Design & content integrityVisual regressionSurprise layout changes, caught pixel-for-pixel.Structure driftVanished buttons, fields and sections, flagged.Broken links & imagesNo 404s or missing images on your key pages.Error scanNo error messages or raw, unrendered code on your pages.
Speed & Web VitalsCore Web VitalsLCP, INP and CLS within Google’s thresholds.Real-user Web Vitals (RUM)LCP/INP/CLS from actual visitors, p75 per page.
Security & integrityVulnerability scanRisky, closed or abandoned plugins & themes, flagged.File integrityCore files, plugins and hidden code — checked against what's supposed to be there.Theme integrityTampered theme files, wp-config.php and dropped malware, caught.Admin rosterNew or elevated admins and their application passwords, flagged.Exposure scanLeaked keys, exposed files and weak headers — found before an attacker finds them.Mixed contentNo insecure http resources on your HTTPS pages.Background jobsThe Action Scheduler queue keeps draining.
Sales & checkoutGuest checkoutAdd to cart → pay, as a first-time shopper.Logged-in checkoutPurchase as a real, signed-in customer.Payment methodsEvery way to pay stays available.StorefrontYour shop page loads and lists products.Prices & stockPrices show and add-to-cart works.Order anomalyCatches a silent drop in orders.
Accounts & emailCustomer loginSign-in works, all the way into the account area.Password resetThe reset email actually sends and arrives.Email deliveryYour site can still send mail — before customers notice it can’t.
Uptime & availabilityUptimeReachable, fast, and not erroring.SSL certificateValid, trusted, and not about to expire.Maintenance-mode leakNo ‘coming soon’ wall hiding your live site.
Domain & DNSDomain registrationNot expiring, not on hold, locked.DNS healthRecords unchanged, DNSSEC working, resolvers agree.Email authenticationSPF, DKIM and DMARC that keep your mail trusted.Certificates & subdomainsNo surprise certificates, no dangling subdomains.
Search & AI visibilitySEO integrityNo accidental noindex; robots and canonical sane.AI / AEO readinessFound and cited by ChatGPT, Perplexity & AI Overviews.Multilingual healthhreflang cluster valid, every locale indexable.Google Search Console monitoringClicks, indexed pages and rich results — against your own usual.Bing Webmaster Tools monitoringPages in Bing's index, crawl errors and traffic — watched daily.
See all checks →
Changelog

What’s new in Relvato

Every update to the Relvato app and the WordPress plugin, newest first.

  1. WordPress pluginv0.2.10
    • Fix: Coupon removal now actually clears the cart. Over REST, remove_coupon() was a no-op (the code wasn't found in the un-hydrated cart, then recalculation restored it from the session), so a 100%-off verification coupon could persist and zero a later run's totals. Now clears the session coupon state directly and force-saves it.
  2. WordPress pluginv0.2.9
    • Fix: Persist coupon apply/remove to the cart session in the REST endpoint (WC()->cart->set_session), so a removed verification coupon actually stays removed. Without this a 100%-off verification coupon could linger on the logged-in verification user's cart and zero out a later run's totals.
  3. WordPress pluginv0.2.8
    • Add: Server-side coupon apply/remove endpoint so coupon verification is theme-independent — no need to find a theme's coupon field (some themes, e.g. Rey, hide it with no standard toggle).
    • Fix: The runner's REST calls now load the correct cart for logged-in (authenticated-journey) verification. WordPress ignores cookie auth on REST without a nonce, so cart totals, coupons, and shipping were read from an empty cart; the token-gated endpoints now honor the runner's auth cookie.
  4. WordPress pluginv0.2.7
    • Add: Signed REST endpoints (cart-state, store-info) so Relvato reads structured cart totals, coupons, and shipping directly from WooCommerce instead of scraping the page — robust across themes and locales. Token-gated to the verification runner.
  5. WordPress pluginv0.2.6
    • Add: Coupon support for checkout verification — verify a coupon applies (or is correctly rejected), and place real "free" test orders on stores without cash on delivery via an auto-created, restricted 100%-off verification coupon (locked to the verification user, never public).
  6. WordPress pluginv0.2.5
    • Add: "Connect with Relvato" onboarding — a one-click button (and an admin prompt when unconnected) that opens the dashboard pre-filled for this store, so you just pick/create the site and paste the connect token back. Guided two-step setup.
  7. WordPress pluginv0.2.4
    • Change: Connection is now a single "connect token" pasted from the dashboard, instead of separate Endpoint / Site ID / Signing secret fields — fewer fields to copy and no risk of a mismatch. Existing connections keep working; leave the token blank to keep the current connection.
  8. WordPress pluginv0.2.3
    • Add: Email-delivery verification support. The verification user's email is pointed at the site's Relvato inbox so order-confirmation emails can be checked for actual delivery.
    • Add: Store-owner order notifications (new/cancelled/failed) are suppressed for verification test orders, so running verifications no longer emails the merchant. Customer emails are untouched.
  9. WordPress pluginv0.2.2
    • Fix: block-based (Store API) checkouts now tag and auto-remove verification test orders too — previously only classic shortcode checkouts were cleaned up, so block-checkout stores left the test order in place.
  10. WordPress pluginv0.2.1
    • Add: "Settings" link on the Plugins screen for quick access to the configuration page.
  11. WordPress pluginv0.2.0
    • Add: Settings page (Endpoint, Site ID, Signing secret, Verification user, Enable/disable, Test orders).
    • Add: Authenticated checkout — token-gated trusted login as a dedicated verification user (no password stored).
    • Add: Test-order hygiene — verification checkouts no longer change stock; test orders are auto-trashed.
    • Add: Verification-mode bypass for WooCommerce "Coming soon" so staging/pre-launch stores can be verified.
  12. WordPress pluginv0.1.0
    • Initial release: change detection (core/plugin/theme/WooCommerce updates), HMAC-signed change events with debounced dispatch, and verification-mode token handling.