Shopware monitoring from storefront to Store API
XICTRAQ checks the storefront, checkout, Store API and background processes of your Shopware shop and recognises maintenance mode as a planned pause rather than an outage. The cookieless tracker reads product views, cart and order completion straight from the standard Shopware 6 markup.
Check these paths first
- Uptime monitoringHomepage with maintenance detection
/ - Script integrityCart: third-party scripts and form targets
/checkout/cart - Browser monitoringFrom product page to order review
/checkout/confirm - Browser monitoringLogin with a test customer
/account/login - API monitoringStore API with sw-access-key
/store-api/product - SEO monitoringSitemap including linked .xml.gz files
/sitemap.xml
Why pinging the homepage is not enough
A Shopware 6 shop is more than its storefront: the Store API serves headless frontends and apps, scheduled tasks and the message queue run as separate background processes, and plugins and the theme hook into cart and checkout. An update can shift something in any of these places while the homepage keeps answering with HTTP 200.
XICTRAQ therefore spreads the checks across several modules: uptime monitoring with subpages and maintenance detection, browser checks for the path to checkout, API checks for the Store API, heartbeats for the background processes and script integrity for embedded third-party scripts.
XICTRAQ also monitors Shopware 5 with uptime, browser and API checks. The shop API connection for patch level, order status and order import, however, is only available for Shopware 6; the scan detects Shopware 5 shops and reports the end of support, but they cannot be connected through the API. The vendor discontinued development of Shopware 5 at the end of July 2024 and has not shipped regular security updates since. The tracker captures considerably less there than on Shopware 6: product views and add-to-cart clicks on the product detail page, and the order completion only through a dataLayer entry or a call of your own.
Let browser checks end on the order review page so that no real orders are placed, and sign in with a dedicated test customer rather than a real customer account.
What typically breaks in Shopware shops
Maintenance mode, planned or forgotten
When a sales channel is in maintenance mode, Shopware 6 redirects visitors to /maintenance and answers there with HTTP 503. XICTRAQ treats this as maintenance: outage and content alerts pause, while SSL, domain and blacklist alerts stay armed. Start and end are recorded in the changelog, so a forgotten maintenance mode can be traced as well.
Server errors after an update or plugin installation
After an update, the storefront or a single page can answer with a server error while other pages still work. Besides the homepage, uptime monitoring checks configured subpages such as /checkout/cart, reports an outage per path with its status code and keeps the timing split into DNS, connection, TLS and first byte in the history.
Buy button or checkout stops responding
A JavaScript error from a plugin can break the add-to-cart button or the checkout even though every page answers with HTTP 200. A browser check clicks through from product page via cart to order review and captures a screenshot of the failed step. In addition, the tracker reports JavaScript errors from real visits, and errors seen repeatedly trigger an alert.
Scheduled tasks and queue have stopped
In Shopware 6, scheduled tasks need a background process such as bin/console scheduled-task:run, and in the recommended setup the message queue is processed by a worker running messenger:consume. If one of them stops, the storefront usually stays reachable and an availability check sees nothing. A heartbeat expects a ping after every run and reports when it is missing or when a failure is signalled.
Tampered third-party script in checkout
Payment, chat or marketing scripts from other providers load on cart and checkout pages. For a verified website, script integrity records the SHA-256 hash of external scripts during a scan, fetches them again regularly and reports deviations. If you also scan /checkout/cart, a later scan of that page reports new external form targets. Scripts served from the shop’s own domain are not part of this check.
Store API returns errors or empty data
Headless frontends and apps use the Store API under /store-api/. API monitoring calls an endpoint such as /store-api/product with the sales channel access key in the sw-access-key header and checks status code, response time and individual response fields via JSON path. That way a response that arrives with HTTP 200 but no longer contains the expected data is caught too.
How XICTRAQ recognises Shopware
Technology detection reads the HTML and response headers of the monitored page and tells Shopware 6 apart from Shopware 5. A change of the detected system is recorded in the changelog, while maintenance detection and the tracker work independently of it.
- Shopware 6 by response headers such as sw-language-id and sw-currency-id or by traces in the HTML such as /bundles/storefront/ or data-sales-channel-id.
- Shopware 5 by paths such as /engine/Shopware/ or /themes/Frontend/Responsive/. Shopware 5 is listed as “Shopware”, Shopware 6 as “Shopware 6”.
- If the detected system changes, for example when migrating from Shopware 5 to 6, XICTRAQ writes a changelog entry naming the old and the new system.
- For Shopware 6, XICTRAQ also requests the admin page /admin and reads the major and minor version from its feature flags. If it changes, the changelog records the old and the new version, marked as a warning when the version goes back.
- On request, XICTRAQ reads the exact patch level, for example 6.7.14.2, through the Admin API of a Shopware 6 shop. To do so, create an integration without administrator rights under Settings › System › Integrations in the Shopware Administration and enter its access keys in the website settings once the domain is verified; for the patch level it needs no role. The version number is requested once a day; if the patch level changes, the change is recorded in the changelog. If you also want to see the order status in the order log, switch it on there and give the integration a role with read access to orders, payments, deliveries and their states. For the order status, only the order number and the states of the purchases captured by the tracker are read then, no customer data.
- With the optional order import, XICTRAQ uses the same integration to fetch the entire existing order history and then new and changed orders every ten minutes, including those created in the Administration, for example after an order by telephone. For this the role needs exactly eight entries under Settings › System › Users & permissions › Role › Detailed privileges, each with “Read” only: order, order_line_item, order_transaction, order_delivery, state_machine_state, payment_method, shipping_method and currency. Fetched are the order number, time, amounts with tax and shipping costs, currency, payment and shipping method, states and line items, as well as the name, company and customer number of the person ordering. XICTRAQ does not request the email address, address, telephone number, comment of the person ordering or VAT ID, even where the role makes some of them readable. Orders already captured by the tracker are not counted twice; if you switch the import off or disconnect the shop, the imported data is deleted. The order import is part of the Business plan; the step-by-step guide is in the documentation under “Shop connection (Shopware 6)”.
- XICTRAQ recognises maintenance by a 503 response that ends up on /maintenance after redirects or carries a maintenance notice in its title or text. A 503 without such a notice remains an incident.
- If no page content comes back, for instance behind bot protection, the previous shop detection stays in place instead of being recorded as “not Shopware”.
What the tracker captures in Shopware
The tracker recognises Shopware 6 by window.salesChannelId from the standard template and reads shop events straight from the storefront markup. It sets no cookies and, in standard tracking, stores nothing in browser storage.
Captured by the tracker on its own
- Page views with referrer, UTM parameters and device type, plus load times and Web Vitals such as LCP, CLS and INP.
- Product views on the Shopware 6 product detail page with name and price, plus the product number where the markup outputs it as itemprop="sku".
- Add-to-cart clicks with product, price and quantity, quantity changes and removals on the cart page, and removals in the off-canvas cart.
- The cart state on pages listing cart items: line items, subtotal, shipping, tax and total. In the off-canvas cart, line items and total.
- The start of checkout on the order review page at /checkout/confirm.
- The order completion on /checkout/finish with total and order number, as far as the confirmation page shows them.
- JavaScript errors from real visits with message, file and line.
Not captured automatically
- Signed-in customers: the tracker only links them if the theme outputs a customer ID, for example as data-customer-id or window.customerId. The standard Shopware 6 template does not.
- Foreign currencies on order revenue: the order total is reported as EUR, even if the sales channel charges in another currency. The same applies to the off-canvas cart state.
- Tax, shipping costs and individual line items on the purchase event itself. These values only appear in the separately captured cart state; with the order import the line items of matched orders come from the shop.
- Cancellations and refunds. There is no automatic event for them; with the optional order import their status comes from the shop.
- On Shopware 5, the order completion and revenue, unless a plugin places the purchase as a purchase entry in a dataLayer. Otherwise, checkout start is reported there only by a generic path match that already fires on /checkout/cart.
- Orders created without a storefront page, for example through the Administration or a Store API client without the tracker. With the optional order import through the Admin API they are counted all the same.
Pass missing values through the JavaScript API: xictraq.revenue(amount, "EUR", orderNumber, { tax, shipping }) on the confirmation page of a Shopware 5 shop, xictraq.identify(customerId, { group }) for signed-in customers and xictraq.refund(orderNumber, amount, "EUR") for refunds.
The right modules for Shopware
Frequently asked questions
Does Shopware maintenance mode trigger an outage alert?
Usually not. With maintenance mode active, Shopware 6 redirects to /maintenance and answers there with HTTP 503. XICTRAQ recognises this combination as maintenance and pauses outage and content alerts, while SSL, domain and blacklist alerts stay armed. A 503 without a maintenance notice, on the other hand, is treated as an incident, because an overloaded server answers the same way.
Can a browser check walk through the Shopware checkout?
Yes. A browser check can open pages, click, fill in forms, wait for elements and verify text, URLs or status codes. Let it end on the order review page at /checkout/confirm so that no real orders are placed. For the login at /account/login, use a dedicated test customer rather than a real customer account.
How do I monitor the Shopware Store API?
Create an endpoint such as /store-api/product in API monitoring and add the sales channel access key as the sw-access-key header. You can check status code, response time, text content, response headers, individual fields via JSON path or the whole response via JSON schema.
How do I notice that scheduled tasks or the queue worker have stopped?
With a heartbeat: append a call to the ping URL to the cron entry running bin/console scheduled-task:run --no-wait. If the ping does not arrive within the expected interval plus grace period, XICTRAQ reports the missed run. Separate URLs for start and failure also capture run time and aborts, which suits a worker running messenger:consume that stops regularly via --time-limit and is restarted.
What does the tracker capture on Shopware 5?
Considerably less than on Shopware 6: product views and add-to-cart clicks on the product detail page, plus page views, Web Vitals and JavaScript errors. It only captures order completion and revenue if a plugin places the purchase in a dataLayer; otherwise, call xictraq.revenue() yourself on the confirmation page. Since the end of July 2024, Shopware 5 has not received regular security updates from the vendor.
Does the security scan find exposed Shopware files?
Besides general files such as .env, .git/config or SQL dumps, it also requests .env.local, config/jwt/private.pem and the Composer files auth.json and composer.json. They are usually only exposed if the web root points to the project folder instead of public. A file is only reported if its beginning matches it, for example the header of a private key; a start or error page that answers under every address does not count as a finding. In installations with key files, config/jwt/private.pem signs the Admin API access tokens, so an exposed key appears as critical in the report.
Does XICTRAQ report an outdated Shopware version?
Yes, with a limitation. Shopware 5 no longer receives vendor updates and is reported as outdated. Shopware 5 cannot be connected through the API. For Shopware 6, XICTRAQ reads the major and minor version, for example 6.6, from the publicly reachable admin page and assesses it against the vendor release notes; the admin page does not reveal the patch level. If you connect the shop to XICTRAQ through an integration without a role, the exact patch level, for example 6.7.14.2, comes from the Admin API once a day. Without this connection and with a blocked admin page the version stays unmeasured. A version change, or a switch between Shopware 5 and 6, is recorded in the changelog. The CRA cockpit additionally assesses components that reveal their version, such as PHP in a response header, the web server, OpenSSL or jQuery.
Which permissions does the integration need for the order import?
A role with exactly eight entries, each with “Read” only: order, order_line_item, order_transaction, order_delivery, state_machine_state, payment_method, shipping_method and currency. You create the role under Settings › System › Users & permissions, set the permissions under “Detailed privileges” and assign it to the integration under Settings › System › Integrations; the integration needs no administrator rights. When you switch the import on, XICTRAQ checks the permissions right away and lists missing ones. With read access to order, Shopware technically also makes other customer details such as the email address readable; XICTRAQ only requests the name, company and customer number.
Does XICTRAQ count orders from the shop admin and purchases the tracker missed?
Yes, with the order import. Orders from the shop admin count with the next sync, online orders without a captured purchase after two hours, so that a late tracker report does not count twice. They feed into revenue, orders, products and reports, not into conversion rate and funnel, because no visit underlies them. The import does not take over orders cancelled in the shop.