Changelog
All releases and functional changes to the XICTRAQ platform. We announce breaking changes at least 30 days ahead via email.
# October 2026 — Order import from Shopware 6
E-commerce and shop data
- Order import from Shopware 6 — Through the Admin API with eight read-only permissions, XICTRAQ fetches the entire order history and then new and changed orders every ten minutes, including those created in the shop admin. Purchases captured by the tracker are not counted twice. Imported orders count in revenue, orders, products, finances and reports, not in conversion rate, funnel and ROAS. Business and above. Guide
- Shop data in tracker purchases — Line items of matched orders come from the shop, with exact quantity, article number and variant and without discount lines. If a tracker purchase lacks the payment or shipping method, the value from the shop applies. Customers from tracker and import with the same customer number appear as one customer.
- Nine new cards with the shop data — In the card picker under Analytics · E-commerce › Shop orders (import): orders by origin, tracker coverage, cancellations, order and delivery status, open payments, refunds (shop), revenue by sales channel, order import and repeat customers. Through the API at /websites/:id/shop/summary and /websites/:id/shop/orders.
- Order history by origin and shop state — Filters for tracker, import and shop admin and for the state of order, payment and delivery in Shopware, with counters across the whole period.
- Websites with order import only — If a website has no page view yet but imported orders, analytics opens the e-commerce area.
Tracker
- Tracker on your own domain — The nginx block in the app and the docs now hides the HSTS policy of api.xictraq.com, overwrites X-Forwarded-For with the address your server sees, accepts recordings up to 20 MB and gives up after seconds instead of a minute during a disruption. View block
Websites and analytics
- Website list by groups — Groups are open, and the list remembers the ones you collapse; “Expand all” and “Collapse all” switch all at once. The group header shows status, uptime of the last 30 days, security grade and the next SSL expiry as labelled columns and links to the group overview in analytics.
- Internet providers with brand domain — Provider network names in reverse DNS, often legacy brands such as arcor-ip.net or d1-online.com, appear as the brand domain; business connections with their own name stay unchanged. Eight networks now carry the name of the brand their connections run under, and iCloud Private Relay counts as a relay instead of a data centre.
Alerts
- JavaScript error alerts — One alert per error message with the error text in the title, the file name without timestamp and build ID, so the same error stays one alert across new builds. Category “Performance and JS errors”.
- Capture rate and import alerts — If the share of online orders captured by the tracker drops over three days below 80 % of its own 28-day value, XICTRAQ reports it as an insight. If the order import fails twice with the same error or no sync succeeds for an hour, the alert “Order import failing” fires, with an all-clear on the next success.
v1.1 — Custom domain for status pages
Status pages
- Custom domain released — A status page now runs on your own address, for example status.example.com. Bookable as an add-on at EUR 5 per domain and month, on every plan, quantity 1 to 25.
- Two DNS options — A CNAME to status.xictraq.com, or A and AAAA records pointing at our edge addresses if your provider does not allow a CNAME there. Both targets are shown for copying in the status page settings.
- Certificate issued automatically — The TLS certificate is issued as soon as DNS points at us. No upload, no manual renewal.
- Verification measures reachability — Only a domain that actually points at us is confirmed. Proof of ownership via a TXT record is no longer sufficient, because it would have released a domain for which no certificate can be issued.
v1.0 — Initial Release
Uptime & availability
- Multi-Location-Monitoring — Checks from 3 EU data centers (Nuremberg, Helsinki, Falkenstein). 2-of-3 consensus prevents false alarms.
- Flexible intervals — 30 seconds to 5 minutes, plan-dependent. HTTP and TCP checks.
- SLA-Filter — Exclude maintenance windows, calculate uptime percentage correctly.
- Timing waterfall — DNS, TCP, TLS, TTFB breakdown per check.
- Heartbeat-Monitoring — Ping URLs for cron jobs, backups and batch processes. Alert on missed ping.
Security & compliance
- SSL/TLS monitoring — Chain validation, staggered expiry warnings from your configured lead time, issuer change detection.
- Security-Header-Audit — HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy. Score 0–100.
- CSP-Wizard — Automatic whitelist generation from live scan. Copy-paste-ready snippets for Nginx, Apache, Caddy, Express.
- GDPR compliance — Pre-consent tracker detection, cookie banner check, imprint validation, Google Fonts check. Daily cron.
- BFSG/WCAG-2.2 — Accessibility scan via axe-core with score and concrete findings.
- DNSSEC-Monitoring — DS/DNSKEY check, AD bit validation, change detection.
- Blacklist-Check — Spamhaus, Barracuda, CBL/Abuseat and more DNSBL lists. Daily scan.
- Defacement detection (multi-layer) — Three signal layers (pixel diff, normalised HTML hash, DOM element fingerprint with external script/iframe hosts) correlated into a 0–100 score. Learning phase over 3 runs, opt-in per website, alert from score 60 (severity critical), auto-resolve. Changelog type “defacement”. From Starter.
- Script-Integrity / Magecart-Watch — SHA-256 fingerprint of monitored third-party scripts, re-checked every 10 minutes; alert on unannounced change (supply chain/Magecart). From Business.
- Certificate-Transparency-Watch — New certificates from CT logs (crt.sh) are matched against brand and lookalike patterns — phishing early warning plus certificate inventory. From Business.
- DNS & email authentication — SPF, DKIM, DMARC, MX and DNS records plus domain expiry (RDAP) with advance warning.
EU regulation (NIS2 & CRA)
- NIS2 reporting obligations — Incident capture with the statutory deadlines (24 h early warning, 72 h notification, final report 1 month after notification) and automatic deadline reminders. From Business.
- CRA component cockpit — Cyber Resilience Act: inventory of deployed components (tech-stack heuristic), detection of outdated versions and an alert from severity “high” that names the lead time to the next CRA deadline (90/30/7 days). From Business.
Analytics (cookieless, GDPR-compliant)
- Cookieless measurement — Pageviews, sessions, devices, geo, channels, UTM — no cookie banner needed (§ 25 (2) no. 2 TDDDG).
- Click-Heatmaps — Screenshot overlay with click positions and scroll depth.
- Session-Recordings — rrweb-based, inline CSS, privacy masking, own domain.
- Form-Analytics — Field drop-off, conversion funnels, submission rate per form.
- Media-Analytics — Video/audio engagement: play, pause, 25/50/75% progress, completion.
- A/B-Testing — Two-proportion z-test, uplift with 95% confidence interval, automatic significance detection.
- E-Commerce Auto-Tracking — 25+ shop systems auto-detected (WooCommerce, Shopify, Shopware, Magento, PrestaShop, etc.). Revenue, product views, cart, checkout.
- Web Vitals — LCP, CLS, INP from real user data. Performance budgets with alert on violation.
- Automated Insights — Statistically unusual deviations in traffic, bounce rate, JavaScript errors, load time, referrers, country and device mix; for shops also in orders, revenue and tracking coverage.
- 10 Dashboard-Tabs — Overview, audience, content, sources, heatmap, e-commerce, performance, conversions, recordings, settings.
- User identification — Link anonymous sessions to CRM or shop via a pseudonymous customer ID — automatically for Shopware, Shopify, WooCommerce etc. or manually via xictraq.identify(). No plain names/PII, cross-session.
- Attribution & ROAS — First-/last-click models, channel journey and click-ID capture (gclid, fbclid …); enter ad spend and see ROAS per campaign.
- User flow & transitions — Sankey user flow across the first steps plus in and out transitions per single URL.
- Matomo-Import — Import existing Matomo data — deduplicated, with GeoIP and bot enrichment, idempotent.
AI visibility (Share of Model)
- Share of Model — Measures whether and how your brand appears in answers from large AI models — periodic runs per topic/prompt profile, visibility score and trend. Evaluated on an own, EU-hosted model. From Business.
Dashboard & sharing
- Configurable dashboard — Drag-and-drop cards from 160+ building blocks, resizable, multiple named layouts per account.
- Share-Links — Share analytics and monitoring views read-only via link — no login, with its own persistent and configurable dashboard per link.
Incidents & alerting
- Incidents — Auto-creation for critical alerts. Lifecycle: Open → Acknowledged → Resolved. Timeline, comments, root cause, postmortem PDF.
- 7 alert channels — Email, Slack, Discord, Microsoft Teams, Telegram, webhook (HMAC-signed), browser push.
- Deduplication — 10-minute window + 24h cooldown for persistent alert types. No spam on flapping.
- On-Call-Eskalation — Multi-stage, schedules, vacation override, handoff notification.
- Auto-Resolve — Incidents are automatically closed when all linked alerts are resolved.
Competitor tracking
- 22 scan sections — Uptime, SSL, security, SEO, GDPR, tech stack, OG tags, content, careers, Web Vitals, accessibility, ads, page weight, email infra etc.
- Auto-Discovery — Find competitors by industry + postal code (OpenStreetMap + Google Places). Also nationwide without postal code.
- Overall score — Score 0–100 from security, GDPR, accessibility, performance, SSL. Default leaderboard metric.
- Activity heatmap — 12-week visualization of change frequency per competitor.
- Change-Detection — Concrete diffs: tech stack changes, Schema.org types, sitemap URL diffs, IP changes (DNS-based, CDN-tolerant).
- Export — CSV, JSONL and benchmark PDF report.
Brand Protection
- 8 detection techniques — TLD swap, character drop, swap, keyboard typo, hyphen, homoglyphs (l→1, o→0, rn→m), bitflips, phishing prefix/suffix.
- DNS registration detection — Daily cron checks up to 200 variants via A record lookup.
- Allowlist — Mark own legitimate domains (e.g. alias domains) as "dismiss".
- Dashboard-UI — Scan button, stats tiles, registered domains highlighted, available variants expandable.
SEO & content
- Keyword-Ranking — Daily position tracking, visibility index and competitor comparison. From Business, not yet enabled.
- Sitemap-Health — Weekly HEAD check up to 50 URLs. Broken/redirect detection.
- Schema.org-Validierung — Required field validation per @type on every compliance scan.
- Visual-Diff — Screenshot comparison per scan, pixel diff, auto-alert on defacement.
Reporting & status
- PDF-Reports — Weekly/monthly, auto-delivery to up to 20 recipients, 8–24 pages, all modules.
- Status-Pages — Per customer with subscribers (double opt-in), RSS, embeddable widget (badge/banner/card).
- White-Label — Logo, colors, company name in reports, status pages and emails (Agency plan).
Data export & API
- JSONL-Export — 6 report types (pages, referrers, visits, uptime, scans, alerts). Machine-readable for BI tools and ML pipelines.
- CSV-Export — Analytics, competitor data, invoices.
- REST-API — Sanctum token auth, all endpoints documented, HMAC-signed webhooks for alerts and incidents.
- Browser-Monitoring — Playwright scripts for login flows, checkouts. Chrome Recorder import.
- API-Monitoring — JSON schema assertions, auth support, latency budgets, multi-step chains.
- Geo-API — Own IP geo system (country/region/city plus ISP/ASN, RIR-based) queryable via API — no MaxMind, EU data.
Free tools
- 59 Tools — 43 server checks (DNS, SSL, security score, mail, Whois, pagespeed, broken links, redirects, sitemap, tech stack, accessibility, privacy, cookies, 10 geo tools, etc.) + 16 browser helpers (JWT, JSON, JSONL validator, encoder, UUID, regex, cron, etc.).
- No signup — All tools usable without account, EU-hosted, no tracking.
Team & account
- Team management — Invite members with roles (admin, editor, viewer). Client portal for customers (read-only).
- Security — 2FA (TOTP + passkeys/WebAuthn), login history, active sessions with revoke.
- AI chat assistant — Live data access, URL-specific suggestions, mutations with confirmation.
- 4 plans — Free (1 site), Starter (3 sites, from €12/mo, cancel monthly), Business (10 sites, from €29/mo, cancel monthly), Agency (50 sites, from €79/mo, cancel monthly). Permanently free Free plan to get started.
Frequently asked questions
Functional changes that affect existing integrations are announced at least 30 days ahead via email. Additive features (new endpoints, new fields) ship without lead time because they do not break existing calls.