Pingvera

Pingvera is a monitoring service for studios and agencies that maintain many
client websites. Unlike a plain uptime checker, it watches whether the client’s
business actually works — orders arrive, forms deliver, checkout runs — not
just whether the homepage returns 200. So you find out about a problem before the
client calls asking “why did the orders stop?”.

This plugin is the inside connector: it looks at the WordPress/WooCommerce site
from the inside and reports to your dashboard:

• Commerce (WooCommerce): real-time order.created / order.failed events that feed a unified timeline and a business-anomaly detector (“orders dropped to zero while the site is up”), plus failed-order spikes, payment-gateway and checkout health, and a daily order-pipeline smoke run.
• Inventory: WordPress core, PHP and database versions, active theme, plugins and their versions.
• Updates: available core and plugin updates.
• Security: predictable admin login name, debug mode left on, core file integrity (checksums), a malware scan, and new-administrator detection.
• Performance: object cache presence, size of autoloaded options.
• Availability: REST loopback, recent PHP fatal errors (a count only, never the log itself).
• Configuration: WP-Cron mode and task lag; mail/SMTP.
• Files: write permissions on wp-config.php.

What the plugin does NOT do: it opens no inbound ports, executes no remote
commands, and never transmits passwords, database contents, or visitor
personal data. All communication is outbound HTTPS to your own dashboard.

External services

This plugin is the connector for Pingvera, an external website-monitoring
service (https://pingvera.com). The plugin exists to send your site’s technical
health to your Pingvera dashboard, so using it requires that service. It talks to
the dashboard you configure — a hosted dashboard such as pingvera.com, or your
own self-hosted/on-prem instance — over outbound HTTPS only.

What is sent and when:

• Pairing (once, when you click “Connect”): the one-time pairing code and your
  site URL are sent to obtain a scoped access token. Endpoint: /cms/v1/pair.
• Sync (once an hour via WP-Cron, and on “Sync now”): technical health and
  inventory — WordPress, PHP and database versions; the active theme and the list
  of plugins with their versions; available updates; security, performance and
  configuration findings; WooCommerce order statistics and payment gateway /
  checkout status; and a count of recent PHP fatal errors. Endpoint: /cms/v1/sync.
  Passwords, database contents, post content and visitor personal data are never
  sent.
• Real User Monitoring (only if enabled for your site in the dashboard): a small
  asynchronous script is loaded on the front end to collect anonymous Core Web
  Vitals (loading and interaction timings) of your own pages. Endpoint: /rum/v1/.
  No personal data is collected.
• Business events (WooCommerce only, as they happen): when a new order is
  created or an order fails, the order ID, total, currency and status are sent
  so the dashboard can flag unusual patterns in real time. Endpoint: /cms/v1/event.
  No customer names, addresses, emails or payment details are sent.

Service provided by Pingvera:

• Terms of Service: https://pingvera.com/terms.html
• Privacy Policy: https://pingvera.com/privacy.html