Configuration
Plugin Settings (WordPress Admin)
Navigate to StorePilot → Settings.
| Setting | Description | Default |
|---|---|---|
| API Key | The site's secret key, shown in the dashboard under Settings → Installation | (required) |
| Allowed JavaScript Files | URL patterns, one per line, of the scripts whose errors you want reported. Empty reports errors from every script | (empty) |
| Monitored Plugins | Plugins whose PHP warnings, deprecations and notices are collected. Fatal errors and uncaught exceptions are reported from every plugin whether or not it is ticked | (none) |
The platform address ships with the plugin (the STOREPILOT_PLATFORM_URL constant), so there is
no field for it. What is collected — session replay, consent, exclusions, pausing collection — is
set per site in the dashboard, under Settings → Privacy, and applies to every install method.
Platform Settings (NestJS Server)
Settings stored in the .env file at apps/backend/.env.
Required Variables
# Database
DATABASE_URL="mysql://user:password@localhost:3306/wp_error_logger"
# Authentication
JWT_SECRET="your-secret-key-256bit"
JWT_REFRESH_SECRET="your-refresh-secret-256bit"
# Platform admin account (first run)
INITIAL_ADMIN_EMAIL="admin@yourdomain.com"
INITIAL_ADMIN_PASSWORD="strong-password"
Redis (required for multi-instance deployments)
REDIS_HOST=127.0.0.1
REDIS_PORT=6379
REDIS_PASSWORD= # leave blank if no password
Email Notifications (optional)
SMTP_HOST=smtp.mailgun.org
SMTP_PORT=587
SMTP_USER=postmaster@mg.yourdomain.com
SMTP_PASS=your-smtp-password
SMTP_FROM="StorePilot <noreply@yourdomain.com>"
# SMTP_SECURE=true # implicit TLS; derived from the port when unset (465 → yes, 587 → STARTTLS)
All three of SMTP_HOST, SMTP_USER and SMTP_PASS are required — with any of them missing, mail is off. The other notification channels (Slack, Telegram, n8n) continue working, and Settings → Notifications → Send test reports the email channel as unconfigured rather than failing.
One thing does not degrade gracefully: organization invitations go through the same transport. Without SMTP the invitation row is created and no email is sent, so the invited person is never told. Send them the invite link yourself, or configure SMTP before inviting anyone.
SMTP_FROM defaults to SMTP_USER. Many providers reject a From address outside the authenticated mailbox — change the display name, not the address.
Storage: Recordings (optional)
By default, session recording segments are stored in the local filesystem. To use S3-compatible object storage:
S3_ENDPOINT=https://s3.eu-central-1.amazonaws.com
S3_REGION=eu-central-1
S3_BUCKET=wp-error-logger-recordings
S3_ACCESS_KEY=AKIA...
S3_SECRET_KEY=wJalrX...
Notification destinations
Where alerts go is set per site in Settings → Notifications, as a list of
destinations — an email address, a Slack channel, a Telegram chat
or a webhook — each receiving the events you tick. Email needs the SMTP_* variables in .env;
the other three need nothing on the server.
Security Hardening
- Rotate the API key if it may have leaked — the site owner can do it through the API; see Rotating the API key
- Use HTTPS for both the Platform URL and your WordPress site
- Set a strong
JWT_SECRET(minimum 256 bits of entropy) - Restrict the NestJS API port to only allow traffic from your WordPress server and your own IP in the firewall