Managing Sites
Each WordPress site you monitor is represented as a Site in the Platform. You can manage multiple sites from one dashboard account.
Adding a Site
- Click Sites → Add Site in the top navigation
- Enter the site Name (display label) and Domain (e.g.
mystore.com) - Click Create
The Platform generates a unique API key for this site immediately.
Site Settings
Navigate to Sites → [Site] → Settings to configure:
General
| Setting | Description |
|---|---|
| Site Name | Display name shown in the dashboard |
| Domain | The WordPress site domain |
API Key
The site's API key is shown here. Click Regenerate Key to rotate it.
Regenerating the key invalidates the previous one immediately. Update the key in StorePilot → Settings on your WordPress site before your next page load.
Notifications
| Setting | Description |
|---|---|
| Slack Webhook URL | Slack Incoming Webhook URL |
| Telegram Bot Token | Telegram bot API token |
| Telegram Chat ID | Group or channel chat ID |
| Email Notify | Enable email notifications |
| Notification Email | Email address to send alerts to |
| n8n Error Webhook | Webhook URL for error events |
| n8n Leads Webhook | Webhook URL for lead events |
Privacy
Settings → Privacy is the authoritative copy of these switches. The WordPress plugin no longer carries its own privacy tab: it used to, and a setting stored there could override the dashboard, so a shop that switched recording off in the plugin could not switch it back on from here.
| Setting | What it does |
|---|---|
| Stop collecting | Stops everything this site sends: page views, errors, recordings, leads and orders. Nothing already collected is deleted |
| Session recording | Master switch for replay on this site. Off means the recorder is never even downloaded |
| Require consent | Nothing at all is collected until the visitor's consent is signalled |
| Record console | Include browser console output in replays. Off by default — console lines often contain application data |
| Record canvas | Include canvas content in replays, as up to 2 image frames per second while a canvas is being redrawn. Off by default — a canvas is pixels, and no masking rule can reach into pixels, so a signature pad or a product personaliser records exactly as drawn. Pages without a canvas cost nothing |
| Report console.error | File what your scripts pass to console.error() as an error, with a stack trace. Off by default, and separate from the switch above: this one writes into Issues under the type console, catching failures a script caught itself and never let reach the browser as a crash |
| Excluded URLs | One pattern per line. Matching pages are skipped |
| Exclusion mode | Whether an excluded URL skips session replay only, or everything |
| Lead retention | Days to keep leads for this site, if you want them kept for less time than the platform default |
| Internal traffic | Your own team's email addresses, email domains and office IP ranges |
Stop collecting is the switch for the moment you need collection to end now — a legal
request, a load test, a flood of traffic you would rather not pay for. It is not the same as
removing the plugin or rotating the key: nothing about your install changes, so turning it back
on resumes collection within a minute and needs no re-configuration.
What it does not do is delete anything. Your dashboards, exports and retention windows are exactly as they were, and the platform records when the switch was pressed, so a screen that looks empty afterwards says so in those words rather than sending you to check a working plugin. Visitors' browsers stop sending within a minute of the change; a page that was already cached may try for a few minutes longer, and the platform refuses those quietly.
Internal traffic is how a shop says this is us. Anyone it names is not a customer, and the
two halves of that are treated differently on purpose:
- Visits are not collected at all. A request from a listed office range, from a WordPress user who can manage the shop's orders, or from a browser that opened the Exclude this browser link on the settings page writes no pageview, no session, no recording and no unit of your plan's quota.
- Orders and checkouts are kept, and marked. A test order is money that moved through your shop, so deleting it would change your own history. It stays in the database and simply drops out of revenue, conversion, average order value and the three lists — each of which prints how many rows it withheld, with one press to show them.
Email addresses and domains are matched when an order or a checkout is written, which is the only
moment anyone's address is known. Addresses already stored can be re-marked by support with
orders:mark-internal.
Require consent is the setting that turns StorePilot into an opt-in tool. With it on, a visitor
who has not agreed produces no pageview, no error, no recording and no lead — and this is enforced
on the server, not only in the browser, so a form your site forwards from PHP is covered too.
Two behaviours are not settings, deliberately, and cannot be switched off:
- Global Privacy Control is always honoured, on every site. A browser sending
Sec-GPC: 1is treated as having opted out, whatever else is configured — under the CPRA that signal is a binding opt-out, not a preference. - IP addresses are always truncated before they are stored — the last octet of an IPv4 address, the last 80 bits of an IPv6 one. Country is resolved before truncation, so your geography breakdown is unaffected.
Do Not Track is not a signal here. DNT: 1 does not suppress collection. The specification
was discontinued in 2019, no privacy law names it, and in practice it was switched on in browsers
whose owners did not know — while Global Privacy Control, which is recognised in law, stays
unconditional. Dropping the advisory signal is what lets the binding one stop being argued with.
See GDPR and the Privacy Policy for what is retained and for how long.
Recording storage
There is nothing to configure. Session replay data is stored by the platform, not on your own server and not in a bucket you provide — earlier versions did it the other way round, and the per-site S3 settings that went with that are gone.
Deleting a Site
- Go to Sites → [Site] → Settings
- Scroll to the bottom
- Click Delete Site
Deleting a site permanently removes all errors, recordings, leads, pageviews, and visitor data associated with it. This cannot be undone.