=== Cart Lookout – Checkout Monitoring for WooCommerce ===
Contributors: cartlookout
Tags: woocommerce, checkout, monitoring, alerts, testing
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
Requires Plugins: woocommerce
Stable tag: 0.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Tests your WooCommerce checkout with a real browser around the clock and alerts you when it breaks, with the failing step and likely cause.

== Description ==

A broken checkout costs sales quietly. A payment plugin updates overnight, a theme change hides the Place order button, or a caching rule breaks the checkout page, and nobody notices until customers complain or sales dry up.

**Cart Lookout** is a hosted service that places safe test orders on your store with a real browser, on a schedule. When checkout fails twice in a row, you get an alert with the step that broke, a screenshot and the likely cause.

**This plugin is the store side of that service.** On its own it doesn't monitor anything; it makes the service's tests safe and lets it read basic facts about your store. You need a Cart Lookout account to use it.

= What the plugin does on your store =

* **Connects your store** to your Cart Lookout account with a token you paste in. The secret is stored encrypted and never shown again.
* **Creates one hidden test product** (virtual, priced 1.00 in your currency, hidden from your shop and search). Ordinary shoppers can't buy it.
* **Adds a hidden test payment method** that takes no money. Only Cart Lookout's own test sessions can see or use it, and only to pay for the test product, never for your real products. It never appears to shoppers or in your payment settings.
* **Keeps test orders out of your business:** every test order is tagged, sends no WooCommerce email (to customers or to you), is skipped by WooCommerce webhooks, and is deleted after the test with any stock put back.
* **Reports store facts** for diagnosis: WordPress, WooCommerce and PHP versions, theme, checkout type, the state of your checkout page, the plugins you have installed (names and versions), and plugins or themes recently updated, switched on or off. Never customer data.
* **Helps find the cause** after a failed test: it reports WooCommerce's own fatal-error log from the last 24 hours, with email addresses, long numbers, server paths and attached data removed first, and which WooCommerce templates your theme overrides.
* **Can apply fixes you approve (off until you switch it on):** in WooCommerce → Cart Lookout you can allow Cart Lookout to apply fixes that you approve, one at a time, in your Cart Lookout dashboard. Only these, nothing else: save permalinks again, purge known page caches, create missing WooCommerce pages, switch one plugin off (never WooCommerce or Cart Lookout), and switch back on a plugin that such a fix switched off. Every fix is listed in the fix log on the same screen, and your site emails its administrator address each time one is applied. Security plugins are never switched off.

= Works with =

* Classic (shortcode) checkout and block checkout.
* WooCommerce's High-Performance Order Storage and the older posts storage.
* Tested with WooCommerce 9.9, 10.9 and 11.2.

= Security =

* Every request from the service is signed (HMAC-SHA256) with a secret only your store and your account share, must be less than 5 minutes old, and can be used only once.
* Requests are rate-limited, and repeated failed attempts are blocked for 10 minutes.
* The settings screen is available only to users who can manage WooCommerce.

== External services ==

This plugin is the store-side part of the **Cart Lookout** checkout-monitoring service, operated at https://cartlookout.com. It is required for the service to work.

**The plugin does not send any data by itself.** It never makes outgoing requests. Instead, once you paste a connection token, the Cart Lookout service connects to your store's REST API at `/wp-json/cartlookout/v1/`, using requests signed with a secret shared only by your store and your account.

What the service reads or does, and when:

* **When you connect, and on each scheduled health check:** your site address, WordPress, WooCommerce and PHP versions, the active theme's name and version, whether checkout uses the block or the classic shortcode, whether High-Performance Order Storage is on, your store currency, and the names and versions of plugins, themes and WordPress core updated in the last 7 days, and of plugins switched on or off and themes switched to in that time.
* **On each scheduled health check (plugin 0.2):** also the names, versions and on/off state of installed plugins, the active theme's parent theme, whether your checkout page is published and contains a checkout, and whether you switched on fixes.
* **After a failed test:** WooCommerce's fatal-error log entries from the last 24 hours (at most 10, each cut to 300 characters, with email addresses, numbers of 6 or more digits, server paths and attached context removed in your store before sending), and the list of WooCommerce templates your theme overrides.
* **Only if you switched on fixes and approved one in your dashboard:** it asks the plugin to run that one fix from the list above.
* **Before each test order:** it asks the plugin to create or reuse the hidden test product and to open a 10-minute test session.
* **After each test order:** it asks the plugin to delete the test order.

No customer data, order data from real customers, personal data, passwords, payment details or settings values are sent.

During a test, Cart Lookout's browser places an order on your store with fictional test details (for example `runner@example.test`), exactly as a shopper would.

* Terms of service: https://cartlookout.com/terms
* Privacy policy: https://cartlookout.com/privacy

== Installation ==

1. Make sure WooCommerce is installed and active.
2. Install and activate **Cart Lookout – Checkout Monitoring for WooCommerce**.
3. In your Cart Lookout dashboard, add your store and copy the connection token.
4. In WordPress, go to **WooCommerce → Cart Lookout**, paste the token and click **Save token**.
5. Cart Lookout connects and the status changes to **Connected**. The first test runs shortly after.

If your store uses a security plugin or firewall that blocks the REST API, allow requests to `/wp-json/cartlookout/v1/`.

== Frequently Asked Questions ==

= Do I need a Cart Lookout account? =

Yes. This plugin makes the service's tests safe and lets the service connect to your store. Without an account it does nothing.

= Will test orders affect my customers, stock or reports? =

They are designed not to. Test orders send no WooCommerce emails, are skipped by WooCommerce webhooks (so shipping and accounting integrations don't receive them), and are deleted within the test, with stock restored. The test product is virtual and doesn't track stock.

One limit: if another plugin sends its own email directly when an order is created, rather than through WooCommerce's email system, Cart Lookout can't silence that email.

= Will my real payment gateway be charged? =

No. Tests pay with the hidden test payment method, which takes no money, or with an offline method such as cash on delivery. Live card payments are never used.

= Can shoppers see the test product or the test payment method? =

No. The test product is hidden from your shop and search and can't be bought outside a Cart Lookout test session. The test payment method appears only inside a test session.

= Does it work with block checkout? =

Yes, with both block checkout and the classic shortcode checkout.

= What happens when I disconnect or delete the plugin? =

Disconnecting deletes the stored secrets immediately; Cart Lookout can no longer reach your store. Deleting the plugin also removes its settings, the hidden test product and any leftover test orders.

== Screenshots ==

1. WooCommerce → Cart Lookout: connect your store, allow the fixes you approve, and see every fix in the log.
2. Your Cart Lookout dashboard: every store, its latest checks and whether checkout works.
3. An incident report: the step that failed, the evidence, and what caused it, with what to do.
4. A fix you approved, applied on your store and confirmed by the next test.
5. Alerts: who is emailed when checkout breaks and when it works again.

== Changelog ==

= 0.2.0 =
* Reports the state of the checkout page and the installed plugins, so Cart Lookout can tell a missing checkout page from a broken one and name the plugin involved.
* After a failed test, reports WooCommerce's recent fatal errors (personal data removed first) and the theme's template overrides.
* New, off by default: allow Cart Lookout to apply fixes you approve (save permalinks, purge caches, create missing WooCommerce pages, switch a plugin off or back on), with a fix log.

= 0.1.2 =
* Also notes when a plugin is switched on or off and when the theme changes, so an alert can show what changed just before checkout broke.

= 0.1.1 =
* The settings screen shows when Cart Lookout last reached your store.
* Sites served through Cloudflare see how to allow Cart Lookout's test server, so its bot protection doesn't block checks.

= 0.1.0 =
* First version: connection screen with encrypted token, signed and rate-limited REST API (handshake, health, prepare-test, cleanup), hidden test product and test payment method for classic and block checkout, silent self-deleting test orders, version-change log, clean uninstall.
