JTL-Shop monitoring from cart to task scheduler
XICTRAQ checks the homepage, cart and checkout of your JTL-Shop, recognises maintenance mode as a planned pause rather than an outage and uses a heartbeat to report when the task scheduler stops running. The cookieless tracker reads product views, add-to-cart clicks and the start of checkout from the NOVA template.
Check these paths first
- Uptime monitoringHomepage with maintenance detection
/ - Uptime monitoringCart as a separate subpage
/Warenkorb - Browser monitoringFrom product page into checkout
/Bestellvorgang - Browser monitoringLogin with a test customer
/Mein-Konto - SEO monitoringrobots.txt served by robots.php
/robots.txt
Why pinging the homepage is not enough
A JTL-Shop is more than its homepage: cart, checkout and customer account are separate pages, plugins and the template hook into the purchase path, and exports and newsletter sending run through the task scheduler. An update can shift something in any of these places while the homepage keeps answering with HTTP 200.
On top of that come states that JTL-Shop switches itself. In maintenance mode, the shop serves a maintenance page with HTTP 503 at the same address, and without a dedicated cron job the task scheduler only processes exports and newsletters alongside page views by visitors. From the outside, the first looks like an outage and the second like nothing at all.
XICTRAQ therefore spreads the checks across several modules: uptime monitoring with subpages and maintenance detection, browser checks for the path into checkout, heartbeats for the task scheduler, script integrity for embedded third-party scripts and a check of the robots.txt.
Let browser checks end before the order is submitted so that no real orders are placed, and sign in with a dedicated test customer rather than a real customer account.
What typically breaks in JTL shops
Maintenance mode, planned or forgotten
In maintenance mode, JTL-Shop serves a maintenance page with HTTP 503 at the same address. If it contains "Wartungsmodus" or "Wartungsarbeiten", XICTRAQ treats this as maintenance: outage and content alerts pause, while SSL, domain and blacklist keep being checked. Start and end are recorded in the changelog, and a browser check fails on the maintenance page, so a maintenance mode left on after an update is noticed as well.
Server errors after an update or plugin installation
After a shop update or a plugin installation, a single page such as the cart can answer with a server error while the homepage still works. Besides the homepage, uptime monitoring checks configured subpages such as /Warenkorb or /Mein-Konto and reports each path separately.
Buy button or checkout stops responding
A JavaScript error from a plugin or a template change can break "Add to cart" even though every page answers with HTTP 200. A browser check set up for this opens a product page, adds the product to the cart, moves on to checkout and captures a screenshot of the failed step. Because JTL-Shop sends visitors with an empty cart from checkout back to the cart, the check should include a step that verifies the URL it reached, so that a silent bounce is caught as well.
Task scheduler has stopped
JTL-Shop processes exports and newsletters through its task scheduler. Without a cron job, the scheduler only runs alongside page views, which is why JTL recommends a real cron job calling includes/cron_inc.php. If that job stops, the shop stays reachable and an availability check sees nothing. A heartbeat expects a ping after every run and reports when it is missing or when a failure is signalled.
robots.txt blocks all search engines
JTL-Shop serves its robots.txt through robots.php. If a "Disallow: /" ends up in the live shop after a server move or a restored test copy, all crawlers are locked out. XICTRAQ reports a robots.txt that blocks all crawlers as a critical alert and records every change to the file, with added and removed lines, in the changelog.
Tampered third-party script in the purchase path
Payment, chat or marketing scripts from other providers load within the shop. Script integrity records the SHA-256 hash of external scripts during a scan, up to twelve per scan, and reports when a hash changes in a later scan. If the checked page sits under a path such as /Warenkorb or /Bestellvorgang, it also reports new external form targets. Scripts served from the shop’s own domain, for example by plugins, are not part of this check.
How XICTRAQ recognises JTL-Shop
Technology detection in the scan reads the source code of the checked page and stores the result in the technology profile. The tracker recognises the NOVA template independently in the browser.
- JTL-Shop by traces in the source code such as the "Powered by JTL-Shop" notice in the NOVA footer or paths under /plugins/jtl. With a licence that removes the vendor notice, the first trace is missing.
- The ongoing checks of the monitoring agent leave the detected "JTL-Shop" entry in place, even though they cannot detect it themselves.
- In the CRA component cockpit, JTL-Shop appears as a component without a version and is therefore marked as not assessable. There is no version rule for JTL-Shop itself; visible versions of PHP, nginx, Apache, OpenSSL, jQuery or Bootstrap are matched against known vulnerabilities.
- XICTRAQ recognises maintenance by a 503 response with "Wartungsmodus" or "Wartungsarbeiten" in its text. A 503 without such a notice counts as an incident unless it clearly comes from bot protection.
- The tracker recognises JTL-Shop by markers of the NOVA template such as #result-wrapper on the product page and in checkout, or .productbox in product lists.
What the tracker captures in JTL-Shop
The tracker recognises pages of the NOVA template by their markup and reads shop events straight from it. It sets no cookies.
Captured by the tracker on its own
- Page views with referrer and UTM parameters, plus Web Vitals such as LCP and CLS.
- Product views on the product page with name, price and item number, plus manufacturer and category where structured data contains them. The tracker may take the name from the page title; if the shop appends its shop title or the price there, that becomes part of the name.
- Clicks on "Add to cart" on the product page with product, price and quantity.
- The start of checkout as soon as a page such as /Bestellvorgang is loaded.
- E-commerce events that the shop or a plugin writes to the dataLayer as view_item, add_to_cart, begin_checkout or purchase, with amount, currency and order number for purchases.
- JavaScript errors from real visits with message, file and line.
Not captured automatically
- Order completion and revenue: the NOVA confirmation page shows the order number but no total the tracker could read. Without a dataLayer event or your own call, no revenue is recorded.
- Signed-in customers: there is no dedicated customer detection for JTL-Shop. The tracker only links customers if the template outputs an identifier such as the xictraq:user-id meta tag or a data-customer-id attribute.
- The cart state with totals, as well as quantity changes and removals in the cart: the total and line rows of the NOVA cart do not carry the markers these evaluations expect.
- Cancellations, returns and refunds, for example from JTL-Wawi. There is no automatic event for them.
- Processes without a shop page in the browser, such as the sync with JTL-Wawi via the dbeS interface or notifications from payment providers.
- Product views and add-to-cart clicks in custom templates that are not based on NOVA and do not keep its markers.
Pass missing values through the JavaScript API: xictraq.revenue(amount, "EUR", orderNumber) on the order confirmation page, where NOVA provides the order number as {$Bestellung->cBestellNr}, xictraq.identify(customerId, { name }) for signed-in customers and xictraq.refund(orderNumber, amount, "EUR") for refunds.
The right modules for JTL-Shop
Frequently asked questions
Does JTL-Shop maintenance mode trigger an outage alert?
Usually not. In maintenance mode, JTL-Shop answers with HTTP 503 and a maintenance page; if it contains "Wartungsmodus" or "Wartungsarbeiten", XICTRAQ treats this as maintenance and pauses outage and content alerts, while SSL, domain and blacklist keep being checked. If you change the notice via the language variable maintenanceModeActive, keep one of these words in it, or a phrase such as "undergoing maintenance" in an English-language shop. A 503 without a maintenance notice counts as an incident unless it clearly comes from bot protection.
How do I monitor the JTL-Shop task scheduler?
With a heartbeat. JTL recommends triggering the task scheduler with a real cron job calling includes/cron_inc.php; append a call to the ping URL to that cron entry. If the ping does not arrive within the expected interval plus grace period, XICTRAQ reports the missed run. Separate URLs for start and failure, or an exit_code passed along, also capture run time and aborts.
Can a browser check walk through the JTL-Shop checkout?
Yes. A browser check can open pages, click, fill in forms, wait for elements and verify text, URLs or status codes. Add a product to the cart first, because with an empty cart JTL-Shop sends visitors from checkout back to the cart. Let the check end before the order is submitted, and use a dedicated test customer for the login at /Mein-Konto.
Why does the tracker not capture revenue in JTL-Shop?
The order confirmation page of the NOVA template shows order number and payment method but no total the tracker could read. If the shop or a plugin writes a purchase event to the dataLayer, the tracker takes amount, currency and order number from it. Otherwise, call xictraq.revenue(amount, "EUR", orderNumber) yourself on the confirmation page.
Does XICTRAQ recognise JTL-Shop without the "Powered by" notice?
Besides the notice in the footer, the scan also recognises JTL-Shop by paths under /plugins/jtl. If both are missing, for example with a licence without the vendor notice and without JTL plugins, JTL-Shop usually does not appear in the technology profile. The tracker is not affected by this: it recognises the NOVA template by its markup in the browser.
Does XICTRAQ report an outdated JTL-Shop version?
There is no version rule for JTL-Shop, and technology detection does not read a JTL version number. In the CRA component cockpit, JTL-Shop is therefore listed as a component that cannot be assessed. Components that reveal their version, such as PHP in a response header or an embedded jQuery file, are matched against known vulnerabilities.