=== Relvato — Continuous Monitoring ===
Contributors: relvato
Tags: monitoring, woocommerce, uptime, security, performance
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
WC requires at least: 8.0
WC tested up to: 11.2
Stable tag: 1.77.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

After every WordPress, plugin, theme or WooCommerce update, Relvato automatically re-tests key pages, checkout, forms, security and speed.

== Description ==

[Relvato](https://www.relvato.com) is a website monitoring platform. It runs monitors against your site in a real
browser: checkout, logins, sign-ups, contact forms, page speed, search visibility and security. This plugin connects
your WordPress site to your Relvato account, so the monitors run again the moment something changes, and can see
what a monitor running from outside can't.

https://www.youtube.com/watch?v=D6GfiDeb8nw

What the plugin adds:

* **Runs after every change (Pro and up).** A plugin, theme, WordPress or WooCommerce update tells Relvato to re-run
  the monitors that change can affect, so a broken checkout is caught minutes after the update, not days later. On
  the free plan you start the runs yourself, from WordPress or the Relvato app, or run them weekly.
* **Monitors that need to be inside.** Logged-in checkout and account pages through a dedicated test customer,
  test orders that never touch your stock, stay out of your analytics and ad platforms (and move themselves to
  the Trash), form tests that don't email your
  team, WooCommerce health, backups, Site Health, PHP errors and failed emails.
* **Security from the inside.** File integrity against WordPress.org checksums, signs of a hack in themes,
  uploads and options, new administrators, leftover backup files, and hardening you can switch on and off.
* **Fixes you apply.** When a run proposes a fix (rolling back a plugin update, turning search indexing back on,
  clearing a cache…), it appears under "Relvato suggests" in WordPress → Relvato, and an administrator applies it
  there with one click. Relvato then re-runs its monitors to verify it, and every fix can be undone. Relvato never
  applies a fix or changes a plugin on its own.
* **AI assistants.** On WordPress 6.9+, Relvato's abilities (site status, monitors, the brief for fixing a
  failure) are available to AI assistants through the WordPress Abilities API, for administrators only.

The plugin needs a Relvato account; there is a free plan ([plans](https://www.relvato.com/pricing)). Nothing is sent
to Relvato until you connect the plugin.
Every request between your site and Relvato is signed with your site's own secret.

Five features are off until you turn them on in **Relvato → Settings**: the activity log (sign-ins, key changes,
PHP errors and failed emails), the test login, form tests, real-user Web Vitals and the outside-services map. When
you set up monitoring in the plugin, its last step lists the ones your chosen monitors need, with what each does:
test login and form tests are ticked, the activity log and real-user Web Vitals are not, and only the ticked ones go
on with the monitors. A monitor that needs one that's off tells you which, in Relvato, instead of running.

== Installation ==

1. Install and activate the plugin.
2. In WordPress, open **Relvato → Settings** and click **Connect with Relvato**. Sign up or sign in (free, no card),
   confirm the site, and you come straight back to WordPress, connected.
3. Or, if you already have a connect token from the Relvato app (the site's Settings → Connection), paste it on the
   same page and save.

== Frequently Asked Questions ==

= Is Relvato free? What does the free plan include? =

Yes, and it stays free: one site, 100 runs a month and every monitor except custom monitors and AI-feature monitors,
with no card. On the free plan you start the runs, from WordPress or the Relvato app, or schedule them weekly. Paid
plans re-run the monitors by themselves after every update, add daily and faster schedules and alerts, and cover more
sites. See https://www.relvato.com/pricing.

= Does Relvato need my password or my customers' passwords? =

Never yours or your customers'. For logged-in monitors the plugin signs Relvato's browser in as a dedicated test
customer it creates (never an administrator), using a short-lived signed token. To test the real login form, Relvato
asks the plugin for that test customer's login: the plugin sets a new random password on that one account each time
and returns it with the username, over the signed connection. This only happens while **Test login** is on in the
plugin's settings.

= Will monitors change my stock or create real orders? =

A checkout monitor set to "Full order" places a real test order — that's how it proves your checkout works. The
plugin marks it (order meta `_relvato_test`), doesn't reduce stock for it, doesn't email you about it, and moves it to
the Trash a few minutes later. Monitors that stop before "Place order" create no order at all. Turning off "Protect
stock & auto-remove" in the plugin's settings keeps test orders (and their stock change) instead of removing them.
So that stores taking only cards can be tested too, the plugin creates a 100% discount coupon that works only inside
Relvato's signed test requests, never for a shopper; it is deleted when you deactivate the plugin.

= Will test orders show up in Google Analytics, Google Ads or Meta? =

No. The plugin switches off the purchase event for test orders in
Pixel Manager for WooCommerce (browser, conversion recovery and server-side), Google for WooCommerce, Google Analytics
for WooCommerce, Site Kit, GTM4WP, Facebook for WooCommerce (pixel and Conversions API), PixelYourSite, Pinterest for
WooCommerce and TikTok. Relvato's test browser also refuses analytics consent and blocks the ad and analytics
collection addresses while it places the order. On WooCommerce 10.7 and later, test orders are also kept out of
WooCommerce Analytics. For your own reports and conversion uploads, skip orders for which
`relvato_is_test_order( $order )` returns true.

= Can Relvato change my site? =

Not on its own. Relvato suggests changes; an administrator applies each one in WordPress → Relvato, where the plugin
makes it from a fixed list of reversible actions built into the plugin: for example rolling a plugin back to the
version before an update, updating or switching off a vulnerable plugin, or turning search indexing back on. Each
needs the matching WordPress permission (for example "update plugins"). No request from Relvato's service can
install, update, activate or remove a plugin or theme, or change your settings or code. What it can ask for is limited
to Relvato's own test data: while Test login is on, the dedicated test customer (the plugin creates that one account,
never an administrator, signs Relvato's browser in as it, sets its password and sends its lost-password email to the
Relvato inbox); the test orders, form entries and test emails its monitors make, and removing them. The plugin never
runs code it receives, and every applied fix can be undone there.

= Does the plugin change WordPress updates? =

Only when you ask it to. After you roll a plugin back, Relvato holds the version you left, so WordPress doesn't put
it straight back: automatic updates skip it and installing it is refused until you release the hold ("Release the
hold" on that plugin's row on the Plugins screen). While quarantine mode is on after a hack, an administrator can
tick "Pause plugin and theme auto-updates" in WordPress → Relvato. Nothing else about WordPress's updates is changed.

= Does the plugin change how my forms handle spam? =

Only for Relvato's own test submissions, and only while **Form tests** is on: for a submission carrying Relvato's
marker in a request signed with your site's secret, the form plugin's CAPTCHA check and Akismet are skipped through
the form plugin's own filters, its notification goes to your site's Relvato inbox instead of your team, and the test
entry is deleted afterwards. Every other submission is handled exactly as before.

= What does security hardening change? =

Nothing until you switch an item on in Relvato, and each can be switched off again: XML-RPC off (not while Jetpack
is active), the public user list and username lookups by number hidden, the WordPress version tag and the
X-Powered-By header removed, the theme and plugin file editor turned off (the same as DISALLOW_FILE_EDIT; a value
already set in wp-config.php wins), a few safe security headers added where the site sends none, and an empty
index.php added to the uploads folders.

= Does the plugin keep backups? =

Only of plugins that aren't from WordPress.org, and only once the site is connected. When one of those updates, the
plugin first zips the version being replaced into wp-content/relvato-backups (closed to web visitors), so Relvato can
roll the update back if it breaks the site; WordPress.org plugins are rolled back from WordPress.org instead. It keeps
the two newest backups per plugin, for up to 60 days.

= What happens when I remove the plugin? =

Deactivating stops all communication with Relvato. Deleting the plugin also removes its settings, the test
customer and Relvato's plugin backups.

== Screenshots ==

1. Once connected, Relvato can monitor your critical site flows, SEO / AEO readiness, site security, performance, domain, legal pages or accessibility.
2. Choose when your monitors run: on a schedule, and again automatically after WordPress, theme or plugin updates.
3. The Relvato dashboard in WordPress: every monitoring group at a glance — what passes, and what needs a look.
4. Relvato suggests safe, reversible fixes. You apply each one in WordPress with one click, switch it back off any time, and Relvato re-runs its monitors to confirm.
5. Performance in WordPress: lab Core Web Vitals against Google's "good" limits on one radar, with the biggest wins to fix first.
6. Legal compliance: Relvato checks for a privacy policy, terms and an accessibility statement, and flags cookie consent and tracking problems — with a suggested fix for each.
7. Every run in WordPress: what ran, what it found, and when — with the full details one click away in Relvato.
8. The Relvato app: each site at a glance — monitors passing, what's ready to run, results over time and every run, for all your sites in one place.

== External services ==

This plugin connects your site to Relvato, a website monitoring service run by Relvato
([terms](https://www.relvato.com/terms), [privacy policy](https://www.relvato.com/privacy)). Nothing below happens
until you connect the site, by clicking "Connect with Relvato" or pasting your connect token.

**Relvato (app.relvato.com).** Used to run your monitors and show their results.

* When you click **Connect with Relvato**, your browser goes to app.relvato.com with your site's address, the way
  back to your WordPress admin, a one-time check value, the active theme and the well-known plugins it runs, by name
  (for example WooCommerce, Yoast SEO, Wordfence, WP Rocket, Elementor), so you can sign in and confirm the site. When you come back, the plugin sends a
  one-time code, the matching secret and your site's address to app.relvato.com to receive your connect token.

* When something changes on the site, the plugin sends a signed event about the change: plugin, theme, WordPress
  and WooCommerce updates, activations and theme switches; new administrators and role changes; and, while
  quarantine mode is on after a hack, new scheduled tasks and uploaded executable files. Each event names the
  WordPress user who made the change.
* While the **activity log** is on (off until you turn it on): administrator and editor logins (with the login name,
  role and the first part of the IP address) and counts of failed logins (never the usernames tried); changes to key
  settings (site address, registration, search visibility); edits made in the theme and plugin file editors;
  application passwords created or deleted; deleted administrators; and new PHP fatal errors and failed emails (the
  recipient's domain only). With it on, the plugin also keeps when each administrator last signed in (on the site)
  and includes that time in the security review of accounts below, so Relvato can point out administrators nobody
  uses; switching the activity log off deletes those times.
* While the **outside-services map** is on (off until you turn it on): for each server-side request a plugin or
  theme makes to another server, the plugin's or theme's folder name and the host name it called (never the full
  address, what was sent or what came back), with the day it was first and last seen. Kept in your site's options
  and read by Relvato's Exposure scan; switching it off deletes it.
* Every six hours the plugin sends its version, which well-known plugins are active, by name (for example Yoast SEO,
  Wordfence, WP Rocket, WooCommerce, a form or caching plugin), the active theme, the search visibility setting,
  whether its REST routes can be reached (and if not, which plugin blocks them) and which of the features above are on.
* When you open the Relvato pages in WordPress, the plugin fetches your monitors' status and Relvato's suggestions,
  and sends the actions you start there (such as running a monitor).
* When an administrator applies a suggestion there, the plugin first asks app.relvato.com to start a plugin update or
  deactivation (so Relvato can verify it), then reports what was applied: which suggestion, whether it worked (and
  WordPress's error if not), the hardening settings now on, and the WordPress user who applied it. A quarantine's
  auto-update pause, a released update hold and an undo are reported the same way.
* Relvato's monitors call the plugin's own REST routes, signed with your site's secret, to read results such as
  WooCommerce health, file checksums and installed plugin versions. None of them can change plugins, themes,
  settings or code; the only things they create or change are Relvato's own test data (the test customer below, test
  orders, form-test entries and test emails). The security
  review of accounts reads the administrator and other privileged accounts (login name, display name, roles, when the
  account was created, the domain of its email address and the names of its application passwords), and the ways in that skip the login form: WooCommerce REST API keys (their description,
  owner, access and the last characters WooCommerce shows) and OAuth clients. Administrator passwords and API keys
  are never sent.
* While **Test login** is on (off until you turn it on), the plugin keeps one dedicated test customer account (it
  creates it as a customer, or a subscriber without WooCommerce; never an administrator, and it refuses any account
  that can do more than shop). For logged-in monitors, a request signed by Relvato signs Relvato's browser in as that account (a session
  cookie, nothing stored). To test the real login form, Relvato can ask for that account's login: the plugin sets a
  new random password on it and returns the username and that password over the signed connection. Relvato can also have WordPress send that account's
  lost-password email (to the Relvato test inbox), to check the reset email goes out. No other account's password is
  set or sent.
* While **AI assistant abilities** are on, an AI assistant working in your WordPress admin (as an administrator) can
  ask the plugin for the site's status, its monitors or the fix brief for a run, or start monitors; each request goes
  to app.relvato.com, and nothing is sent until an assistant asks.
* While connected, your homepage carries `<meta name="relvato-site">` with your Relvato site's ID, so Relvato can
  confirm the connection from outside. It isn't a link and shows nothing to visitors.

**Relvato real-user speed measurement (app.relvato.com).** While real-user Web Vitals is on (off until you turn it on), a small script on
your public pages measures how fast each page loads for a sample of visitors and sends the timings, the page type,
whether the device is a phone or a computer, and (for slow pages) the slow element and resource to
app.relvato.com/api/vitals. It sets no cookies and doesn't identify visitors. The script is part of the plugin
(assets/vitals-beacon.js); nothing is loaded from Relvato.

**Relvato test inbox (verify.relvato.com).** During a contact-form test (while form tests are on) or an email
monitor, the test message goes to a Relvato address for your site instead of to your team, so Relvato can confirm it
arrived.

**WordPress.org (api.wordpress.org, downloads.wordpress.org).** File integrity compares your WordPress core and
plugin files with WordPress.org's published checksums. Rolling a plugin back or reinstalling it downloads that
version from WordPress.org. See the [WordPress.org privacy policy](https://wordpress.org/about/privacy/).


== Changelog ==

= 1.77.2 (2026-10-15) =
* Changed: Relvato is now on WordPress.org, and the plugin updates from there like any other. Sites that installed it from relvato.com move over with this version; nothing to do.

= 1.77.1 (2026-10-11) =
* Fixed: wp-config.php is checked for malware patterns again (only the pattern's name is reported; 1.77.0 skipped it along with its hash).
* Readme: says exactly what Relvato's requests can create or change — only its own test data, including how the test customer is signed in.

= 1.77.0 (2026-10-11) =
* Changed: Relvato never applies a fix or changes a plugin on its own. Fixes, plugin updates, rollbacks, deactivations and their undo are applied by an administrator under "Relvato suggests" in WordPress → Relvato (each needs the matching WordPress permission); the plugin then tells Relvato, which re-runs its monitors to verify the change. The routes Relvato's service used to apply them are removed.
* Changed: during quarantine mode, pausing plugin and theme auto-updates is a tick box in WordPress → Relvato, set by an administrator.
* Changed: Relvato's scheduled update window no longer runs on sites with this version; WordPress's own automatic updates keep working, and an update that breaks a monitor is offered as a one-click rollback in WordPress → Relvato.
* Security: the plugin no longer reads the values of your WordPress keys and salts, and wp-config.php is no longer part of the file fingerprint. Every admin page is escaped as it's printed. The activity log and quarantine record a file-editor save only with WordPress's own check for that save.

= 1.76.2 (2026-10-09) =
* Changed: "Tested up to" is declared only in this readme, no longer in the plugin file's header, as WordPress.org now requires.

= 1.76.1 (2026-10-09) =
* Fixed: the Runs list heading ("The latest 5 runs") now translates correctly in languages whose singular form also covers numbers like 21.

= 1.76.0 (2026-10-09) =
* Changed: on setup's last step, the activity log and real-user Web Vitals start unticked; only the switches you tick go on with your monitors. Test login and form tests stay ticked.
* Changed: backups of plugins that aren't from WordPress.org are kept only once the site is connected.
* Changed: the description and the dashboard group "Legal & accessibility" no longer say "legal compliance": Relvato reports what it finds on your legal pages, cookie banner and accessibility; it doesn't certify anything.
* New: suggested privacy-policy text for the real-user speed script and the activity log (Settings → Privacy → Policy Guide).
* Fixed: with two copies of Relvato in two plugin folders, activating the second no longer stops with a fatal error.
* Readme: the FAQ and External services now say exactly what Test login sends, and when plugin backups are made.

= 1.75.1 (2026-10-09) =
* Fixed: a monitor still collecting data (Real-user Web Vitals before enough page views) no longer counts as "couldn't run" on the Overview's "Monitors passing" row. It's ready — Ready to run says so — and the row now shows it as "1 collecting data", with a note that it's counted once there's enough.

= 1.75.0 (2026-10-08) =
* New: the Overview's "Monitors passing" row now says how many monitors passed and how many it leaves out — e.g. "26 of 27 passing · 3 couldn’t run". Monitors that couldn’t run or haven’t run yet aren't in the percentage, so a 100% that covers only part of your monitors now says so. "Ready to run" shows why each one is left out.

= 1.74.2 (2026-10-08) =
* Changed: the Overview's "Site health" card is now "Monitors passing" — it was always the share of your monitors whose latest run passed, not a score for the whole site. "Health over time" is now "Passing over time". Nothing about how it's counted changed.

= 1.74.1 (2026-10-08) =
* Fixed: switches ticked on setup's last step — Test login, form tests, the activity log — weren't saved (only Real-user Web Vitals was), so Customer login and Logged-in checkout still reported Test login as off. They're saved now. If you set up with 1.74.0, turn Test login on in Relvato → Settings.

= 1.74.0 (2026-10-08) =
* New: setup's "When should they run?" step lists the plugin switches your chosen monitors need — Test login, Real-user Web Vitals, form tests, the activity log — with what each does, ticked. They go on with your monitors (untick any first), so Customer login, Logged-in checkout and real-user Web Vitals run from the start instead of waiting for you in Settings.

= Earlier versions =
* The full history is at https://www.relvato.com/changelog
