=== Cart Lookout – Checkout Monitoring for WooCommerce ===
Contributors: cartlookout
Tags: woocommerce, checkout, monitoring, alerts, testing
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
Requires Plugins: woocommerce
Stable tag: 0.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Tests your WooCommerce checkout with a real browser around the clock and alerts you when it breaks, with the failing step and likely cause.

== Description ==

A broken checkout costs sales quietly. A payment plugin updates overnight, a theme change hides the Place order button, or a caching rule breaks the checkout page, and nobody notices until customers complain or sales dry up.

**Cart Lookout** is a hosted service that places safe test orders on your store with a real browser, on a schedule. When checkout fails twice in a row, you get an alert with the step that broke, a screenshot and the likely cause.

**This plugin is the store side of that service.** On its own it doesn't monitor anything; it makes the service's tests safe and lets it read basic facts about your store. You need a Cart Lookout account to use it.

= What the plugin does on your store =

* **Connects your store** to your Cart Lookout account with a token you paste in. The secret is stored encrypted and never shown again.
* **Creates one hidden test product** (virtual, priced 1.00 in your currency, hidden from your shop and search). Ordinary shoppers can't buy it.
* **Adds a hidden test payment method** that takes no money. Only Cart Lookout's own test sessions can see or use it, and only to pay for the test product, never for your real products. It never appears to shoppers or in your payment settings.
* **Keeps test orders out of your business:** every test order is tagged, sends no WooCommerce email (to customers or to you), is skipped by WooCommerce webhooks, and is deleted after the test with any stock put back.
* **Reports store facts** for diagnosis: WordPress, WooCommerce and PHP versions, theme, checkout type and recently updated plugins. Never customer data.

= Works with =

* Classic (shortcode) checkout and block checkout.
* WooCommerce's High-Performance Order Storage and the older posts storage.
* Tested with WooCommerce 9.9, 10.9 and 11.2.

= Security =

* Every request from the service is signed (HMAC-SHA256) with a secret only your store and your account share, must be less than 5 minutes old, and can be used only once.
* Requests are rate-limited, and repeated failed attempts are blocked for 10 minutes.
* The settings screen is available only to users who can manage WooCommerce.

== External services ==

This plugin is the store-side part of the **Cart Lookout** checkout-monitoring service, operated at https://cartlookout.com. It is required for the service to work.

**The plugin does not send any data by itself.** It never makes outgoing requests. Instead, once you paste a connection token, the Cart Lookout service connects to your store's REST API at `/wp-json/cartlookout/v1/`, using requests signed with a secret shared only by your store and your account.

What the service reads or does, and when:

* **When you connect, and on each scheduled health check:** your site address, WordPress, WooCommerce and PHP versions, the active theme's name and version, whether checkout uses the block or the classic shortcode, whether High-Performance Order Storage is on, your store currency, and the names and versions of plugins, themes and WordPress core updated in the last 7 days.
* **Before each test order:** it asks the plugin to create or reuse the hidden test product and to open a 10-minute test session.
* **After each test order:** it asks the plugin to delete the test order.

No customer data, order data from real customers, personal data, passwords, payment details or settings values are sent.

During a test, Cart Lookout's browser places an order on your store with fictional test details (for example `runner@example.test`), exactly as a shopper would.

* Terms of service: https://cartlookout.com/terms
* Privacy policy: https://cartlookout.com/privacy

== Installation ==

1. Make sure WooCommerce is installed and active.
2. Install and activate **Cart Lookout – Checkout Monitoring for WooCommerce**.
3. In your Cart Lookout dashboard, add your store and copy the connection token.
4. In WordPress, go to **WooCommerce → Cart Lookout**, paste the token and click **Save token**.
5. Cart Lookout connects and the status changes to **Connected**. The first test runs shortly after.

If your store uses a security plugin or firewall that blocks the REST API, allow requests to `/wp-json/cartlookout/v1/`.

== Frequently Asked Questions ==

= Do I need a Cart Lookout account? =

Yes. This plugin makes the service's tests safe and lets the service connect to your store. Without an account it does nothing.

= Will test orders affect my customers, stock or reports? =

They are designed not to. Test orders send no WooCommerce emails, are skipped by WooCommerce webhooks (so shipping and accounting integrations don't receive them), and are deleted within the test, with stock restored. The test product is virtual and doesn't track stock.

One limit: if another plugin sends its own email directly when an order is created, rather than through WooCommerce's email system, Cart Lookout can't silence that email.

= Will my real payment gateway be charged? =

No. Tests pay with the hidden test payment method, which takes no money, or with an offline method such as cash on delivery. Live card payments are never used.

= Can shoppers see the test product or the test payment method? =

No. The test product is hidden from your shop and search and can't be bought outside a Cart Lookout test session. The test payment method appears only inside a test session.

= Does it work with block checkout? =

Yes, with both block checkout and the classic shortcode checkout.

= What happens when I disconnect or delete the plugin? =

Disconnecting deletes the stored secrets immediately; Cart Lookout can no longer reach your store. Deleting the plugin also removes its settings, the hidden test product and any leftover test orders.

== Changelog ==

= 0.1.0 =
* First version: connection screen with encrypted token, signed and rate-limited REST API (handshake, health, prepare-test, cleanup), hidden test product and test payment method for classic and block checkout, silent self-deleting test orders, version-change log, clean uninstall.
