Hybrid architecture & security spec

How PathHog tests real checkouts with zero side effects

A cloud Playwright browser fleet plus a lightweight, auditable WooCommerce connector plugin. Here's the exact flow from trigger to verified cleanup.

The connector plugin

Download the WooCommerce connector

A single, auditable PHP file — HPOS + Checkout Blocks native, no external SDKs. v1.5.0 with the in-dashboard license activation UI.

  1. 1

    Download & install the plugin

    One auditable file. Upload it in WordPress → Plugins, or drop it in wp-content/plugins and activate.

  2. 2

    Paste your license key

    Open the PathHog menu in wp-admin and activate. The plugin verifies your plan and stores a signing secret.

  3. 3

    PathHog runs & verifies

    We run the full checkout on schedule and after every update, then atomically erase the test order.

The full path we verify, every run

Product
loads in stock
Add to cart
201 created
Shipping · tax
totals match
Checkout
form hydrates
Payment
mock gateway
Receipt
order verified
Cleanup
order erased
Critical path verified · 0 real orders
LAYER 01 · CLOUD ORCHESTRATOR

Scheduler, update receiver & isolated Playwright fleet

Runs on a 15/30/60-minute schedule, on manual trigger, or within seconds of a signed upgrader_process_complete webhook from your store. Spins up an isolated Chromium container with HMAC session headers.

  • • Captures pageerror & console.error
  • • Records failed 4xx/5xx network calls
  • • Captures a screenshot at every step
LAYER 02 · STORE CONNECTOR (PHP)

Invisible mock payment gateway, gated by signature

Installed on your WooCommerce site. Validates the HMAC-SHA256 X-PathHog-Signature + timestamp nonce. Only when valid does it expose the pathhog_mock method to Blocks and Classic checkout.

  • • 100% invisible to regular shoppers
  • • Never calls Stripe, PayPal, or Authorize.Net
  • • HPOS & Checkout Blocks native
LAYER 03 · ATOMIC VERIFICATION

Post-order atomic cleanup & signed attestation

Customer & admin emails are suppressed for test orders. Once the runner confirms the /checkout/order-received/ DOM, it calls the cleanup endpoint to delete the order and restore stock before marking the run passed.

  • • Purges HPOS order + metadata
  • • Verifies product stock count unchanged
  • • Returns SHA-256 cleanup attestation

Ready to prove your checkout works?