ThemeChum Checkout Monitor for WooCommerce

Powered by Checkout Monitor (https://checkoutmonitor.app).

A silent checkout failure is the most expensive kind of outage. Traffic looks
normal, the homepage loads, ads keep spending — and not a single order comes
through. Uptime monitors report everything green, because nothing they do
actually tries to buy something.

This plugin is the store-side half of Checkout Monitor.
It lets the service complete a real, end-to-end purchase on your store on a
schedule, and tells you the moment that stops working.

The important part is that it does this without touching your real business
data. Every order the test creates is flagged and then suppressed across every
surface a merchant looks at.

What it does

• Verifies each incoming request with an HMAC signature, a timestamp and a
  single-use nonce, so only Checkout Monitor can trigger a test. Any mismatch
  is refused with an identical response, giving an attacker nothing to learn
  from.
• Adds a hidden test product that only the verified bot can see. It is excluded
  from your catalog, search, the Store API, the classic REST API and the admin
  product list.
• Adds a simulated-success payment gateway that only the verified bot can
  use. It never contacts Stripe, PayPal or any real payment provider, and no
  money ever moves. Real customers cannot see or select it, whatever the
  enabled toggle in WooCommerce says — availability is decided per request by
  the signature check.
• Flags every test order and hides it from your orders list, your order status
  counts, WooCommerce Analytics, and your transactional emails. Your reports
  and your inbox stay clean.
• Reports whether your order-confirmation emails are configured to send, so a
  broken SMTP setup shows up as a problem before a customer notices.
• Provides a signed cleanup endpoint so test orders can be removed on request.

What it does not do

• It does not take payments, and it does not place orders for real customers.
• It does not send any of your data anywhere on its own. See External
  services below.
• It does not modify your theme, your checkout page or your existing products.

A free Checkout Monitor account is required to use this plugin, since the
plugin only responds to requests — it never initiates anything by itself.

External services

This plugin does not contact any external service. It makes no outbound
HTTP requests of any kind. All traffic is inbound.

What it does instead is expose three authenticated REST endpoints that the
Checkout Monitor service at checkoutmonitor.app calls. Those calls are
authenticated with a shared secret that you copy from Settings → Checkout
Monitor on your own site and paste into your checkoutmonitor.app dashboard.
Until you do that, nothing can successfully call these endpoints: every
request without a valid signature is refused.

Data your store returns when the service calls, and only then:

• Status endpoint — whether your WooCommerce order-confirmation emails are
  enabled, the admin notification recipient address, your store’s “from”
  email address and name, a hint identifying which SMTP plugin is active (if
  any), and the timestamp of the last plugin, theme or core update. The two
  email addresses are the only personal data involved; they are needed so the
  service can tell you whether order emails are actually configured to reach
  anyone.
• Test product endpoint — the id, slug, SKU, permalink, status and
  visibility of the hidden test product.
• Cleanup endpoint — the number of test orders removed and the number
  remaining. It requires an explicit confirmation flag in the request body and
  only ever touches orders this plugin created.

Your customer records, order contents, payment details and site credentials are
never read or returned by any of these endpoints.

Using the Checkout Monitor service is subject to its
Terms of Service and
Privacy Policy.

1. Install and activate WooCommerce, if it is not already active.
2. Upload and activate Checkout Monitor (Plugins → Add New →
   Upload Plugin, then Activate).
3. Go to Settings → Checkout Monitor. A shared secret is generated for you
   automatically on activation.
4. Copy the shared secret shown on that page.
5. Sign in at checkoutmonitor.app, add your
   store, and paste the shared secret into the Shared secret field.

That is the whole setup. Monitoring begins on the schedule you choose in your
Checkout Monitor dashboard. Treat the shared secret like a password: anyone who
has it can trigger a test checkout on your store.

Do I need a Checkout Monitor account?

Yes. The plugin only answers signed requests; it never starts anything on its
own, so on its own it does nothing. A free account is enough to get started.

Will test orders appear in my orders list, reports or emails?

No. Every order created by a verified test is flagged and then hidden from the
orders list, the order status counts, WooCommerce Analytics and all
transactional emails, including the admin new-order notification.

Can a real customer see or use the test payment gateway?

No. The gateway’s availability is decided per request by the signature check,
not by the enabled toggle in WooCommerce settings. A request without a valid
signature never sees it. It also never contacts a real payment provider, so no
money can move through it.

Is a real payment taken during a test?

No. The test gateway simulates a successful payment and marks the order paid
without contacting any payment provider. Nothing is charged and nothing is
captured.

Why does the test product show a price?

The test needs a purchasable product to complete a real checkout flow. The
product is hidden from your catalog, search, the Store API, the classic REST
API and the admin list, so customers cannot find or buy it.

What happens if I deactivate the plugin?

Monitoring stops answering and your store will show as unreachable in Checkout
Monitor. Your shared secret and settings are kept, so reactivating resumes
where you left off.

What happens if I delete the plugin?

The shared secret, the stored settings and the replay-protection records are
permanently removed. The hidden test product and any test orders this plugin
created are moved to the trash, so they leave your lists but can still be
restored if you need them. Nothing belonging to WooCommerce or any other
plugin is touched.

I regenerated the shared secret and monitoring stopped working.

That is expected. Regenerating invalidates the old value immediately. Copy the
new secret from Settings → Checkout Monitor into your checkoutmonitor.app
dashboard and monitoring resumes.

Does this work with High-Performance Order Storage (HPOS)?

Yes. The plugin declares HPOS compatibility and its order queries work with
both HPOS and the legacy posts storage.

Does it support multisite?

Yes. Each site in the network gets its own shared secret and is added to
Checkout Monitor separately. On a newly created site the secret is generated
the first time an administrator loads the dashboard.

1.0.0

• First public release.