Cobalt Checkout Diagnostics for WooCommerce

Cobalt Checkout Diagnostics for WooCommerce is an admin diagnostic plugin. A shop manager with manage_woocommerce can run local, read-only checks to see whether cart and checkout look configured and renderable on this site.

It does not process payments, place orders, or watch the store from the public internet.

Product truth

Local checks do not prove that a real external customer can complete payment. This plugin must never be described as a live checkout or payment monitor.

What this version does

• Support-matrix guard for PHP 8.2+, WordPress 6.9+, and WooCommerce 10.8+
• Manual diagnostic run from WooCommerce → Checkout Diagnostics
• Read-only checks for versions, HTTPS, permalinks, cart/checkout pages, block vs classic type, catalog, enabled payment gateway ids, shipping, HPOS vs posts storage, WP-Cron, and Action Scheduler
• Safe loopback cart probe and checkout-render probe (GET to this site’s assigned URLs only)
• Configuration snapshots and a changes check against the previous run
• Run history on this site, grouped results, evidence, and allowlisted remediation links
• Optional scheduled runs (Action Scheduler when ready, otherwise WP-Cron)
• Optional operator incident email to the site admin address (off by default)

What this version does not do

• Charge a gateway, create orders, change stock, send customer mail, or trigger fulfilment
• Expose a public REST API
• Accept arbitrary probe URLs
• Claim that a real customer can complete payment

Requirements

• PHP 8.2+ (8.3 or 8.4 recommended)
• WordPress 6.9+ (tested up to 7.1)
• WooCommerce 10.8+ (tested up to 11.0)
• Block Cart/Checkout, classic shortcodes, mixed setups, and HPOS or posts storage are all in scope

Limitations

• Local checks do not prove that a real external customer can complete payment.
• Probes are loopback HTTP GETs to this site’s cart and checkout permalinks. They do not POST checkout, call process_payment, or hit Store API write endpoints.
• Probe timeouts are capped (default 10 seconds, maximum 15). TLS verification is never disabled.
• Scheduled WP-Cron runs are approximate. Action Scheduler jobs are not unscheduled during uninstall if Action Scheduler has not initialized yet; leftover actions then fire a no-op hook.
• Incident email is not sent on every run. Fail and warning are both incidents. Recipients cannot be typed in the UI.
• This plugin has no REST API.