CartProof documentation

CartProof tests pending WooCommerce updates by placing real test orders in an anonymized sandbox copy of your store, before and after the updates, and applies them to the live store only when checkout still works. The free CartProof Connector plugin links a store to a CartProof account; the account decides what runs and when. This guide covers installing and pairing the connector, what it sends, and the controls that live in wp-admin.

Requirements

• WordPress 6.4 or newer, WooCommerce 8.0 or newer and PHP 8.0 or newer, on any host.
• A CartProof account. The free Checkout Monitor needs one too; unpaired, the plugin only adds a settings screen under WooCommerce → CartProof and makes no external requests.
• Unique AUTH_KEY and SECURE_AUTH_KEY values in wp-config.php. The connector encrypts its keys with them and refuses to pair while they are missing or still the sample placeholder.
• Single-site WordPress. Multisite is not supported in this version.

Install and pair

1. Install and activate WooCommerce, then the CartProof Connector: download the zip from the CartProof product page, Plugins → Add New → Upload Plugin, install, activate.
2. In your CartProof dashboard, add the store. The dashboard shows an 8-word pairing code, valid for 90 seconds.
3. In wp-admin, open WooCommerce → CartProof, paste the code and click Pair with CartProof. Pairing means you accept the CartProof Terms of Service and Privacy Policy, linked under the button.
4. Check the status line on the same screen: connection, last heartbeat, delivery mode, and the last and next daily checkout check.

To disconnect, click Disconnect on the same screen. The keys and schedules are removed and CartProof is told to revoke them.

Firewalls and polling mode

CartProof reaches the store through signed REST requests. If a firewall or security plugin (Cloudflare, Wordfence, Sucuri and similar) protects your REST API, the settings screen shows the allowlist entry to add. Without it the connector works in polling mode and picks up queued work on its heartbeat, with up to 5 minutes of latency. The connector also sends loopback requests to your own site, at most once every 6 hours on the settings screen, to check that background processing works.

What runs on each plan

• Checkout Monitor (free account). Once a day, at a time CartProof assigns, the connector loads the checkout page with one item in a throwaway guest cart, reads the Store API cart and checks for PHP fatal errors since the last check, then empties the cart and deletes the session. It reports the result and the pending update list; CartProof emails you when checkout stops working and sends a digest when updates are waiting. No order is created and nothing changes on your site.
• Store, Store Pro and Agency. CartProof takes an anonymized copy of the store into an isolated sandbox, places test orders before and after the pending plugin, theme, core and translation updates, and reports whether it is safe to update and which update broke checkout. On plans that include it, the tested updates are then applied to the live store, only after the connector has created and verified a restore point.

Everything else is decided in the CartProof dashboard: which stores are connected, when tests run, and whether updates are applied automatically, after approval, or never. The only switches in wp-admin are local ones: polling-only delivery, allowing Canary Orders on this store, and deleting restore points.

What leaves your store

• Heartbeat, every 5 minutes while paired: software versions, a hash of the plugin list, pending update counts, checkout health and environment hints, plus the connector’s own audit log and store events (a PHP fatal, a plugin activated or deactivated, a theme switched, an automatic update). Never customer data.
• Inventory, before a test run: plugins, themes, drop-ins, server and locale details, and the checkout-related WooCommerce settings (gateway ids and test-mode state, shipping zones, tax and coupon switches, currency, guest checkout, HPOS, block or classic checkout). No customer data and no secret values.
• Test-run export, to CartProof storage over single-use pre-signed URLs: the database with names, emails, addresses, phone numbers, IP addresses and payment tokens replaced or removed on your own server while the export is written, plus the plugin, theme and referenced media files needed to rebuild the store. The connector checks the export for leaks before upload.
• Premium packages: when a pending update is not public, the connector downloads it with your site’s own licence through the plugin’s normal update mechanism and uploads the zip so the exact same package can be tested. Licence keys are never asked for or stored.

Applying updates and restore points

Before an update, the connector zips the plugins and themes being updated and saves their settings. When an update can change the database (WooCommerce core, Subscriptions, or plugins with their own database version), it also makes a full database backup. Restore points stay on your server in wp-content/uploads/cartproof-restore/ and are never uploaded. The database backup is your own rollback copy, so it is not anonymized; it is encrypted with a key derived from your wp-config.php security keys and the directory is blocked from web access by .htaccess. The connector keeps the newest 3 restore points, removes others after 72 hours and removes anything older than 14 days. Delete restore points now on the CartProof screen removes them at once.

On nginx, .htaccess is ignored and the settings screen shows the location block to add. Better still, move restore points outside the web root with define( 'CARTPROOF_RESTORE_DIR', '/path/outside/webroot' ); in wp-config.php.

During an apply or rollback the connector writes a temporary must-use plugin, 000-cartproof-maintenance.php, which answers checkout and cart requests with “back in a minute” (HTTP 503) so no shopper pays against a half-installed plugin. It expires after at most 15 minutes and removes itself. Packages are installed only if their SHA-256 matches the package that passed the tests, only plugins that were active before are reactivated, and the connector rolls back automatically if the post-update health check fails. Database restores are never automatic; if you ask for one, the orders placed since the restore point are first exported, encrypted the same way, and downloadable as CSV or JSON from the CartProof screen.

Canary Orders

An optional, owner-enabled check on Store Pro and Agency. Turn it on with Allow CartProof to place $0 Canary Orders on this store on the CartProof screen (or define( 'CARTPROOF_CANARY_ENABLED', true );) and in your CartProof policy. The connector creates one hidden, $0, virtual product and a single-use coupon; CartProof places one order with them after an update to confirm the live checkout works. Canary orders send no emails, do not touch stock, are excluded from WooCommerce Analytics and webhooks, and are cancelled and deleted automatically. Third-party tracking tools that cannot be told to ignore the visit may still record it. Turning the setting off removes the canary product and coupon.

Deactivating and uninstalling

Deactivating keeps the restore points and moves the canary product to draft. Uninstalling (Plugins → Delete) removes every CartProof option, key, table and schedule, the maintenance file, the canary product, coupon and any leftover canary order, all restore points and any unfinished export parts. Restore points cannot be restored without the plugin, so take a host backup first if you want to keep a copy.