, add daily and faster schedules and alerts, and cover more
sites. See https://www.relvato.com/pricing.

Does Relvato need my password or my customers’ passwords?

Never yours or your customers’. For logged-in monitors the plugin signs Relvato’s browser in as a dedicated test
customer it creates (never an administrator), using a short-lived signed token. To test the real login form, Relvato
asks the plugin for that test customer’s login: the plugin sets a new random password on that one account each time
and returns it with the username, over the signed connection. This only happens while Test login is on in the
plugin’s settings.

Will monitors change my stock or create real orders?

A checkout monitor set to “Full order” places a real test order — that’s how it proves your checkout works. The
plugin marks it (order meta _relvato_test), doesn’t reduce stock for it, doesn’t email you about it, and moves it to
the Trash a few minutes later. Monitors that stop before “Place order” create no order at all. Turning off “Protect
stock & auto-remove” in the plugin’s settings keeps test orders (and their stock change) instead of removing them.
So that stores taking only cards can be tested too, the plugin creates a 100% discount coupon that works only inside
Relvato’s signed test requests, never for a shopper; it is deleted when you deactivate the plugin.

Will test orders show up in Google Analytics, Google Ads or Meta?

No. The plugin switches off the purchase event for test orders in
Pixel Manager for WooCommerce (browser, conversion recovery and server-side), Google for WooCommerce, Google Analytics
for WooCommerce, Site Kit, GTM4WP, Facebook for WooCommerce (pixel and Conversions API), PixelYourSite, Pinterest for
WooCommerce and TikTok. Relvato’s test browser also refuses analytics consent and blocks the ad and analytics
collection addresses while it places the order. On WooCommerce 10.7 and later, test orders are also kept out of
WooCommerce Analytics. For your own reports and conversion uploads, skip orders for which
relvato_is_test_order( $order ) returns true.

Can Relvato change my site?

Not on its own. Relvato suggests changes; an administrator applies each one in WordPress Relvato, where the plugin
makes it from a fixed list of reversible actions built into the plugin: for example rolling a plugin back to the
version before an update, updating or switching off a vulnerable plugin, or turning search indexing back on. Each
needs the matching WordPress permission (for example “update plugins”). No request from Relvato’s service can
install, update, activate or remove a plugin or theme, or change your settings or code. What it can ask for is limited
to Relvato’s own test data: while Test login is on, the dedicated test customer (the plugin creates that one account,
never an administrator, signs Relvato’s browser in as it, sets its password and sends its lost-password email to the
Relvato inbox); the test orders, form entries and test emails its monitors make, and removing them. The plugin never
runs code it receives, and every applied fix can be undone there.

Does the plugin change WordPress updates?

Only when you ask it to. After you roll a plugin back, Relvato holds the version you left, so WordPress doesn’t put
it straight back: automatic updates skip it and installing it is refused until you release the hold (“Release the
hold” on that plugin’s row on the Plugins screen). While quarantine mode is on after a hack, an administrator can
tick “Pause plugin and theme auto-updates” in WordPress Relvato. Nothing else about WordPress’s updates is changed.

Does the plugin change how my forms handle spam?

Only for Relvato’s own test submissions, and only while Form tests is on: for a submission carrying Relvato’s
marker in a request signed with your site’s secret, the form plugin’s CAPTCHA check and Akismet are skipped through
the form plugin’s own filters, its notification goes to your site’s Relvato inbox instead of your team, and the test
entry is deleted afterwards. Every other submission is handled exactly as before.

What does security hardening change?

Nothing until you switch an item on in Relvato, and each can be switched off again: XML-RPC off (not while Jetpack
is active), the public user list and username lookups by number hidden, the WordPress version tag and the
X-Powered-By header removed, the theme and plugin file editor turned off (the same as DISALLOW_FILE_EDIT; a value
already set in wp-config.php wins), a few safe security headers added where the site sends none, and an empty
index.php added to the uploads folders.

Does the plugin keep backups?

Only of plugins that aren’t from WordPress.org, and only once the site is connected. When one of those updates, the
plugin first zips the version being replaced into wp-content/relvato-backups (closed to web visitors), so Relvato can
roll the update back if it breaks the site; WordPress.org plugins are rolled back from WordPress.org instead. It keeps
the two newest backups per plugin, for up to 60 days.

What happens when I remove the plugin?

Deactivating stops all communication with Relvato. Deleting the plugin also removes its settings, the test
customer and Relvato’s plugin backups.

Reviews

Changelog

1.77.2 (2026-10-15)

Changed: Relvato is now on WordPress.org, and the plugin updates from there like any other. Sites that installed it from relvato.com move over with this version; nothing to do.

1.77.1 (2026-10-11)

Fixed: wp-config.php is checked for malware patterns again (only the pattern’s name is reported; 1.77.0 skipped it along with its hash).
Readme: says exactly what Relvato’s requests can create or change — only its own test data, including how the test customer is signed in.

1.77.0 (2026-10-11)

Changed: Relvato never applies a fix or changes a plugin on its own. Fixes, plugin updates, rollbacks, deactivations and their undo are applied by an administrator under “Relvato suggests” in WordPress Relvato (each needs the matching WordPress permission); the plugin then tells Relvato, which re-runs its monitors to verify the change. The routes Relvato’s service used to apply them are removed.
Changed: during quarantine mode, pausing plugin and theme auto-updates is a tick box in WordPress Relvato, set by an administrator.
Changed: Relvato’s scheduled update window no longer runs on sites with this version; WordPress’s own automatic updates keep working, and an update that breaks a monitor is offered as a one-click rollback in WordPress Relvato.
Security: the plugin no longer reads the values of your WordPress keys and salts, and wp-config.php is no longer part of the file fingerprint. Every admin page is escaped as it’s printed. The activity log and quarantine record a file-editor save only with WordPress’s own check for that save.

1.76.2 (2026-10-09)

Changed: “Tested up to” is declared only in this readme, no longer in the plugin file’s header, as WordPress.org now requires.

1.76.1 (2026-10-09)

Fixed: the Runs list heading (“The latest 5 runs”) now translates correctly in languages whose singular form also covers numbers like 21.

1.76.0 (2026-10-09)

Changed: on setup’s last step, the activity log and real-user Web Vitals start unticked; only the switches you tick go on with your monitors. Test login and form tests stay ticked.
Changed: backups of plugins that aren’t from WordPress.org are kept only once the site is connected.
Changed: the description and the dashboard group “Legal & accessibility” no longer say “legal compliance”: Relvato reports what it finds on your legal pages, cookie banner and accessibility; it doesn’t certify anything.
New: suggested privacy-policy text for the real-user speed script and the activity log (Settings Privacy Policy Guide).
Fixed: with two copies of Relvato in two plugin folders, activating the second no longer stops with a fatal error.
Readme: the FAQ and External services now say exactly what Test login sends, and when plugin backups are made.

1.75.1 (2026-10-09)

Fixed: a monitor still collecting data (Real-user Web Vitals before enough page views) no longer counts as “couldn’t run” on the Overview’s “Monitors passing” row. It’s ready — Ready to run says so — and the row now shows it as “1 collecting data”, with a note that it’s counted once there’s enough.

1.75.0 (2026-10-08)

New: the Overview’s “Monitors passing” row now says how many monitors passed and how many it leaves out — e.g. “26 of 27 passing · 3 couldn’t run”. Monitors that couldn’t run or haven’t run yet aren’t in the percentage, so a 100% that covers only part of your monitors now says so. “Ready to run” shows why each one is left out.

1.74.2 (2026-10-08)

Changed: the Overview’s “Site health” card is now “Monitors passing” — it was always the share of your monitors whose latest run passed, not a score for the whole site. “Health over time” is now “Passing over time”. Nothing about how it’s counted changed.

1.74.1 (2026-10-08)

Fixed: switches ticked on setup’s last step — Test login, form tests, the activity log — weren’t saved (only Real-user Web Vitals was), so Customer login and Logged-in checkout still reported Test login as off. They’re saved now. If you set up with 1.74.0, turn Test login on in Relvato Settings.

1.74.0 (2026-10-08)

New: setup’s “When should they run?” step lists the plugin switches your chosen monitors need — Test login, Real-user Web Vitals, form tests, the activity log — with what each does, ticked. They go on with your monitors (untick any first), so Customer login, Logged-in checkout and real-user Web Vitals run from the start instead of waiting for you in Settings.

Earlier versions

The full history is at https://www.relvato.com/changelog