Sentrix – Store Health Monitoring for WooCommerce

Descrição

Sentrix is a lightweight diagnostic and early-warning assistant for WooCommerce stores.

It monitors store health across six areas — sales pipeline, configuration changes, file integrity, security hardening, task queue hygiene, and store availability — and surfaces clear, business-language signals inside the WordPress admin panel.

Sentrix does not place test orders, does not simulate customer purchases, and does not act as a synthetic external monitoring service. It works with real WordPress and WooCommerce data and presents safe diagnostic summaries without exposing customer details.

Why Sentrix?

WooCommerce issues are often noticed too late. A payment method silently stops converting. A plugin update breaks the checkout. A file is modified without explanation. A database task queue grows out of control and slows the store. Sentrix helps connect these signals before customers start reporting problems.

Key features:

• SalesGuard – monitors payment success rates and detects failing gateways.
• ChangeMonitor – records plugin, theme, gateway, and checkout changes.
• IntegrityGuard – detects unauthorized file modifications and suspicious PHP files in uploads.
• SecurityGuard – applies WordPress hardening and audits security configuration.
• SchedulerCleaner – monitors and cleans the Action Scheduler task queue.
• StoreAvailability – passively detects PHP fatal errors, HTTP 5xx responses, and inferred outages.

Need help or found a bug?
Contact us at support@ilabs.com.pl

SalesGuard

SalesGuard detects payment health risks by analyzing real WooCommerce order data.

It is designed to answer a simple question:

Are customers able to complete payments through the active payment methods in this store?

SalesGuard compares payment success rates across a current and a comparison period. It identifies:

• active payment gateways with zero successful orders in the analyzed period;
• gateways whose success rate has dropped significantly compared with the previous period;
• gateways with no recent payment activity;
• online gateways with a streak of consecutive failed payment attempts;
• periods with no order activity at all;
• insufficient data situations where a reliable conclusion cannot be drawn.

The result is shown as a clear business status:

• OK – no concerning signals were detected in the analyzed period.
• Information – there is not enough data for a reliable assessment.
• Warning – one or more signals should be reviewed.
• Critical – customers may be trying to pay but payments are not completing.

SalesGuard is read-only. It never creates or modifies orders, payments, or store configuration.

SalesGuard can be run manually from the Sentrix admin screen. It can also be configured to automatically refresh stale results when the module screen is opened.

ChangeMonitor

ChangeMonitor records important WordPress and WooCommerce configuration changes.

It helps answer the question:

What changed in the store before a payment, checkout, or sales issue appeared?

Monitored change types include:

• plugin activation, deactivation, and updates;
• active theme changes;
• payment gateway enable and disable actions;
• payment gateway live/test mode changes;
• payment gateway settings saves;
• WooCommerce checkout settings changes;
• selected WooCommerce general store settings changes.

Each event is stored with a date, time, type, and importance level. The store keeps up to 200 events, with configurable retention of 30, 60, or 90 days. High-importance changes — such as payment gateway modifications and checkout setting changes — are highlighted separately.

ChangeMonitor starts recording from the moment it is enabled. It cannot reconstruct changes that occurred before activation.

ChangeMonitor does not restore previous settings, block changes, or send email alerts. It is a safe change history that supports diagnostics and support.

IntegrityGuard

IntegrityGuard detects unauthorized file changes in your WordPress installation and suspicious PHP files in the uploads directory.

It works in two stages:

1. Baseline — you create a snapshot of your current file tree. Each file is recorded as a SHA-256 checksum.
2. Scan — when you choose, IntegrityGuard compares the current filesystem against the baseline and reports new, modified, and deleted files.

IntegrityGuard also scans the uploads directory for PHP files with known executable extensions. PHP files in the uploads directory may indicate a backdoor injection.

Monitored areas are individually configurable:

• WordPress core files (excluding wp-content);
• wp-content/plugins;
• wp-content/themes;
• wp-content/uploads (PHP file detection only).

All operations — creating the baseline, running a scan, and resetting — are triggered manually by an administrator. There are no automatic or scheduled scans.

Only relative file paths and SHA-256 checksums are stored. No file contents are read or retained. No absolute server paths are recorded.

SecurityGuard

SecurityGuard provides two distinct layers of WooCommerce store protection.

Hardening layer — lightweight filters applied on every WordPress request. Each feature is independently enabled or disabled from the settings screen.

The available hardening features are:

• Hide WordPress version — removes the WordPress version from page headers, RSS feeds, Atom feeds, and XML exports, preventing automated scanners from fingerprinting the installation.
• Hide asset versions — strips the ?ver= parameter from enqueued script and stylesheet URLs, preventing version-based fingerprinting of themes and plugins.
• Unify login errors — replaces specific login error messages with a generic response, preventing username enumeration via the login form.
• Block REST users endpoint — blocks unauthenticated and authenticated access to /wp/v2/users, preventing automated username enumeration via the WP REST API.
• Disable comments — closes comments and pingbacks on all non-product post types, preserving WooCommerce product reviews.
• Block weak passwords — prevents account registration and profile updates when the chosen password is shorter than eight characters or contains no number or symbol.

Audit layer — a read-only check that verifies each hardening feature is active and effective. The audit runs on demand from the SecurityGuard module screen and covers seven checks:

• WordPress version hidden;
• Asset version stripped;
• Login error unified;
• REST users endpoint blocked;
• Comments disabled (reports as informational when the feature is off by design);
• Weak password block active;
• Debug log publicly accessible (passive environmental check — checks file existence only).

The audit performs no network requests and does not modify any store data.

SchedulerCleaner

SchedulerCleaner monitors the Action Scheduler task queue and provides a manual cleanup operation for completed and canceled records.

It shows the current count of tasks by status: pending, complete, failed, and canceled.

A manual cleanup removes old complete and canceled records older than a configured number of days (default: 30). Each cleanup operation is bounded to 500 records per call to protect database performance. For large queues, multiple manual cleanup invocations can be used.

SchedulerCleaner never removes pending or failed tasks. Failed tasks require manual review. There is no automatic or scheduled cleanup in the free version.

StoreAvailability

StoreAvailability passively monitors your store’s availability by recording PHP fatal errors, HTTP 5xx responses, and inferred server outages.

It registers a lightweight PHP shutdown callback on every WordPress request. No external monitoring infrastructure is required, and no test or synthetic traffic is generated.

Detected incident types:

• PHP fatal errors;
• HTTP 5xx server error responses;
• inferred server outages — when the heartbeat gap between successful requests exceeds 120 seconds.

Incidents are stored in a bounded list of up to 50 entries, with a 30-day retention. Incidents are visible on the Sentrix overview dashboard and the StoreAvailability module screen.

The module does not read log file contents. Incident records contain only the error type and a sanitized description. Absolute server paths are excluded. No customer data, order data, or session data is collected.

There is no real-time alerting in the free version. Incidents are visible when an administrator opens the Sentrix admin screens.

Privacy and data safety

Sentrix is designed to avoid storing sensitive customer data.

SalesGuard diagnostic results do not include order IDs, customer names, email addresses, phone numbers, billing or shipping addresses, or payment tokens. Only aggregated gateway statistics are stored.

ChangeMonitor stores what changed and when it changed. For payment gateway changes, only the type of change and changed field names are stored — not secret values or API keys.

IntegrityGuard stores only relative file paths and SHA-256 checksums. No file contents are read or retained. No absolute server paths are recorded.

SecurityGuard audit results contain only check IDs, status codes, and diagnostic messages. The debug log check uses only file existence — it never reads log file contents. Password values evaluated during registration or profile update are never logged or persisted.

SchedulerCleaner stores only integer task counts per status and a scan timestamp. It does not collect Action Scheduler task arguments.

StoreAvailability stores only sanitized error types and truncated descriptions. Absolute file paths are excluded. No customer, session, or order data is collected.

No diagnostic data is transmitted to iLabs or any external service.

What Sentrix does not do

Sentrix is a diagnostic and hardening tool. It is not an external monitoring system or a store configuration manager.

It does not:

• place test orders or simulate customer purchases;
• log in as a customer;
• verify payment gateway API keys or credentials directly;
• guarantee that a payment method works at the exact current moment;
• automatically fix store configuration;
• restore previous settings;
• block administrators from making changes;
• perform automatic or scheduled file integrity scans;
• perform automatic or scheduled Action Scheduler cleanup;
• send automatic email alerts;
• transmit store data to external services.

The plugin provides early-warning signals and hardening based on available WordPress and WooCommerce data.

External Services

When an administrator opens the Sentrix Support page, the plugin embeds an iframe that loads a contact form hosted at ilabs.dev. This service is operated by Inspire Labs (iLabs), the developer of Sentrix.

When a user submits the contact form, the submitted data (name, email address, and message) is sent to ilabs.dev. This connection is only established when an administrator visits the Support page. No data from the WordPress site or WooCommerce store is transmitted automatically.

• Service URL: https://ilabs.dev
• Privacy Policy: https://ilabs.dev/polityka-prywatnosci/ (Polish)

Third-Party Libraries

This plugin bundles Chart.js 4.5.1 (MIT License) by Chart.js Contributors.
Source and license: https://github.com/chartjs/Chart.js

Source Code

The minified file resources/dist/js/admin.min.js is compiled from the unminified source at resources/assets/admin/js/admin.js, which is included in this package. The SCSS source files for compiled stylesheets are included at resources/assets/admin/scss/.

Assets are compiled using webpack. The build configuration is included in this package at webpack.config.js and package.json.