Profit Forge for WooCommerce

Your store leaks money in cents. A coupon that stacked when it should not have. A refund where the goods never came back to stock. A customer charged twice because the checkout button was clicked twice. Each one is small. A month of them is not.

Profit Forge scans your orders and reports what it found — with the order numbers, the amount in dollars and the steps that stop it happening again.

What it reports

• Coupon stacking — an “individual use only” coupon that ended up combined with other coupons, and how much extra discount that gave away.
• Refund without restock — money refunded, goods never returned to stock, and the inventory value now missing.
• Duplicate paid orders — the same cart and email paid for twice within minutes, before the customer’s bank turns it into a chargeback.

Every finding carries the order numbers behind it. Nothing is reported that cannot be shown on an order screen.

Your data stays in your store

The scan runs inside WordPress. This plugin makes no external requests at all — no analytics, no phoning home, no order data sent anywhere. Nothing leaves your server. The one place a request can happen is the separate Pro add-on reading your own gateway statement, and only if you give it a key — see External services below.

How it works

1. Activate. No account, no key, no setup wizard.
2. Run a scan — it processes orders in the background in batches, so a busy store keeps serving customers.
3. Read the report: total found, findings grouped by rule, evidence per finding, fix steps.

You choose the window: a rolling number of days, the last full calendar month, or all the order history you have. Nothing about the scan is capped, metered or time-limited.

A note on precision

A false accusation costs more than a missed leak. Every rule stays silent when it cannot prove its case: a coupon whose settings were deleted, a refund on a product that does not track stock, two orders from the same cart a week apart. If the report says nothing, that means nothing was proven — not that the rule did not run. Rules that could not run are listed with the reason.

Pro

A separate add-on adds nine more rules (gateway fees against your rate card, shipping charged below label cost, single-use coupon reuse, coupon on top of a sale price, partial refund above the line total, tax class with no matching rate, negative margin after cost of goods, paid orders stuck on hold), a printable report, CSV export and a monthly email.

Those rules and screens live in the other plugin — they are not in this one, switched off. Everything this plugin ships is on, for everyone, with no key: every rule it has, the whole scan window, and every line of every report.

Hooks

profitforge/leak_found

Fires once per scan, right after the report is saved, when the new findings
found by that scan add up to at least the alert threshold (Settings →
“Alert threshold”, $50 by default). One e-mail to the site admin also goes
out through wp_mail() at the same time — this hook fires either way, so an
integration does not depend on outbound mail being configured on the site.

do_action( 'profitforge/leak_found', $report_id, $total_cents, $count, $top_rule )

• $report_id (int) — the id of the scan run whose report contains these findings.
• $total_cents (int) — the sum of the new findings that crossed the threshold, in cents. Findings marked “observe” and findings already marked “Fix confirmed” at an equal or higher amount are not counted here.
• $count (int) — how many findings that sum is made of.
• $top_rule (string) — the id of the rule that contributed the largest amount (for example R04).

This is how FlowForge (or any other plugin) can route a Profit Forge leak
into its own automation without parsing the e-mail. Free rules count the same
as Pro rules here — the hook does not check which add-on found the money.

External services

This plugin connects to nothing. It has no analytics, no update server of its own, no licence check and no telemetry. Everything below is about the separate Pro add-on, and is listed here so the answer is in one place.

Stripe (Pro add-on only, and only if you add a key)

The Pro add-on can check the fee Stripe kept against your rate card. To do that it reads your own Stripe statement.

• What it is: the Stripe API, https://api.stripe.com/v1/balance_transactions.
• When it happens: only after you paste a restricted, read-only Stripe key on the Pro settings screen, and then only while a scan is running or when you press “Test connection”. No key, no requests — the rules fall back to what the Stripe payment plugin already stored on each order.
• What is sent: your key, the date range being scanned and a page cursor. No order, customer or product data is sent — matching a transaction to an order happens on your own server, after the answer comes back.
• What comes back: your own charges and refunds — amount, fee, currency, card country and brand.
• Your key: stored encrypted (libsodium) with a secret you put in wp-config.php; without that secret the add-on refuses to store the key at all. Only the last four characters are ever shown.
• Stripe’s terms: https://stripe.com/legal/ssa — Stripe’s privacy policy: https://stripe.com/privacy

PayPal fees are not read over the network at all; they come from the fee the PayPal plugin records on the order, or from a statement you export yourself.