ThemeChum Checkout Monitor for WooCommerce

Powered by Checkout Monitor (https://checkoutmonitor.app).

A silent checkout failure is the most expensive kind of outage. Traffic looks
normal, the homepage loads, ads keep spending — and not a single order comes
through. Uptime monitors report everything green, because nothing they do
actually tries to buy something.

This plugin is the store-side half of Checkout Monitor.
It lets the service complete a real, end-to-end purchase on your store on a
schedule, and tells you the moment that stops working.

The important part is that it does this without touching your real business
data. Every order the test creates is flagged and then suppressed across every
surface a merchant looks at.

What it does

• Verifies each incoming request with an HMAC signature, a timestamp and a
  single-use nonce, so only Checkout Monitor can trigger a test. Any mismatch
  is refused with an identical response, giving an attacker nothing to learn
  from.
• Adds a hidden test product that only the verified bot can see. It is excluded
  from your catalog, search, the Store API, the classic REST API and the admin
  product list.
• Adds a simulated-success payment gateway that only the verified bot can
  use. It never contacts Stripe, PayPal or any real payment provider, and no
  money ever moves. Real customers cannot see or select it, whatever the
  enabled toggle in WooCommerce says — availability is decided per request by
  the signature check.
• Flags every test order and hides it from your orders list, your order status
  counts, WooCommerce Analytics, and your transactional emails. Your reports
  and your inbox stay clean.
• Reports whether your order-confirmation emails are configured to send, so a
  broken SMTP setup shows up as a problem before a customer notices.
• Provides a signed cleanup endpoint so test orders can be removed on request.

What it does not do

• It does not take payments, and it does not place orders for real customers.
• It does not send any of your data anywhere on its own. See External
  services below.
• It does not modify your theme, your checkout page or your existing products.

A free Checkout Monitor account is required to use this plugin, since the
plugin only responds to requests — it never initiates anything by itself.

External services

This plugin does not contact any external service. It makes no outbound
HTTP requests of any kind. All traffic is inbound.

What it does instead is expose three authenticated REST endpoints that the
Checkout Monitor service at checkoutmonitor.app calls. Those calls are
authenticated with a shared secret that you copy from Settings → Checkout
Monitor on your own site and paste into your checkoutmonitor.app dashboard.
Until you do that, nothing can successfully call these endpoints: every
request without a valid signature is refused.

Data your store returns when the service calls, and only then:

• Status endpoint — whether your WooCommerce order-confirmation emails are
  enabled, the admin notification recipient address, your store’s “from”
  email address and name, a hint identifying which SMTP plugin is active (if
  any), and the timestamp of the last plugin, theme or core update. The two
  email addresses are the only personal data involved; they are needed so the
  service can tell you whether order emails are actually configured to reach
  anyone.
• Test product endpoint — the id, slug, SKU, permalink, status and
  visibility of the hidden test product.
• Cleanup endpoint — the number of test orders removed and the number
  remaining. It requires an explicit confirmation flag in the request body and
  only ever touches orders this plugin created.

Your customer records, order contents, payment details and site credentials are
never read or returned by any of these endpoints.

Using the Checkout Monitor service is subject to its
Terms of Service and
Privacy Policy.