Configuration
Plugin Settings (WordPress Admin)
Navigate to StorePilot → Settings.
| Setting | Description | Default |
|---|---|---|
| Platform URL | Full URL to the NestJS API server (no trailing slash). Example: https://api.store-pilot.net | (required) |
| API Key | Site-specific API key generated in the Platform dashboard | (required) |
| Enable Error Tracking | Track JavaScript and PHP errors | on |
| Enable Session Recordings | Record user sessions with rrweb | off |
| Enable Pageview Tracking | Track pageviews and time-on-page | on |
| Enable Lead Capture | Capture WooCommerce checkout form data | off |
| Recording Sample Rate | Percentage of sessions to record (1–100) | 100 |
Platform Settings (NestJS Server)
Settings stored in the .env file at apps/backend/.env.
Required Variables
# Database
DATABASE_URL="mysql://user:password@localhost:3306/wp_error_logger"
# Authentication
JWT_SECRET="your-secret-key-256bit"
JWT_REFRESH_SECRET="your-refresh-secret-256bit"
# Platform admin account (first run)
INITIAL_ADMIN_EMAIL="admin@yourdomain.com"
INITIAL_ADMIN_PASSWORD="strong-password"
Redis (required for multi-instance deployments)
REDIS_HOST=127.0.0.1
REDIS_PORT=6379
REDIS_PASSWORD= # leave blank if no password
Email Notifications (optional)
SMTP_HOST=smtp.mailgun.org
SMTP_PORT=587
SMTP_USER=postmaster@mg.yourdomain.com
SMTP_PASS=your-smtp-password
SMTP_FROM="StorePilot <noreply@yourdomain.com>"
# SMTP_SECURE=true # implicit TLS; derived from the port when unset (465 → yes, 587 → STARTTLS)
All three of SMTP_HOST, SMTP_USER and SMTP_PASS are required — with any of them missing, mail is off. The other notification channels (Slack, Telegram, n8n) continue working, and Settings → Notifications → Send test reports the email channel as unconfigured rather than failing.
One thing does not degrade gracefully: organization invitations go through the same transport. Without SMTP the invitation row is created and no email is sent, so the invited person is never told. Send them the invite link yourself, or configure SMTP before inviting anyone.
SMTP_FROM defaults to SMTP_USER. Many providers reject a From address outside the authenticated mailbox — change the display name, not the address.
Storage: Recordings (optional)
By default, session recording segments are stored in the local filesystem. To use S3-compatible object storage:
S3_ENDPOINT=https://s3.eu-central-1.amazonaws.com
S3_REGION=eu-central-1
S3_BUCKET=wp-error-logger-recordings
S3_ACCESS_KEY=AKIA...
S3_SECRET_KEY=wJalrX...
Notification Channels
Configure per-site in Dashboard → Sites → [Site] → Settings.
Slack
- Create an Incoming Webhook in your Slack workspace
- Paste the webhook URL in the Slack Webhook field
Telegram
- Create a Telegram Bot via @BotFather
- Get the chat ID via
https://api.telegram.org/bot<token>/getUpdates - Enter both in the Platform settings
Email
- Configure
SMTP_*variables in.env - Enable Email Notifications in the site settings
- Enter the Notification Email address
Webhooks (n8n)
Set n8n_webhook (for errors) and n8n_leads_webhook (for leads) in the site settings. The Platform will POST a JSON payload to these URLs on each new event.
Recording Sample Rate
To avoid storing every session, you can sample a percentage of users:
Recording Sample Rate: 25
This means 1 in 4 sessions will be recorded. The decision is made client-side using Math.random() and stored in localStorage so the same user is consistently recorded or not during one session.
Security Hardening
- Rotate the API key regularly: Dashboard → Sites → Settings → Regenerate Key
- Use HTTPS for both the Platform URL and your WordPress site
- Set a strong
JWT_SECRET(minimum 256 bits of entropy) - Restrict the NestJS API port to only allow traffic from your WordPress server and your own IP in the firewall