Eyesite Monitor

Description

Eyesite Monitor is a health and performance monitoring plugin for your WordPress site and WooCommerce store. It is a complete solution for agencies, freelancers and e-commerce owners that detects problems before your customers do. The plugin works on its own locally, and can optionally connect to the EyeSite service (eyesite.pl) for external 24/7 uptime monitoring and e-mail alerts.

Key features

• Store monitoring: Tracks payment errors, the cart, shipping problems and sales silence (no orders for an unusual period).
• Order anomalies: Intelligent detection of irregularities in order statuses based on a 30-day rolling average.
• Server monitoring: Checks site availability, disk space usage, memory (RAM) and that WP-Cron is running correctly.
• Google and AI visibility: Indexing blocks, sitemap, schema.org data, and whether AI assistants (ChatGPT, Claude, Perplexity) are allowed to read the site.
• Security: Warns when your WordPress version has publicly known security holes, tests SSL certificate validity, Cloudflare protection and two-factor authentication (2FA).
• Error reporting (JS & PHP tracking): Captures and logs critical JavaScript (front-end) and PHP errors, including contact-form submission errors.

External services

This plugin connects to the EyeSite service (https://eyesite.pl) to provide external uptime monitoring and e-mail alerts. The connection is entirely optional and only happens after you click the “Connect” button in the plugin panel. Without connecting, the plugin still works locally (the monitoring dashboard is available offline).

What data is sent, and when:

• When connecting (after you click “Connect”): your site URL, your site name, the monitoring endpoint URL (which contains the API token used to read status) and your administrator e-mail address (pre-filled on the connect page, editable) used for alert notifications. This data is sent to the connect page at https://eyesite.pl/connect.
• Periodically: the EyeSite monitoring backend requests your site’s public status endpoint (/?eyesite-api=check) to read health status (UP/DOWN and check results) and e-mails you on failure.
• Once a day: the plugin verifies the connection token by sending it to the EyeSite automation backend at https://n8n.bielecki.cloud/webhook/eyesite-verify.
• On disconnect: the plugin sends the token to https://n8n.bielecki.cloud/webhook/eyesite-disconnect.
• Uptime data (only when connected, fetched in the background): the plugin reads your site’s public uptime history from the EyeSite status page at https://status.eyesite.pl (the status page is identified by a slug made from your site’s address, e.g. example-com). This includes the day-by-day availability file https://status.eyesite.pl/eyesite-dni/.json used in the monthly report. Only the slug is sent; nothing else.
• Feedback form (only when you submit it): the message, feedback type, your site URL, site name and administrator e-mail are e-mailed to the plugin author and also posted to https://n8n.bielecki.cloud/webhook/eyesite-feedback for logging. Nothing is sent unless you click “Send”.
• Page-speed check (opt-in, off by default): only after you enable “Pomiar szybkości strony” in the settings or click “Włącz pomiar prędkości” on the dashboard, the plugin sends your site’s public URL to the EyeSite automation backend at https://n8n.bielecki.cloud/webhook/eyesite-lighthouse, which queries the Google PageSpeed Insights API (https://developers.google.com/speed/docs/insights/v5/about) server-side and returns the performance score. It then repeats at most every 6 hours while you open the plugin dashboard. Only the public site URL is sent; no personal data. You can switch it off at any time in the settings. Google’s terms: https://developers.google.com/terms ; privacy: https://policies.google.com/privacy
• Audit and repair requests (only when you click “Zleć naprawę” or a free-audit button): your site URL, site name, administrator e-mail, the type of request, the problem description shown next to the button and the detected consent-mode status / names of tracking tags found on your home page are e-mailed to the plugin author (kontakt@eyesite.pl) using your site’s own mailer and also posted to https://n8n.bielecki.cloud/webhook/eyesite-audit-lead so that we can contact you about the request. Nothing is sent unless you click the button.
• Connection notice (only when you click “Connect”): the plugin author (kontakt@eyesite.pl) receives an e-mail with your site name, site URL and administrator e-mail, sent by your site’s own mailer, so that the service can be set up.
• E-mail delivery test (only when the site is connected to EyeSite): the plugin sends a short test e-mail from your site’s own mailer to probe@eyesite.pl. The message contains only a random token (no site data, no personal data). The plugin then asks https://n8n.bielecki.cloud/webhook/eyesite-mailprobe for the verdict (SPF/DKIM/DMARC result, blacklist status), sending only that token. The test runs when you click the test button on the e-mail card and automatically at most once a day while the site is connected; disconnecting stops it.
• WordPress security status (once a day): the plugin downloads the public list of WordPress releases from WordPress.org at https://api.wordpress.org/core/stable-check/1.0/ and compares it locally with the installed version, to warn you when your WordPress version has publicly known security holes. The request sends nothing about your site (no version, URL or token). This is the same WordPress.org API that WordPress itself uses; terms: https://wordpress.org/about/privacy/
• Known vulnerabilities in plugins and themes (opt-in, off by default): only after you enable “Sprawdzanie znanych luk we wtyczkach i motywach” in the settings, the plugin sends the list of installed plugin and theme slugs with their version numbers to the EyeSite automation backend at https://n8n.bielecki.cloud/webhook/eyesite-vulns once a day (and shortly after an update). The backend matches the list against a copy of the Wordfence Intelligence vulnerability database (https://www.wordfence.com/threat-intel/) and returns the matching records. No site URL, e-mail address, token or personal data is sent, and the list is not stored. Vulnerability data: Wordfence Intelligence, Copyright Defiant Inc., terms: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/

• Domain expiry check (opt-in, off by default): only after you enable “Sprawdzanie daty wygaśnięcia domeny” in the settings, the plugin sends your site’s registrable domain name (e.g. example.com) to the public RDAP service at https://rdap.org once a day and reads the registration expiry date and registrar. Nothing else is sent. RDAP.org terms and privacy: https://about.rdap.org/

• File integrity check (on by default, can be switched off in the settings): once a day the plugin downloads the public checksum lists for the installed WordPress version from https://api.wordpress.org/core/checksums/1.0/ and for each installed plugin from https://downloads.wordpress.org/plugin-checksums/ (the request URL contains only the WordPress version and locale, or the plugin slug and version). Your files are compared on your own server; nothing about your site is sent.

• Leaked password check (opt-in, off by default): only after you enable “Sprawdzaj hasło administratora w bazie wycieków”, when an administrator logs in (at most once a week per account) the plugin sends the first 5 characters of the SHA-1 hash of the password to the Have I Been Pwned “Pwned Passwords” API at https://api.pwnedpasswords.com/range/ (k-anonymity: the password and its full hash never leave your server). Terms: https://haveibeenpwned.com/API/v3#AcceptableUse, privacy: https://haveibeenpwned.com/Privacy
• Captcha key check (only when a form plugin has reCAPTCHA, Cloudflare Turnstile or hCaptcha configured): once a day the plugin sends the secret key stored in that form plugin’s settings, together with a dummy token, to the captcha provider’s own verification endpoint (https://www.google.com/recaptcha/api/siteverify, https://challenges.cloudflare.com/turnstile/v0/siteverify or https://api.hcaptcha.com/siteverify). This is the same request your form already makes on every submission; no visitor data is sent. The answer tells whether the key is valid.
• Form test (“mystery shopper”, connected sites only, switched on per site only after the owner agrees): EyeSite’s test browser opens a page with a form, fills it with obviously fake data (“Test EyeSite”, probe@eyesite.pl) and submits it, carrying a signed cookie valid for at most 30 minutes. For those requests the plugin redirects the form notification to the EyeSite test inbox (probe@eyesite.pl) instead of your recipients, and blocks outgoing requests and newly scheduled jobs to other services (CRM, newsletter, webhooks) except the captcha check and the e-mail sending itself. Integrations that queue data in their own database tables may still process the test entry later, and the form plugin may keep the test entry in its own entries list; this is why the test is enabled per site only on request. The EyeSite backend then reports the result to the plugin (form accepted, e-mail delivered). The plugin also exposes the list of pages with forms (URL, form plugin, title) to the EyeSite backend, authenticated with the site’s API token.
• Security event log (connected sites only): important admin events (a new administrator account, an administrator’s e-mail or password change, plugin installs and activations, a change of the site address or of the default role for new accounts, an administrator login from a new address, a login attempt on the trap account, changed files) are sent as they happen to https://n8n.bielecki.cloud/webhook/eyesite-blackbox with the connection token: event type, a short description, the login of the user who caused it, the site address and the time. E-mail addresses in the description are masked (ja***@example.com). No IP addresses and no content. This lets EyeSite e-mail you at the address given when connecting even if an intruder changes the site’s admin e-mail, and keeps a copy of the log that cannot be erased on the server. When you deactivate the plugin or click “Rozłącz”, the disconnect request also carries the reason and the login of the user who did it, so you get an e-mail if someone else switched the protection off.
• Visitor behaviour analysis (opt-in, off by default, connected sites only): only after you open the “Jak ludzie zachowują się na stronie” card, accept the data-processing agreement and switch it on, the plugin loads the analytics and session-recording scripts from the EyeSite analytics server at https://analityka.eyesite.pl (self-hosted Umami, https://umami.is, MIT licence, server in the EU). From then on that server receives, for each visit: page paths, page titles, referrer domain, browser, device type, screen size, language and country, and a recording of the rendered page (mouse movement, scrolling, clicks and DOM changes). It does not store IP addresses, city or region, URL query strings or ad click identifiers. Form fields are masked by the recorder, so what visitors type is not recorded, and WooCommerce billing, shipping and checkout fields are excluded entirely. No cookies are set. Recordings are deleted after 30 days and visit statistics after 13 months. By default the scripts start only after the visitor accepts statistics cookies in your consent banner (Complianz, CookieYes, Borlabs and Real Cookie Banner are recognised; without a recognised consent nothing is recorded); you can instead choose your legitimate interest, in which case visitors can opt out with the [eyesite_rezygnacja] shortcode. The plugin adds a suggested paragraph to Settings -> Privacy -> Policy guide. Your acceptance of the agreement (version, date, WordPress login and e-mail) is sent to EyeSite together with the request that switches the feature on. While the feature is on, the plugin asks https://eyesite.pl once a day whether recording should continue (sending the connection token and the analytics site ID) and fetches the ready-made written conclusions for the dashboard card and the monthly report (same data). When you switch it off, disconnect the monitoring or deactivate the plugin, it notifies https://eyesite.pl so that all data of your site is deleted within 30 days. You can switch it off at any time from the same card; disconnecting the monitoring switches it off as well. Terms and privacy: https://eyesite.pl/regulamin/ and https://eyesite.pl/polityka-prywatnosci/

AI visibility check (once a day): the plugin reads your own home page and /robots.txt, and requests the home page once more with the user agent string of an AI search bot (OAI-SearchBot) to see whether your server or firewall turns such bots away. These are requests to your own site only; nothing is sent to OpenAI, Anthropic or any other service.

Database leak trap (created only on sites connected to EyeSite, can be switched off in the settings): the plugin creates one WordPress user account with a random login, no role, no posts, an undeliverable e-mail address (…@pulapka.invalid) and a random 40-character password that is never stored or shown. Logging in to it and resetting its password are always refused. It is hidden from the REST API, the users sitemap and author archives, and marked “Pułapka EyeSite” in the Users list. Its login exists only in your database, so a login attempt or a password-reset request for it means someone has read the database; you are alerted at once. The plugin also adds one Disallow line with a random path to the virtual robots.txt: only bots that ignore robots.txt visit it, which helps tell targeted login attempts from background noise. Switching the option off or uninstalling the plugin deletes the account.

Tracking tag detection (Google Tag Manager, Google Analytics, Meta Pixel, etc.), SSL certificate, SEO, checkout and hardening checks only read your own site (loopback requests to your home page, robots.txt, sitemap, cart and REST endpoints). The plugin does not load, call or send data to these services. The e-mail DNS check (SPF, DKIM, DMARC, MX) uses your server’s normal DNS resolver.

The EyeSite service (eyesite.pl) and its automation backend (n8n.bielecki.cloud) are provided by Bielecki Consulting. Terms of use and privacy policy:

• Terms of service: https://eyesite.pl/regulamin/
• Privacy policy: https://eyesite.pl/polityka-prywatnosci/

Privacy

Visitor data stays on your site. The plugin stores in your site’s own database: for a front-end error (a JavaScript error) the error message, script source and stack trace; for a contact-form submission whether it succeeded; for a visitor who leaves the WooCommerce cart or checkout page with products in the cart the cart total and whether a technical error happened. Each record also has the page URL, browser and device type, the user-agent string and a random session identifier. It does not store IP addresses, cart contents or customer details, and none of this data is sent to EyeSite or any other service.

Form copies (on by default only on connected sites, can be switched off): each contact-form message is also kept encrypted on your own server for 30 days, so an enquiry is not lost when e-mail fails. Copies never leave your site.

Visit statistics: daily page-view totals stored on your site only, without cookies.

Cookie: the browser sets a first-party cookie eyesite_session holding a random identifier, valid for 30 minutes, only when one of the events above happens: a JavaScript error, a contact-form submission (successful or not), or leaving the cart or checkout page with products in the cart. It is used solely to group these reports from the same visit and is never sent to EyeSite. Pages viewed without any of these events never set it, so full-page caching is not affected. Treat it as a functional cookie in your consent banner.

Retention: records are deleted automatically after 60 days, resolved errors after 3 days. Uninstalling the plugin removes its tables and options.

The plugin adds a suggested paragraph to Settings -> Privacy -> Policy guide that you can copy into your privacy policy.