Cart Lookout – Checkout Monitoring for WooCommerce

A broken checkout costs sales quietly. A payment plugin updates overnight, a theme change hides the Place order button, or a caching rule breaks the checkout page, and nobody notices until customers complain or sales dry up.

Cart Lookout is a hosted service that places safe test orders on your store with a real browser, on a schedule. When checkout fails twice in a row, you get an alert with the step that broke, a screenshot and the likely cause.

This plugin is the store side of that service. On its own it doesn’t monitor anything; it makes the service’s tests safe and lets it read basic facts about your store. You need a Cart Lookout account to use it.

What the plugin does on your store

• Connects your store to your Cart Lookout account with a token you paste in. The secret is stored encrypted and never shown again.

• Creates one hidden test product (virtual, priced 1.00 in your currency, hidden from your shop and search). Ordinary shoppers can’t buy it.

• Adds a hidden test payment method that takes no money. Only Cart Lookout’s own test sessions can see or use it, and only to pay for the test product, never for your real products. It never appears to shoppers or in your payment settings.

• Keeps test orders out of your business: every test order is tagged, sends no WooCommerce email (to customers or to you), is skipped by WooCommerce webhooks, and is deleted after the test with any stock put back.

• Reports store facts for diagnosis: WordPress, WooCommerce and PHP versions, theme, checkout type, the state of your checkout page, the plugins you have installed (names and versions), and plugins or themes recently updated, switched on or off. WordPress update outcomes are reported only when updater hooks or the installed version provide evidence; a failed Cart Lookout test is not treated as an update failure. Never customer data.

• Real order health (on by default, you can switch it off): between scheduled tests, Cart Lookout asks how your real orders went, so when several real orders start failing it can tell you before its next test. The plugin answers with counts only: per 5 minutes and payment method, how many orders were created, paid, failed, pending, on hold or cancelled, the total value of the paid ones, and how often the checkout page was opened and submitted (counted on your server; nothing is added to your shop pages and no cookies are set). It never sends order numbers, names, email or postal addresses, products, notes or payment details. Cart Lookout’s own test orders and test visits are never counted.

• Helps find the cause after a failed test: it reports WooCommerce’s own fatal-error log from the last 24 hours, with email addresses, long numbers, server paths and attached data removed first, and which WooCommerce templates your theme overrides.

• Can apply fixes you approve (off until you switch it on): in WooCommerce → Cart Lookout you can allow Cart Lookout to apply fixes that you approve, one at a time, in your Cart Lookout dashboard. Only these, nothing else: save permalinks again, purge known page caches, create missing WooCommerce pages, switch one plugin off (never WooCommerce or Cart Lookout), and switch back on a plugin that such a fix switched off. Every fix is listed in the fix log on the same screen, and your site emails its administrator address each time one is applied. Security plugins are never switched off.

Works with

• Classic (shortcode) checkout and block checkout.

• WooCommerce’s High-Performance Order Storage and the older posts storage.

• Tested with WooCommerce 9.9, 10.9 and 11.2.

Security

• Every request from the service is signed (HMAC-SHA256) with a secret only your store and your account share, must be less than 5 minutes old, and can be used only once.

• Requests are rate-limited, and repeated failed attempts are blocked for 10 minutes.

• The settings screen is available only to users who can manage WooCommerce.

External services

com. It is required for the service to work.

The plugin does not send any data by itself. It never makes outgoing requests. Instead, once you paste a connection token, the Cart Lookout service connects to your store’s REST API at /wp-json/cartlookout/v1/, using requests signed with a secret shared only by your store and your account.

What the service reads or does, and when:

• When you connect, and on each scheduled health check: your site address, WordPress, WooCommerce and PHP versions, the active theme’s name and version, whether checkout uses the block or the classic shortcode, whether High-Performance Order Storage is on, your store currency, and the names and versions of plugins, themes and WordPress core updated in the last 7 days, and of plugins switched on or off and themes switched to in that time.

• During WordPress plugin or theme updates: the component slug, name, previous and target version, attempt time and the updater’s outcome when WordPress reports it. The service may compare the final installed version with the target version. It receives a bounded error code only, never raw updater messages or package URLs. An update result is not inferred from a failed checkout test.

• On each scheduled health check (plugin 0.2): also the names, versions and on/off state of installed plugins, the active theme’s parent theme, whether your checkout page is published and contains a checkout, and whether you switched on fixes.

• After a failed test: WooCommerce’s fatal-error log entries from the last 24 hours (at most 10, each cut to 300 characters, with email addresses, numbers of 6 or more digits, server paths and attached context removed in your store before sending), and the list of WooCommerce templates your theme overrides.

• Every 5 minutes, unless you switched real order health off (plugin 0.4): counts of real orders created in each 5 minutes, by payment method and status (paid, failed, pending, on hold, cancelled, other), the total value of the paid orders in your store currency, and counters of how often the checkout page was served, Place order was submitted, and a submission ended in a PHP fatal error. Order counts can cover up to the last 36 days, so Cart Lookout can learn what is normal for your store; the checkout counters are kept in your store for 48 hours. Order numbers, customer names, email and postal addresses, products, order notes and payment details are never sent.

• Only if you switched on fixes and approved one in your dashboard: it asks the plugin to run that one fix from the list above.

• Before each test order: it asks the plugin to create or reuse the hidden test product and to open a 10-minute test session.

• After each test order: it asks the plugin to delete the test order.

No customer data, details of real orders, personal data, passwords, payment details or settings values are sent. Real order health sends only the counts and totals described above.

test ), exactly as a shopper would.

• Terms of service: https://cartlookout.com/terms

• Privacy policy: https://cartlookout.com/privacy