Checkout Speed Audit

Adds a WooCommerce → Checkout Speed Audit page with one button, Send me the Report. It’s free, and the report arrives by email as a PDF within a few minutes.

tvarkom’s scanner measures your store from outside, the way a visitor’s request would reach it:

• Server response time of your homepage, cart and checkout
• Caching of your pages and static files
• Page weight, number of files and marketing trackers

It adds what the plugin reads from your store:

• Autoloaded options and database size, with the largest autoloaded options and the database tables left by removed plugins
• PHP version and settings, active plugins and object cache
• Action Scheduler and WP-Cron health, with failed and late tasks
• A profile of one checkout page load: which plugins, hooks, database queries and outside services take the time
• A fix plan: what to fix first, step by step, with estimated developer hours

You can request one report per week. Until 7 days have passed, the Send me the Report button is disabled and the page shows the date of your next scan. A scan that failed doesn’t count. Reports go to the site’s admin email by default; you can change the address.

The scan runs on tvarkom’s servers and loads your public pages like a visitor would. The plugin changes nothing on your store, apart from one small table of daily totals (below). For the checkout profile it loads your checkout page once from your own server, with one product in a temporary cart that is never saved; nothing is ordered. Analytics or marketing plugins that record checkout visits on the server may count that page load as one visit.

External services

This plugin uses the tvarkom audit service (https://tvarkom.com) to register your store and run scans. The plugin contacts tvarkom for the first time when an administrator clicks Send me the Report, right under a list of what it sends and the line “By clicking “Send me the Report”, you agree to send this data to tvarkom and accept tvarkom’s Terms of Use and Privacy Policy”. Before that click, nothing is sent and the plugin’s page contacts nobody.

Registration (first scan only): your store’s home URL, the report email and the URL of the plugin’s verification endpoint are sent to https://api.tvarkom.com/v1/register. tvarkom then calls https://<your store>/wp-json/tvarkom/v1/verify to confirm the request came from your store, and issues a free API key for your domain (https://api.tvarkom.com/v1/register/verify).

Each scan: your store’s home URL, cart and checkout URLs and the report email are sent to https://api.tvarkom.com/v1/audits. tvarkom’s scanner then loads your homepage, cart and checkout pages.

Store data: these values are sent as well. The plugin lists them above the Send me the Report button.

• PHP, WordPress and WooCommerce versions
• Database and options table sizes, autoloaded options size
• Number of active plugins, object cache type
• Action Scheduler task counts (pending, overdue, failed) and how late WP-Cron is
• Orders in the last 30 days as a range (for example 50–200)
• Your store’s business context, so the report can explain findings in business terms:
  • country and currency from your WooCommerce settings
  • the number of paid and on-hold orders in the last 30 days, and of failed, pending and cancelled orders
  • gross sales in the last 30 days and the average order value, in your store’s currency, so the report can show them as they are. tvarkom uses them only to write your report and never stores them
  • how many customers in the last 30 days were new and how many returning, as two counts from WooCommerce Analytics (no customer is identified)
  • the number of published products and variations, and whether stock management is on
  • the IDs of the enabled payment gateways and shipping methods (for example stripe, flat_rate), never their settings or keys
  • whether checkout uses the Checkout block or the classic shortcode, and whether High-Performance Order Storage is on
  • the database and web server product (for example “MariaDB 10.11”, “nginx”), how many of your theme’s WooCommerce template overrides are outdated, how many plugins have an update waiting, and the name of an active backup plugin, if any
  • the domain your store’s emails come from (WooCommerce → Settings → Emails), never the address, so tvarkom can check its SPF and DMARC records
  • how many products were added to the cart, checkout pages opened and orders placed over the last 30 days, and how many days that covers. The plugin counts these on your server in a small table of daily totals (its name ends in tvarkom_csa_funnel): no cookies, no browser script and nothing about the shopper. Logged-in administrators and shop managers aren’t counted. Days older than 35 are deleted, and uninstalling the plugin removes the table
  • how many orders in the last 30 days came from each source type (for example organic search, referral, campaign, direct) and from the 10 most common campaign sources (utm_source, for example “google”), from WooCommerce Order Attribution
• The names and sizes of the 20 largest autoloaded options (never their contents)
• Names, sizes and estimated row counts of database tables no active plugin or theme matches, each with the name of the switched-off or not-installed plugin or theme it likely belongs to
• memory_limit, WP_MEMORY_LIMIT, max_execution_time and whether OPcache is on
• Failed Action Scheduler tasks grouped by hook with their count and last error message (with emails, links, IP addresses and long numbers removed), and the hook names and times of tasks more than 15 minutes late (never their arguments)
• The checkout profile: plugin, theme and hook names with their timings and call counts, database query shapes with every value replaced by ?, the host names (not the full addresses) of outside services called while the checkout page loads, object cache hit and miss counts, peak memory and the page’s server time

The report is emailed only to the report email. tvarkom keeps no copy: its report mailbox (checkoutspeedaudit@tvarkom.com) gets a short notice for each report sent, with the store’s domain, the time and the status, never the report. Notices and alerts are deleted after 12 months (see the privacy policy for the mailbox, the short-lived working copy and backups).

Audit history: we retain audit results linked to your store for support and comparison over time. For each report sent, tvarkom keeps the score and risk level, which scoring rules and fix plan items applied (as short identifiers), the response times, page weight and number of files, the autoloaded options size, the PHP version and object cache type, the days left on the HTTPS certificate, and whether SPF and DMARC records were found; never the report, its text, the report email, or option, table, task or hook names. The results aren’t anonymous: they’re linked to your store through its audit request. They’re used to answer you about your reports and, across stores, to improve the scanner, and are deleted 12 months after each scan, or sooner on request.

Store profile: tvarkom keeps the latest business context above (not the report, and no sales amount) for your store, replaced by each scan. It’s used as totals across stores (for example how many stores per country or size) and to support your store when you contact tvarkom, and it’s deleted with your store’s registration, at the latest 24 months after its last scan.

Next scan date and exchange rates: once your store is registered (after the first click), the plugin asks https://api.tvarkom.com/v1/client when your store may scan again, each time you open its page and before each scan, sending only your store’s key. The answer also carries the European Central Bank’s daily euro rates (fetched by tvarkom, not by your store), which versions before 0.12.0 used.

The plugin doesn’t read customers’ names, emails or addresses or order contents for this, and sends sales only as the two 30-day totals above, which tvarkom doesn’t store. Option, table, task and host names have email addresses, long numbers and identifiers replaced before they’re sent, and campaign names that look like one count as “other”.

Uninstalling the plugin deletes its settings, key and table of daily totals from your store; records on tvarkom’s side follow the retention periods in the privacy policy.

Terms of use: https://plugins.svn.wordpress.org/tvarkom-checkout-speed-audit-for-woocommerce/trunk/legal/terms-of-use.txt

Privacy policy: https://tvarkom.com/privacy/

Both ship with the plugin in its legal folder. The plugin page links to them before you run a scan, with a short privacy summary, and the plugin suggests text for your own privacy policy under Settings → Privacy.