manifest / ecommerce / central-business-overview

Central Business Overview

Pulls WooCommerce business data from a remote store via REST API and webhooks.

by Anisur Rahman · github.com/anisur2805/central-business-overview · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/anisur2805/central-business-overview/archive/refs/heads/main.zip

No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Readme github.com/anisur2805/central-business-overview ↗

Pulls WooCommerce business data from a remote store via REST API and webhooks into a single wp-admin dashboard.

What It Does

Central Business Overview connects a plain WordPress site (no WooCommerce needed) to a remote WooCommerce store and surfaces key metrics in one place.

Pull: The destination site fetches data from the source WooCommerce store via the REST API — server-side only, nothing exposed to the frontend.
Push: The source site sends webhooks on order/product/customer events. The dashboard polls for those deliveries every 15 seconds and updates the metrics in place — no page reload, no manual refresh.
Cache: Data is cached with transients (5-minute fallback) and cleared instantly on webhook receipt.

Dashboard Widgets

Widget	Details
Revenue	Gross total for a selectable period (1 / 7 / 15 / 30 days), filtering processing + completed orders. Orders are read page by page (100 at a time, up to 5 pages — filterable), so totals are not capped at the first page
Order Count	Number of matching orders for the period, taken from the API's `X-WP-Total` header
Products	Published product count
Customers	Registered customer count
Latest Orders	10 most recent orders, all statuses — ID, date, customer, status, total
Stock Alerts	Out-of-stock products plus in-stock products at or below the low-stock threshold (default 2, filterable) — name, SKU, stock qty, and status

Features

Top-level Business Overview admin menu with Dashboard and Settings pages
Auto-refresh: polls every 15 seconds and patches the dashboard in place as soon as a webhook is received — no page reload, no manual refresh
No page reloads: webhook updates, Refresh now and the period selector all fetch data over AJAX and update the cards, tables and timestamps in place (with a form/no-JS fallback)
Test Connection button with clear pass/fail feedback
Extensible connection config — built for one connection now, structured for multiple
Fully OOP, namespaced, translation-ready
Clean uninstall removes all options, transients, and custom capabilities

Refresh Timing

There is no page reload, so there is no page-load time to wait for — each update is a single admin-ajax.php POST whose JSON payload is applied to the DOM the moment it returns.

Trigger	What runs	Until the numbers update
Webhook received on the source store	The dashboard asks `cbo_check_webhook` every 15 seconds; when the stored timestamp is newer (and at least 3 seconds have passed since the last refresh) it pulls `cbo_refresh_dashboard` and patches the cards/tables in place	0–15 seconds after delivery (average ≈ 7.5 s), plus one AJAX round-trip
Refresh now	One AJAX POST with `bypass_cache` — the cache is skipped, so the source API is re-queried fresh (orders page by page)	One round-trip; server-side processing measured at ~12–15 ms against a healthy source, plus however long the source store's API takes to answer
Period selector change	One AJAX POST served from cache (a webhook clears the cache instantly, so it is never staler than 5 minutes)	One round-trip; server-side processing measured at ~0.1–0.3 ms on a cache hit
Any refresh already in flight	A 3-second cooldown suppresses a second refresh, so bursts of webhooks coalesce into one update	—
Data cache (transients)	`CBO_TRANSIENT_TTL` fallback when no webhook has arrived	5 minutes

The 15-second poll itself (cbo_check_webhook) is a single option read — measured at under 0.2 ms server-side — so leaving the dashboard open all day costs almost nothing.

Timings measured server-side on the local test site (wp eval-file, mocked source API); add normal browser ↔ admin-ajax.php network latency (typically tens to a few hundred milliseconds) for the full round-trip. Before 1.1.0 the same update cost a full HTML/CSS/JS page reload.

Requirements

WordPress 5.9 or higher
PHP 8.0 or higher
WooCommerce 7.0 or higher on the source site only
HTTPS on both sites

Installation

1. Install the Plugin

Upload central-business-overview.zip on the destination site via Plugins → Add New → Upload Plugin, then activate it.

2. Configure Settings

Go to Business Overview → Settings and fill in:

Field	Description
Source Site URL	The HTTPS root URL of your WooCommerce store (e.g. `https://shop.example.com`)
Consumer Key	Read-only WooCommerce REST API key from the source site
Consumer Secret	Matching secret for that key
Webhook Secret	A shared secret you choose — used to verify incoming webhooks

Click Save Changes, then use the Test Connection button to verify connectivity. The Connection Diagnostic section below the form shows the exact webhook delivery URL to use, and includes a Send Test Webhook button that posts a signed test payload to that URL.

3. Create a Webhook on the Source Site

On the source WooCommerce site:

Go to WooCommerce → Settings → Advanced → Webhooks
Click Add webhook
Fill in:
- Name: Central Business Overview
- Status: Active
- Topic: Order created
- Delivery URL: https://your-destination-site.com/wp-json/cbo/v1/webhook/default
- Secret: The same value you entered in the plugin settings on the destination site
Save, then repeat for these additional topics:
- Order updated
- Order deleted
- Product updated
- Customer created

4. View the Dashboard

Return to Business Overview to see your data. Use the period selector to switch between 1, 7, 15, or 30 days. Every update — webhook arrivals, Refresh now, and the period selector — is applied over AJAX, so the page itself never reloads; only the numbers, tables and timestamps change. The selected period is kept in the URL, so a manual browser refresh shows the same window. Without JavaScript the refresh form still posts and the period selector has an Apply button.

FAQ

Do I need WooCommerce on the destination site?

No. The plugin runs on plain WordPress. WooCommerce is only required on the source site.

What permissions does the REST API key need?

Read-only (Read permission) on the source WooCommerce site. Create it at WooCommerce → Settings → Advanced → REST API → Add key.

Why does the dashboard show "Showing stale data"?

The cache TTL is 5 minutes as a fallback. This badge appears when the plugin couldn't reach the source site and is displaying cached data. It will clear automatically when the next webhook arrives, or click Refresh now to retry immediately.

Does the dashboard reload the page when the data changes?

No. A lightweight check runs every 15 seconds; when it detects a new webhook delivery, the plugin fetches fresh data through AJAX and updates the cards, tables and timestamps in place. Refresh now and the period selector behave the same way. The page only loads once, when you open it.

Does this plugin modify anything on the source site?

No. All API calls are GET requests (read-only). The webhook endpoint only receives data — it clears cache and records the receipt time, it does not store or trust the payload.

The source site URL must use HTTPS?

Yes. The plugin enforces HTTPS and verifies SSL certificates on every request.

Developer Filters

Filter	Default	Purpose
`cbo_revenue`	—	Override the calculated revenue (`$revenue, $orders, $connection_id, $days`)
`cbo_max_order_pages`	`5`	How many 100-order pages are read per revenue period
`cbo_low_stock_threshold`	`2`	Quantity at or below which an in-stock product is listed as low stock

Security

All data fetching is server-side — no browser-side requests to the source site
The dashboard's AJAX refreshes post to this site's own admin-ajax.php; the source store is still only contacted server-side
AJAX endpoints are protected by a nonce and the custom capability
Webhook signatures are verified with HMAC-SHA256 using hash_equals()
Admin access requires the custom view_business_overview capability
Secrets are never exposed in HTML, JS, or error messages
Nonces and capability checks on all write actions

Changelog

1.1.0

No page reloads: webhook updates, Refresh now and the period selector now patch the dashboard in place over AJAX. The previous poller called location.reload() every time a webhook arrived.
New cbo_refresh_dashboard AJAX action returns the full dashboard payload (card values, order rows, stock rows, timestamps, stale/error state) built by the same code that renders the page.
The poller only fetches data when a new webhook timestamp appears, and skips a refresh that runs within 3 seconds of the previous one.
Period selection is reflected in the URL with history.replaceState(), so reloading the browser keeps the chosen window.
No-JS fallback kept: the refresh form still posts, and the period selector ships a `