Connecting a store from its own platform

An Ottom platform plugin shows a store’s score in the store’s own admin. The merchant presses Connect, signs in to Ottom and confirms the store, and the plugin proves the store is theirs with a check file Ottom reads once. This page gives the steps, what the plugin shows and never shows, and how to disconnect.

No Ottom plugin is published in a platform marketplace yet. This page describes how connecting works, so it is ready when the first one is. Until then, scan your store from the Ottom home page.

The steps

1. Press Connect in your store admin
Install the Ottom plugin for your platform and press Connect to Ottom on its settings page. Your browser opens Ottom.
2. Sign in and confirm the store
Sign in to Ottom, or create an account. Ottom shows the store address and the admin address it will send you back to. Press Connect if both are yours, or Cancel if not.
3. Let the plugin finish
Back in your admin, the plugin places a small check file on your storefront at /.well-known/ottom-verify. Ottom reads it once, within 15 minutes, to confirm the store is yours. The plugin then removes the file and shows your latest score.

What the plugin shows

Your latest score, or why there is no number yet.
Each stage the scan ran, stamped PASS, SLOW or STALLED.
How many findings the scan raised at each severity.
A link to the full report on Ottom, where findings are read.

What it never does

The plugin never shows a finding’s title, description or fix, on any plan. Those stay in the report on Ottom, behind the same sign in as everything else.
Ottom gets no access to your orders, customers or admin. The plugin sends Ottom your store address and its own version number, and nothing else.
Connecting does not change how Ottom scans your store. A connected store and an unconnected one are scanned the same way.

Proving the store is yours

Reading the check file proves the store is yours, the same way a DNS record does. A store proved this way can change how Ottom measures it. If another Ottom account already holds the store, connecting is refused and nothing is moved: write to [email protected] from an address on the store’s domain and we will sort it out. The other way to prove a store is a DNS record.

Disconnecting

Press Disconnect in the plugin, or uninstall it, and its access stops at once. You can also disconnect it from the store’s page in your dashboard, or a workspace owner or admin from the workspace page, under Connected platforms. The store stays proved: disconnecting stops the plugin, it does not undo the proof.

When connecting does not finish

Ottom could not read the check file
Your storefront must be online and reachable without a password. If the store is behind a coming soon page or a password, open it to the public for a minute, then press Connect again.
Your storefront answered with something else
A page cache or a security plugin served another page at /.well-known/ottom-verify. Exclude that path from the cache, then press Connect again.
The connection timed out
The code in the address bar lasts 10 minutes and the check file 15 minutes. Press Connect again to start over.

Questions

Does the plugin show my findings?

No. It shows your score, the stage verdicts and how many findings there are at each severity. The findings themselves are in your report on Ottom.

How often does the plugin ask Ottom for my score?

It keeps a score for ten minutes before asking again, and Ottom answers each store at most 60 times an hour.

Can an agency connect a client’s store?

Yes, if the agency can install plugins in the client’s admin. The store must not already be held by another Ottom account. The client keeps their own account if they have one.

Connected stores are listed on your workspace page, under Connected platforms.