Description
ChangeTrace watches your WordPress and WooCommerce site for meaningful changes and
errors and sends them to the ChangeTrace service (a cloud dashboard at
https://app.change-trace.com), where they are correlated against metrics to surface
the most likely cause of a movement, with evidence.
This plugin is the on-site agent. It does nothing until you connect it: you paste a
site token generated in the ChangeTrace dashboard, and only then does the plugin begin
sending data to the ChangeTrace API.
What it collects (once connected):
- A one-time baseline snapshot on connect: your active plugins and theme and their
versions, plus WordPress, PHP, and WooCommerce versions. - An hourly heartbeat so the dashboard knows the site is alive.
- Change detection — when plugins/theme/versions change.
- Error capture — PHP fatals/errors (shutdown + error handler, fails silently),
frontend JS errors (window.onerror, unhandled rejections, failed/5xx fetch & XHR;
sampled), and 5xx/timeouts on WordPress’s outbound HTTP and its own REST API.
All error payloads are PII-stripped (emails, credentials, form values, card numbers)
and size-capped before they are queued and sent. Events are held in a bounded local queue
and sent in batches (roughly every 5 minutes) with retry/backoff.
A ChangeTrace account is required. ChangeTrace is a third-party SaaS. See the
“External services” section below for exactly what is sent and where.
External services
This plugin connects to the ChangeTrace service to send monitoring data. This connection
is required for the plugin to do anything, and only starts after you connect the plugin
with a site token from the ChangeTrace dashboard.
Services used
- ChangeTrace API — https://api.change-trace.com
- ChangeTrace dashboard (web app) — https://app.change-trace.com
What data is sent, and when
- On connect (once): a baseline snapshot — your active plugins and theme with versions,
and your WordPress, PHP, and WooCommerce versions. - Every hour: a heartbeat (site is alive) plus your site token in the request header.
- Roughly every 5 minutes (when there is activity): a batch of events — detected changes
and captured errors (PHP/JS/HTTP). Error payloads are PII-stripped and size-capped. - On connect, your browser is sent to https://app.change-trace.com to sign in and approve
connecting this site.
Your site token is stored on your site and only ever sent to the API as an Authorization
header; the API stores only a hash of it. No data is sent before you connect.
This service is provided by ChangeTrace. By connecting your site you agree to their terms
and privacy policy:
- Terms of Service: https://change-trace.com/terms-of-service
- Privacy Policy: https://change-trace.com/privacy-policy
Screenshots
Installation
- Install and activate the plugin from the Plugins screen (or upload the folder to wp-content/plugins/).
- Open ChangeTrace in the admin menu.
- Create an account at https://app.change-trace.com, generate a site token (it starts
with
site_tok_), and paste it into the connect screen.
Advanced: the API, dashboard, privacy, and terms URLs can be overridden in wp-config.php
via CHANGETRACE_API_BASE_URL, CHANGETRACE_APP_URL, CHANGETRACE_PRIVACY_URL, and
CHANGETRACE_TERMS_URL, or via the matching changetrace_* filters.
FAQ
-
Do I need a ChangeTrace account?
-
Yes. ChangeTrace is a hosted service. The plugin is the on-site agent and needs a site
token from https://app.change-trace.com to do anything. -
Does the plugin send any data before I connect it?
-
No. Nothing leaves your site until you paste a valid site token and connect. See the
“External services” section for what is sent afterward. -
Is personal data sent to ChangeTrace?
-
Error payloads are PII-stripped (emails, credentials, form values, card numbers) and
size-capped before being queued and sent. The baseline snapshot contains software
versions and plugin/theme names, not visitor data. -
How do I stop sending data?
-
Deactivate the plugin, or disconnect the site from the ChangeTrace connect screen. You
can also delete the plugin; it cleans up its stored token and options on uninstall. -
Can I point the plugin at a self-hosted or staging environment?
-
Yes. Define
CHANGETRACE_API_BASE_URL(and optionallyCHANGETRACE_APP_URL) in
wp-config.php.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“ChangeTrace” is open source software. The following people have contributed to this plugin.
Contributors
Translate “ChangeTrace” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
0.3.0
- Error capture: PHP fatals/errors (shutdown + error handler, fails silently),
frontend JS errors (window.onerror, unhandled rejections, failed/5xx fetch & XHR;
sampled), and 5xx/timeouts on WordPress’s outbound HTTP + own REST API. - All error payloads are PII-stripped (emails, credentials, form values, card numbers)
and size-capped before queuing.
0.2.0
- Baseline snapshot (plugins, theme, WP/PHP/WooCommerce versions) sent once on connect.
- Bounded local event queue (drops oldest when full) with a scheduled batch sender
(every 5 minutes) that retries with exponential backoff on failure. - Remote config fetch (enabled modules, sampling, heartbeat interval).
0.1.0
- Connection layer: connect screen, secure token storage, hourly heartbeat.
0.0.0
- Initial skeleton. Boots and activates; no detectors wired up yet.