Title: Relvato — Continuous Monitoring
Author: relvato
Published: October 15, 2026
Last modified: October 15, 2026
---
Search plugins
# Relvato — Continuous Monitoring
By [relvato](https://profiles.wordpress.org/relvato/)
[Download](https://downloads.wordpress.org/plugin/relvato.1.77.2.zip)
* [Details](https://wordpress.org/plugins/relvato/#description)
* [Reviews](https://wordpress.org/plugins/relvato/#reviews)
* [Installation](https://wordpress.org/plugins/relvato/#installation)
* [Development](https://wordpress.org/plugins/relvato/#developers)
[Support](https://wordpress.org/support/plugin/relvato/)
## Description
[Relvato](https://www.relvato.com) is a website monitoring platform. It runs monitors
against your site in a real browser: checkout, logins, sign-ups, contact forms,
page speed, search visibility and security. This plugin connects your WordPress
site to your Relvato account, so the monitors run again the moment something changes,
and can see what a monitor running from outside can’t.
What the plugin adds:
* **Runs after every change (Pro and up).** A plugin, theme, WordPress or WooCommerce
update tells Relvato to re-run the monitors that change can affect, so a broken
checkout is caught minutes after the update, not days later. On the free plan
you start the runs yourself, from WordPress or the Relvato app, or run them weekly.
* **Monitors that need to be inside.** Logged-in checkout and account pages through
a dedicated test customer, test orders that never touch your stock, stay out
of your analytics and ad platforms (and move themselves to the Trash), form tests
that don’t email your team, WooCommerce health, backups, Site Health, PHP errors
and failed emails.
* **Security from the inside.** File integrity against WordPress.org checksums,
signs of a hack in themes, uploads and options, new administrators, leftover
backup files, and hardening you can switch on and off.
* **Fixes you apply.** When a run proposes a fix (rolling back a plugin update,
turning search indexing back on, clearing a cache…), it appears under “Relvato
suggests” in WordPress Relvato, and an administrator applies it there with one
click. Relvato then re-runs its monitors to verify it, and every fix can be undone.
Relvato never applies a fix or changes a plugin on its own.
* **AI assistants.** On WordPress 6.9+, Relvato’s abilities (site status, monitors,
the brief for fixing a failure) are available to AI assistants through the WordPress
Abilities API, for administrators only.
The plugin needs a Relvato account; there is a free plan ([plans](https://www.relvato.com/pricing)).
Nothing is sent to Relvato until you connect the plugin. Every request between your
site and Relvato is signed with your site’s own secret.
Five features are off until you turn them on in **Relvato Settings**: the activity
log (sign-ins, key changes, PHP errors and failed emails), the test login, form
tests, real-user Web Vitals and the outside-services map. When you set up monitoring
in the plugin, its last step lists the ones your chosen monitors need, with what
each does: test login and form tests are ticked, the activity log and real-user
Web Vitals are not, and only the ticked ones go on with the monitors. A monitor
that needs one that’s off tells you which, in Relvato, instead of running.
### External services
This plugin connects your site to Relvato, a website monitoring service run by Relvato(
[terms](https://www.relvato.com/terms), [privacy policy](https://www.relvato.com/privacy)).
Nothing below happens until you connect the site, by clicking “Connect with Relvato”
or pasting your connect token.
**Relvato (app.relvato.com).** Used to run your monitors and show their results.
* When you click **Connect with Relvato**, your browser goes to app.relvato.com
with your site’s address, the way back to your WordPress admin, a one-time check
value, the active theme and the well-known plugins it runs, by name (for example
WooCommerce, Yoast SEO, Wordfence, WP Rocket, Elementor), so you can sign in
and confirm the site. When you come back, the plugin sends a one-time code, the
matching secret and your site’s address to app.relvato.com to receive your connect
token.
* When something changes on the site, the plugin sends a signed event about the
change: plugin, theme, WordPress and WooCommerce updates, activations and theme
switches; new administrators and role changes; and, while quarantine mode is
on after a hack, new scheduled tasks and uploaded executable files. Each event
names the WordPress user who made the change.
* While the **activity log** is on (off until you turn it on): administrator and
editor logins (with the login name, role and the first part of the IP address)
and counts of failed logins (never the usernames tried); changes to key settings(
site address, registration, search visibility); edits made in the theme and plugin
file editors; application passwords created or deleted; deleted administrators;
and new PHP fatal errors and failed emails (the recipient’s domain only). With
it on, the plugin also keeps when each administrator last signed in (on the site)
and includes that time in the security review of accounts below, so Relvato can
point out administrators nobody uses; switching the activity log off deletes
those times.
* While the **outside-services map** is on (off until you turn it on): for each
server-side request a plugin or theme makes to another server, the plugin’s or
theme’s folder name and the host name it called (never the full address, what
was sent or what came back), with the day it was first and last seen. Kept in
your site’s options and read by Relvato’s Exposure scan; switching it off deletes
it.
* Every six hours the plugin sends its version, which well-known plugins are active,
by name (for example Yoast SEO, Wordfence, WP Rocket, WooCommerce, a form or
caching plugin), the active theme, the search visibility setting, whether its
REST routes can be reached (and if not, which plugin blocks them) and which of
the features above are on.
* When you open the Relvato pages in WordPress, the plugin fetches your monitors’
status and Relvato’s suggestions, and sends the actions you start there (such
as running a monitor).
* When an administrator applies a suggestion there, the plugin first asks app.relvato.
com to start a plugin update or deactivation (so Relvato can verify it), then
reports what was applied: which suggestion, whether it worked (and WordPress’s
error if not), the hardening settings now on, and the WordPress user who applied
it. A quarantine’s auto-update pause, a released update hold and an undo are
reported the same way.
* Relvato’s monitors call the plugin’s own REST routes, signed with your site’s
secret, to read results such as WooCommerce health, file checksums and installed
plugin versions. None of them can change plugins, themes, settings or code; the
only things they create or change are Relvato’s own test data (the test customer
below, test orders, form-test entries and test emails). The security review of
accounts reads the administrator and other privileged accounts (login name, display
name, roles, when the account was created, the domain of its email address and
the names of its application passwords), and the ways in that skip the login
form: WooCommerce REST API keys (their description, owner, access and the last
characters WooCommerce shows) and OAuth clients. Administrator passwords and
API keys are never sent.
* While **Test login** is on (off until you turn it on), the plugin keeps one dedicated
test customer account (it creates it as a customer, or a subscriber without WooCommerce;
never an administrator, and it refuses any account that can do more than shop).
For logged-in monitors, a request signed by Relvato signs Relvato’s browser in
as that account (a session cookie, nothing stored). To test the real login form,
Relvato can ask for that account’s login: the plugin sets a new random password
on it and returns the username and that password over the signed connection.
Relvato can also have WordPress send that account’s lost-password email (to the
Relvato test inbox), to check the reset email goes out. No other account’s password
is set or sent.
* While **AI assistant abilities** are on, an AI assistant working in your WordPress
admin (as an administrator) can ask the plugin for the site’s status, its monitors
or the fix brief for a run, or start monitors; each request goes to app.relvato.
com, and nothing is sent until an assistant asks.
* While connected, your homepage carries `` with your
Relvato site’s ID, so Relvato can confirm the connection from outside. It isn’t
a link and shows nothing to visitors.
**Relvato real-user speed measurement (app.relvato.com).** While real-user Web Vitals
is on (off until you turn it on), a small script on your public pages measures how
fast each page loads for a sample of visitors and sends the timings, the page type,
whether the device is a phone or a computer, and (for slow pages) the slow element
and resource to app.relvato.com/api/vitals. It sets no cookies and doesn’t identify
visitors. The script is part of the plugin (assets/vitals-beacon.js); nothing is
loaded from Relvato.
**Relvato test inbox (verify.relvato.com).** During a contact-form test (while form
tests are on) or an email monitor, the test message goes to a Relvato address for
your site instead of to your team, so Relvato can confirm it arrived.
**WordPress.org (api.wordpress.org, downloads.wordpress.org).** File integrity compares
your WordPress core and plugin files with WordPress.org’s published checksums. Rolling
a plugin back or reinstalling it downloads that version from WordPress.org. See
the [WordPress.org privacy policy](https://wordpress.org/about/privacy/).
## Screenshots
[⌊Once connected, Relvato can monitor your critical site flows, SEO / AEO readiness,
site security, performance, domain, legal pages or accessibility.⌉⌊Once connected,
Relvato can monitor your critical site flows, SEO / AEO readiness, site security,
performance, domain, legal pages or accessibility.⌉[
Once connected, Relvato can monitor your critical site flows, SEO / AEO readiness,
site security, performance, domain, legal pages or accessibility.
[⌊Choose when your monitors run: on a schedule, and again automatically after WordPress,
theme or plugin updates.⌉⌊Choose when your monitors run: on a schedule, and again
automatically after WordPress, theme or plugin updates.⌉[
Choose when your monitors run: on a schedule, and again automatically after WordPress,
theme or plugin updates.
[⌊The Relvato dashboard in WordPress: every monitoring group at a glance — what
passes, and what needs a look.⌉⌊The Relvato dashboard in WordPress: every monitoring
group at a glance — what passes, and what needs a look.⌉[
The Relvato dashboard in WordPress: every monitoring group at a glance — what passes,
and what needs a look.
[⌊Relvato suggests safe, reversible fixes. You apply each one in WordPress with
one click, switch it back off any time, and Relvato re-runs its monitors to confirm.⌉⌊
Relvato suggests safe, reversible fixes. You apply each one in WordPress with one
click, switch it back off any time, and Relvato re-runs its monitors to confirm.⌉[
Relvato suggests safe, reversible fixes. You apply each one in WordPress with one
click, switch it back off any time, and Relvato re-runs its monitors to confirm.
[⌊Performance in WordPress: lab Core Web Vitals against Google's "good" limits on
one radar, with the biggest wins to fix first.⌉⌊Performance in WordPress: lab Core
Web Vitals against Google's "good" limits on one radar, with the biggest wins to
fix first.⌉[
Performance in WordPress: lab Core Web Vitals against Google’s “good” limits on
one radar, with the biggest wins to fix first.
[⌊Legal compliance: Relvato checks for a privacy policy, terms and an accessibility
statement, and flags cookie consent and tracking problems — with a suggested fix
for each.⌉⌊Legal compliance: Relvato checks for a privacy policy, terms and an accessibility
statement, and flags cookie consent and tracking problems — with a suggested fix
for each.⌉[
Legal compliance: Relvato checks for a privacy policy, terms and an accessibility
statement, and flags cookie consent and tracking problems — with a suggested fix
for each.
[⌊Every run in WordPress: what ran, what it found, and when — with the full details
one click away in Relvato.⌉⌊Every run in WordPress: what ran, what it found, and
when — with the full details one click away in Relvato.⌉[
Every run in WordPress: what ran, what it found, and when — with the full details
one click away in Relvato.
[⌊The Relvato app: each site at a glance — monitors passing, what's ready to run,
results over time and every run, for all your sites in one place.⌉⌊The Relvato app:
each site at a glance — monitors passing, what's ready to run, results over time
and every run, for all your sites in one place.⌉[
The Relvato app: each site at a glance — monitors passing, what’s ready to run,
results over time and every run, for all your sites in one place.
## Installation
1. Install and activate the plugin.
2. In WordPress, open **Relvato Settings** and click **Connect with Relvato**. Sign
up or sign in (free, no card), confirm the site, and you come straight back to
WordPress, connected.
3. Or, if you already have a connect token from the Relvato app (the site’s Settings
Connection), paste it on the same page and save.
## FAQ
### Is Relvato free? What does the free plan include?
Yes, and it stays free: one site, 100 runs a month and every monitor except custom
monitors and AI-feature monitors, with no card. On the free plan you start the runs,
from WordPress or the Relvato app, or schedule them weekly. Paid plans re-run the
monitors by themselves after every update, add daily and faster schedules and alerts,
and cover more sites. See https://www.relvato.com/pricing.
### Does Relvato need my password or my customers’ passwords?
Never yours or your customers’. For logged-in monitors the plugin signs Relvato’s
browser in as a dedicated test customer it creates (never an administrator), using
a short-lived signed token. To test the real login form, Relvato asks the plugin
for that test customer’s login: the plugin sets a new random password on that one
account each time and returns it with the username, over the signed connection.
This only happens while **Test login** is on in the plugin’s settings.
### Will monitors change my stock or create real orders?
A checkout monitor set to “Full order” places a real test order — that’s how it
proves your checkout works. The plugin marks it (order meta `_relvato_test`), doesn’t
reduce stock for it, doesn’t email you about it, and moves it to the Trash a few
minutes later. Monitors that stop before “Place order” create no order at all. Turning
off “Protect stock & auto-remove” in the plugin’s settings keeps test orders (and
their stock change) instead of removing them. So that stores taking only cards can
be tested too, the plugin creates a 100% discount coupon that works only inside
Relvato’s signed test requests, never for a shopper; it is deleted when you deactivate
the plugin.
### Will test orders show up in Google Analytics, Google Ads or Meta?
No. The plugin switches off the purchase event for test orders in Pixel Manager
for WooCommerce (browser, conversion recovery and server-side), Google for WooCommerce,
Google Analytics for WooCommerce, Site Kit, GTM4WP, Facebook for WooCommerce (pixel
and Conversions API), PixelYourSite, Pinterest for WooCommerce and TikTok. Relvato’s
test browser also refuses analytics consent and blocks the ad and analytics collection
addresses while it places the order. On WooCommerce 10.7 and later, test orders
are also kept out of WooCommerce Analytics. For your own reports and conversion
uploads, skip orders for which `relvato_is_test_order( $order )` returns true.
### Can Relvato change my site?
Not on its own. Relvato suggests changes; an administrator applies each one in WordPress
Relvato, where the plugin makes it from a fixed list of reversible actions built
into the plugin: for example rolling a plugin back to the version before an update,
updating or switching off a vulnerable plugin, or turning search indexing back on.
Each needs the matching WordPress permission (for example “update plugins”). No
request from Relvato’s service can install, update, activate or remove a plugin
or theme, or change your settings or code. What it can ask for is limited to Relvato’s
own test data: while Test login is on, the dedicated test customer (the plugin creates
that one account, never an administrator, signs Relvato’s browser in as it, sets
its password and sends its lost-password email to the Relvato inbox); the test orders,
form entries and test emails its monitors make, and removing them. The plugin never
runs code it receives, and every applied fix can be undone there.
### Does the plugin change WordPress updates?
Only when you ask it to. After you roll a plugin back, Relvato holds the version
you left, so WordPress doesn’t put it straight back: automatic updates skip it and
installing it is refused until you release the hold (“Release the hold” on that
plugin’s row on the Plugins screen). While quarantine mode is on after a hack, an
administrator can tick “Pause plugin and theme auto-updates” in WordPress Relvato.
Nothing else about WordPress’s updates is changed.
### Does the plugin change how my forms handle spam?
Only for Relvato’s own test submissions, and only while **Form tests** is on: for
a submission carrying Relvato’s marker in a request signed with your site’s secret,
the form plugin’s CAPTCHA check and Akismet are skipped through the form plugin’s
own filters, its notification goes to your site’s Relvato inbox instead of your
team, and the test entry is deleted afterwards. Every other submission is handled
exactly as before.
### What does security hardening change?
Nothing until you switch an item on in Relvato, and each can be switched off again:
XML-RPC off (not while Jetpack is active), the public user list and username lookups
by number hidden, the WordPress version tag and the X-Powered-By header removed,
the theme and plugin file editor turned off (the same as DISALLOW_FILE_EDIT; a value
already set in wp-config.php wins), a few safe security headers added where the
site sends none, and an empty index.php added to the uploads folders.
### Does the plugin keep backups?
Only of plugins that aren’t from WordPress.org, and only once the site is connected.
When one of those updates, the plugin first zips the version being replaced into
wp-content/relvato-backups (closed to web visitors), so Relvato can roll the update
back if it breaks the site; WordPress.org plugins are rolled back from WordPress.
org instead. It keeps the two newest backups per plugin, for up to 60 days.
### What happens when I remove the plugin?
Deactivating stops all communication with Relvato. Deleting the plugin also removes
its settings, the test customer and Relvato’s plugin backups.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Relvato — Continuous Monitoring” is open source software. The following people
have contributed to this plugin.
Contributors
* [ relvato ](https://profiles.wordpress.org/relvato/)
[Translate “Relvato — Continuous Monitoring” into your language.](https://translate.wordpress.org/projects/wp-plugins/relvato)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/relvato/), check out
the [SVN repository](https://plugins.svn.wordpress.org/relvato/), or subscribe to
the [development log](https://plugins.trac.wordpress.org/log/relvato/) by [RSS](https://plugins.trac.wordpress.org/log/relvato/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.77.2 (2026-10-15)
* Changed: Relvato is now on WordPress.org, and the plugin updates from there like
any other. Sites that installed it from relvato.com move over with this version;
nothing to do.
#### 1.77.1 (2026-10-11)
* Fixed: wp-config.php is checked for malware patterns again (only the pattern’s
name is reported; 1.77.0 skipped it along with its hash).
* Readme: says exactly what Relvato’s requests can create or change — only its
own test data, including how the test customer is signed in.
#### 1.77.0 (2026-10-11)
* Changed: Relvato never applies a fix or changes a plugin on its own. Fixes, plugin
updates, rollbacks, deactivations and their undo are applied by an administrator
under “Relvato suggests” in WordPress Relvato (each needs the matching WordPress
permission); the plugin then tells Relvato, which re-runs its monitors to verify
the change. The routes Relvato’s service used to apply them are removed.
* Changed: during quarantine mode, pausing plugin and theme auto-updates is a tick
box in WordPress Relvato, set by an administrator.
* Changed: Relvato’s scheduled update window no longer runs on sites with this
version; WordPress’s own automatic updates keep working, and an update that breaks
a monitor is offered as a one-click rollback in WordPress Relvato.
* Security: the plugin no longer reads the values of your WordPress keys and salts,
and wp-config.php is no longer part of the file fingerprint. Every admin page
is escaped as it’s printed. The activity log and quarantine record a file-editor
save only with WordPress’s own check for that save.
#### 1.76.2 (2026-10-09)
* Changed: “Tested up to” is declared only in this readme, no longer in the plugin
file’s header, as WordPress.org now requires.
#### 1.76.1 (2026-10-09)
* Fixed: the Runs list heading (“The latest 5 runs”) now translates correctly in
languages whose singular form also covers numbers like 21.
#### 1.76.0 (2026-10-09)
* Changed: on setup’s last step, the activity log and real-user Web Vitals start
unticked; only the switches you tick go on with your monitors. Test login and
form tests stay ticked.
* Changed: backups of plugins that aren’t from WordPress.org are kept only once
the site is connected.
* Changed: the description and the dashboard group “Legal & accessibility” no longer
say “legal compliance”: Relvato reports what it finds on your legal pages, cookie
banner and accessibility; it doesn’t certify anything.
* New: suggested privacy-policy text for the real-user speed script and the activity
log (Settings Privacy Policy Guide).
* Fixed: with two copies of Relvato in two plugin folders, activating the second
no longer stops with a fatal error.
* Readme: the FAQ and External services now say exactly what Test login sends,
and when plugin backups are made.
#### 1.75.1 (2026-10-09)
* Fixed: a monitor still collecting data (Real-user Web Vitals before enough page
views) no longer counts as “couldn’t run” on the Overview’s “Monitors passing”
row. It’s ready — Ready to run says so — and the row now shows it as “1 collecting
data”, with a note that it’s counted once there’s enough.
#### 1.75.0 (2026-10-08)
* New: the Overview’s “Monitors passing” row now says how many monitors passed
and how many it leaves out — e.g. “26 of 27 passing · 3 couldn’t run”. Monitors
that couldn’t run or haven’t run yet aren’t in the percentage, so a 100% that
covers only part of your monitors now says so. “Ready to run” shows why each
one is left out.
#### 1.74.2 (2026-10-08)
* Changed: the Overview’s “Site health” card is now “Monitors passing” — it was
always the share of your monitors whose latest run passed, not a score for the
whole site. “Health over time” is now “Passing over time”. Nothing about how
it’s counted changed.
#### 1.74.1 (2026-10-08)
* Fixed: switches ticked on setup’s last step — Test login, form tests, the activity
log — weren’t saved (only Real-user Web Vitals was), so Customer login and Logged-
in checkout still reported Test login as off. They’re saved now. If you set up
with 1.74.0, turn Test login on in Relvato Settings.
#### 1.74.0 (2026-10-08)
* New: setup’s “When should they run?” step lists the plugin switches your chosen
monitors need — Test login, Real-user Web Vitals, form tests, the activity log—
with what each does, ticked. They go on with your monitors (untick any first),
so Customer login, Logged-in checkout and real-user Web Vitals run from the start
instead of waiting for you in Settings.
#### Earlier versions
* The full history is at https://www.relvato.com/changelog
## Meta
* Version **1.77.2**
* Last updated **8 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.5 or higher **
* Tested up to **7.1.3**
* PHP version ** 7.4 or higher **
* Tags
* [monitoring](https://wordpress.org/plugins/tags/monitoring/)[performance](https://wordpress.org/plugins/tags/performance/)
[security](https://wordpress.org/plugins/tags/security/)[uptime](https://wordpress.org/plugins/tags/uptime/)
[woocommerce](https://wordpress.org/plugins/tags/woocommerce/)
* [Advanced View](https://wordpress.org/plugins/relvato/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/relvato/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/relvato/reviews/)
## Contributors
* [ relvato ](https://profiles.wordpress.org/relvato/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/relvato/)