About this plugin
ChangeTrace watches your WordPress and WooCommerce site for meaningful changes and
errors and sends them to the ChangeTrace service (a cloud dashboard at
com), where they are correlated against metrics to surface
the most likely cause of a movement, with evidence.
Watch it work (real runs on a test store):
- A plugin update broke checkout. Watch ChangeTrace catch it.
- Site down: was it a plugin, or your host?
- What does the plugin send? Install ChangeTrace and see.
- WooCommerce sales dropped? Find the plugin update that broke it.
This plugin is the on-site agent. It does nothing until you connect it: click
Connect Site, sign in to the ChangeTrace dashboard and approve the connection. Only
then does the plugin begin sending data to the ChangeTrace API.
What it collects (once connected):
- A one-time baseline snapshot on connect: your active plugins and theme and their
versions, plus WordPress, PHP, and WooCommerce versions.
- An hourly heartbeat so the dashboard knows the site is alive.
- Change detection — plugins installed, activated, deactivated, updated or removed;
theme changed or updated (including the parent of a child theme); WordPress core updated;
PHP version changed.
- Watched site options — a short, fixed allowlist (permalink structure, siteurl, home,
active plugins, template, stylesheet, blog_public, core auto-update policy, and
WooCommerce payment gateway settings). Only the option NAME and a summary of its shape
(type, size/length, and a short one-way hash) are sent — never the option’s value.
- Error capture — PHP fatals/errors (shutdown + error handler, fails silently),
onerror, unhandled rejections, failed/5xx fetch & XHR;
sampled), and 5xx/timeouts on WordPress’s outbound HTTP and its own REST API.
- Commerce activity — if WooCommerce or Easy Digital Downloads is active: orders,
failed orders, failed payments, refunds, and checkouts started/failed. Each carries the
order id, the amount, the store currency, the payment method and the order status. No
customer names, addresses, emails or line items are collected.
All error payloads are PII-stripped (emails, credentials, form values, card numbers)
and size-capped before they are queued and sent. Events are held in a bounded local queue
and sent in batches (roughly every 5 minutes) with retry/backoff.
Performance: collection is event-driven and adds no scheduled work beyond two WP-Cron
jobs (an hourly heartbeat and a 5-minute queue flush). The queue is a single non-autoloaded
option capped at 500 events. The plugin does not measure page speed on your server — page
performance is measured by ChangeTrace from outside, so nothing runs in your visitors’
browsers except the small sampled JavaScript error handler.
A ChangeTrace account is required. ChangeTrace is a third-party SaaS. See the
“External services” section below for exactly what is sent and where.
External services
This plugin connects to the ChangeTrace service to send monitoring data. This connection
is required for the plugin to do anything, and only starts after you connect your site
and approve the connection in the ChangeTrace dashboard.
Services used
- ChangeTrace API — https://api.change-trace.com
- ChangeTrace dashboard (web app) — https://app.change-trace.com
What data is sent, and when
- On connect (once): a baseline snapshot — your active plugins and theme with versions,
and your WordPress, PHP, and WooCommerce versions.
- Every hour: a heartbeat (site is alive) plus your site token in the request header.
- Roughly every 5 minutes (when there is activity): a batch of events — detected changes
(plugin/theme/core/PHP/watched options), captured errors (PHP/JS/HTTP), and, when
WooCommerce or Easy Digital Downloads is active, commerce events carrying the order id,
amount, store currency, payment method and status. Error payloads are PII-stripped and
size-capped. Watched-option values are never sent — only the option name and a summary
of its shape.
- A front-end JavaScript error is reported with the visiting browser’s user-agent string
and the address of the page it happened on, with the query string removed. Nothing a
visitor typed is read or sent.
- On connect, your browser is sent to https://app.change-trace.com to sign in and approve
connecting this site.
Your site token is stored on your site and only ever sent to the API as an Authorization
header; the API stores only a hash of it. No data is sent before you connect.
This service is provided by ChangeTrace. By connecting your site you agree to their terms
and privacy policy:
- Terms of Service: https://change-trace.com/terms-of-service
- Privacy Policy: https://change-trace.com/privacy-policy