Appearance

Third-Party Integrations ​

Orbit provides sensible performance defaults, security rate-limiting, and cleanup routines for popular third-party WordPress plugins.

WooCommerce Integrations ​

When WooCommerce is active, Orbit enforces privacy and performance safeguards:

Disabled Telemetry & Pattern Loading ​

Orbit forces option_woocommerce_allow_tracking to return false. This disables background WooCommerce usage tracking and stops WooCommerce from downloading external pattern templates from Pattern Directory endpoints.

Store API Rate Limiting ​

Orbit applies rate limiting to WooCommerce Store API checkout endpoints to protect against automated carding and checkout abuse:

  • Max Requests: 20 requests
  • Time Window: 60 seconds
  • Proxy Support: Enabled (properly respects reverse proxy headers such as Cloudflare or Nginx)

External WooCommerce Pattern Removal ​

Orbit filters out WooCommerce block patterns from both the PHP pattern registry and REST API responses (/wp/v2/block-patterns/patterns).

If you wish to keep default WooCommerce block patterns enabled:

php
add_filter( 'orbit_enable_disable_external_patterns', '__return_false' );

Non-Live Site Safeguards ​

When Orbit detects that the site is running on a Non-Live Site (cloned environment, staging server, local dev, or migration instance), it automatically applies safeguards to prevent unintended background tasks or live transactions:

  • WooCommerce Subscriptions: Forces WooCommerce Subscriptions into Staging Mode (woocommerce_subscriptions_is_duplicate_site). Renewal orders process as manual renewals without making live payment gateway charges to customers.
  • WooCommerce Webhooks: Disables outgoing WooCommerce webhook delivery (woocommerce_webhook_should_deliver) to prevent non-production events from pushing to live CRMs/ERPs.
  • Admin Warning Notice: Displays a prominent notice on WooCommerce admin screens informing administrators that Non-Live Safeguards are active.

Immediate .env Kill-Switch ​

You can explicitly force or disable Non-Live Safeguards in .env without changing code:

env
# Force non-live site safeguards to active
ORBIT_IS_NONLIVE_SITE=true

# Explicitly disable non-live site safeguards (e.g. for testing live modes)
ORBIT_IS_NONLIVE_SITE=false

When omitted, Orbit automatically detects non-live environments via domain pattern matching (beta.*, staging.*, *.kinsta.cloud, .test, .local, .dev, 127.0.0.1) and WP_ENV settings.

Advanced & Edge-Case Overrides ​

For rare edge cases where automatic domain detection fails and .env kill-switches are not suitable, you can use either of these overrides depending on developer preference:

  • Environment Constant: Set ORBIT_PRIMARY_DOMAIN=example.com in .env or wp-config.php. Any site accessed on a host other than the primary domain will automatically activate non-live safeguards.
  • PHP Filter Hook: Filter orbit_is_nonlive_site in PHP code:
php
add_filter( 'orbit_is_nonlive_site', function ( bool $is_nonlive ): bool {
    // Custom logic to flag a site as a non-live site
    return $is_nonlive;
} );

Custom Third-Party Safeguards ​

Orbit exposes an abstract class AbstractNonliveSafeguard (Eighteen73\Orbit\Support\AbstractNonliveSafeguard) implementing the NonliveSafeguards interface under the Support directory.

By extending AbstractNonliveSafeguard, developers can call $this->setup_safeguards() inside setup() or on plugins_loaded. This automatically checks $this->is_nonlive_site() before executing apply_safeguards():

php
namespace Eighteen73\Orbit\ThirdParty;

use Eighteen73\Orbit\Support\AbstractNonliveSafeguard;

/**
 * Example Contrived Safeguard for a custom CRM integration plugin.
 */
class CustomCRMSafeguard extends AbstractNonliveSafeguard {

    public function setup(): void {
        // Defer target plugin checks to plugins_loaded for MU-plugin compatibility
        add_action( 'plugins_loaded', function () {
            if ( class_exists( 'MyCRM_API' ) ) {
                $this->setup_safeguards();
            }
        } );
    }

    /**
     * Apply safeguards (only runs automatically when on a non-live site).
     */
    public function apply_safeguards(): void {
        // Force sandbox API endpoint and block outgoing CRM sync on non-live sites
        add_filter( 'mycrm_api_environment', fn() => 'sandbox' );
        add_filter( 'mycrm_disable_outgoing_sync', '__return_true' );
    }
}

Action Scheduler Optimisations ​

Orbit tunes WooCommerce and Action Scheduler background job cleanup behaviour to prevent the wp_actionscheduler_actions database table from growing excessively large:

  • Retention Period: Retains completed/failed actions for 2 weeks (WEEK_IN_SECONDS * 2).
  • Cleaned Statuses: Automatically purges complete, canceled, and failed jobs.
  • Batch Cleanup Size: Purges in batches of 1000 records per run.

Action Scheduler Filter Hooks ​

php
// Change retention period to 7 days
add_filter( 'orbit_action_scheduler_retention_period', fn() => WEEK_IN_SECONDS );

// Customise cleanup statuses
add_filter( 'orbit_action_scheduler_default_cleaner_statuses', function( array $statuses ) {
    return [ 'complete', 'canceled' ]; // Exclude failed jobs
} );

// Change cleanup batch size
add_filter( 'orbit_action_scheduler_cleanup_batch_size', fn() => 500 );

Altcha CAPTCHA Cache-Busting ​

When using the Altcha spam-protection plugin, challenge URLs can sometimes be cached by reverse proxies (Varnish, Nginx) or CDN edge networks (Cloudflare), causing valid challenge tokens to expire or fail.

Orbit automatically appends a dynamic, uncacheable query string parameter (?r=1234) to Altcha challenge endpoints (altcha_challenge_url), ensuring that every visitor receives a unique cryptographic challenge.

Copyright © 2025 eighteen73