Relvato — Continuous Monitoring

Description

Relvato is a website monitoring platform. It runs monitors against your site in a real browser: checkout, logins, sign-ups, contact forms, page speed, search visibility and security. This plugin connects your WordPress site to your Relvato account, so the monitors run again the moment something changes, and can see what a monitor running from outside can’t.

What the plugin adds:

• Runs after every change (Pro and up). A plugin, theme, WordPress or WooCommerce update tells Relvato to re-run the monitors that change can affect, so a broken checkout is caught minutes after the update, not days later. On the free plan you start the runs yourself, from WordPress or the Relvato app, or run them weekly.
• Monitors that need to be inside. Logged-in checkout and account pages through a dedicated test customer, test orders that never touch your stock, stay out of your analytics and ad platforms (and move themselves to the Trash), form tests that don’t email your team, WooCommerce health, backups, Site Health, PHP errors and failed emails.
• Security from the inside. File integrity against WordPress.org checksums, signs of a hack in themes, uploads and options, new administrators, leftover backup files, and hardening you can switch on and off.
• Fixes you apply. When a run proposes a fix (rolling back a plugin update, turning search indexing back on, clearing a cache…), it appears under “Relvato suggests” in WordPress → Relvato, and an administrator applies it there with one click. Relvato then re-runs its monitors to verify it, and every fix can be undone. Relvato never applies a fix or changes a plugin on its own.
• AI assistants. On WordPress 6.9+, Relvato’s abilities (site status, monitors, the brief for fixing a failure) are available to AI assistants through the WordPress Abilities API, for administrators only.

The plugin needs a Relvato account; there is a free plan (plans). Nothing is sent to Relvato until you connect the plugin. Every request between your site and Relvato is signed with your site’s own secret.

Five features are off until you turn them on in Relvato → Settings: the activity log (sign-ins, key changes, PHP errors and failed emails), the test login, form tests, real-user Web Vitals and the outside-services map. When you set up monitoring in the plugin, its last step lists the ones your chosen monitors need, with what each does: test login and form tests are ticked, the activity log and real-user Web Vitals are not, and only the ticked ones go on with the monitors. A monitor that needs one that’s off tells you which, in Relvato, instead of running.

External services

This plugin connects your site to Relvato, a website monitoring service run by Relvato (terms, privacy policy). Nothing below happens until you connect the site, by clicking “Connect with Relvato” or pasting your connect token.

Relvato (app.relvato.com). Used to run your monitors and show their results.

• When you click Connect with Relvato, your browser goes to app.relvato.com with your site’s address, the way back to your WordPress admin, a one-time check value, the active theme and the well-known plugins it runs, by name (for example WooCommerce, Yoast SEO, Wordfence, WP Rocket, Elementor), so you can sign in and confirm the site. When you come back, the plugin sends a one-time code, the matching secret and your site’s address to app.relvato.com to receive your connect token.

• When something changes on the site, the plugin sends a signed event about the change: plugin, theme, WordPress and WooCommerce updates, activations and theme switches; new administrators and role changes; and, while quarantine mode is on after a hack, new scheduled tasks and uploaded executable files. Each event names the WordPress user who made the change.

• While the activity log is on (off until you turn it on): administrator and editor logins (with the login name, role and the first part of the IP address) and counts of failed logins (never the usernames tried); changes to key settings (site address, registration, search visibility); edits made in the theme and plugin file editors; application passwords created or deleted; deleted administrators; and new PHP fatal errors and failed emails (the recipient’s domain only). With it on, the plugin also keeps when each administrator last signed in (on the site) and includes that time in the security review of accounts below, so Relvato can point out administrators nobody uses; switching the activity log off deletes those times.
• While the outside-services map is on (off until you turn it on): for each server-side request a plugin or theme makes to another server, the plugin’s or theme’s folder name and the host name it called (never the full address, what was sent or what came back), with the day it was first and last seen. Kept in your site’s options and read by Relvato’s Exposure scan; switching it off deletes it.
• Every six hours the plugin sends its version, which well-known plugins are active, by name (for example Yoast SEO, Wordfence, WP Rocket, WooCommerce, a form or caching plugin), the active theme, the search visibility setting, whether its REST routes can be reached (and if not, which plugin blocks them) and which of the features above are on.
• When you open the Relvato pages in WordPress, the plugin fetches your monitors’ status and Relvato’s suggestions, and sends the actions you start there (such as running a monitor).
• When an administrator applies a suggestion there, the plugin first asks app.relvato.com to start a plugin update or deactivation (so Relvato can verify it), then reports what was applied: which suggestion, whether it worked (and WordPress’s error if not), the hardening settings now on, and the WordPress user who applied it. A quarantine’s auto-update pause, a released update hold and an undo are reported the same way.
• Relvato’s monitors call the plugin’s own REST routes, signed with your site’s secret, to read results such as WooCommerce health, file checksums and installed plugin versions. None of them can change plugins, themes, settings or code; the only things they create or change are Relvato’s own test data (the test customer below, test orders, form-test entries and test emails). The security review of accounts reads the administrator and other privileged accounts (login name, display name, roles, when the account was created, the domain of its email address and the names of its application passwords), and the ways in that skip the login form: WooCommerce REST API keys (their description, owner, access and the last characters WooCommerce shows) and OAuth clients. Administrator passwords and API keys are never sent.
• While Test login is on (off until you turn it on), the plugin keeps one dedicated test customer account (it creates it as a customer, or a subscriber without WooCommerce; never an administrator, and it refuses any account that can do more than shop). For logged-in monitors, a request signed by Relvato signs Relvato’s browser in as that account (a session cookie, nothing stored). To test the real login form, Relvato can ask for that account’s login: the plugin sets a new random password on it and returns the username and that password over the signed connection. Relvato can also have WordPress send that account’s lost-password email (to the Relvato test inbox), to check the reset email goes out. No other account’s password is set or sent.
• While AI assistant abilities are on, an AI assistant working in your WordPress admin (as an administrator) can ask the plugin for the site’s status, its monitors or the fix brief for a run, or start monitors; each request goes to app.relvato.com, and nothing is sent until an assistant asks.
• While connected, your homepage carries <meta name="relvato-site"> with your Relvato site’s ID, so Relvato can confirm the connection from outside. It isn’t a link and shows nothing to visitors.

Relvato real-user speed measurement (app.relvato.com). While real-user Web Vitals is on (off until you turn it on), a small script on your public pages measures how fast each page loads for a sample of visitors and sends the timings, the page type, whether the device is a phone or a computer, and (for slow pages) the slow element and resource to app.relvato.com/api/vitals. It sets no cookies and doesn’t identify visitors. The script is part of the plugin (assets/vitals-beacon.js); nothing is loaded from Relvato.

Relvato test inbox (verify.relvato.com). During a contact-form test (while form tests are on) or an email monitor, the test message goes to a Relvato address for your site instead of to your team, so Relvato can confirm it arrived.

WordPress.org (api.wordpress.org, downloads.wordpress.org). File integrity compares your WordPress core and plugin files with WordPress.org’s published checksums. Rolling a plugin back or reinstalling it downloads that version from WordPress.org. See the WordPress.org privacy policy.