Operator toolkit for Shopware 6 — health checks, cache & queue ops, security audits, logs, Elasticsearch tooling, and more, directly in the Administration.
Maintained by FriendsOfShopware.
Repository: github.com/FriendsOfShopware/FroshTools
Shopware shops accumulate operational work that usually needs SSH, Redis CLIs, Elasticsearch dashboards, or ad-hoc scripts. Frosh Tools brings those day-to-day tasks into the Admin under Settings → Plugins → Tools, so merchants and developers can inspect and act without leaving the browser.
| For operators | For developers |
|---|---|
| Clear caches & compile themes | System health + performance recommendations |
| Inspect queues and scheduled tasks | Feature flags, state machines, webhooks |
| Read production logs | Elasticsearch console & index lifecycle |
| Security overview + SBOM export | File integrity for core and extensions |
| Monitor tasks/queues via CLI mail alerts | Redis namespace/tag cleanup helpers |
Compatible with Shopware 6.6 and 6.7.
Create or remove monitoring credentials in the Shopmon tab. FroshTools manages a dedicated ACL role and refreshes its permissions on plugin installation and updates. Repeating setup preserves existing credentials.
For automated setup, set both SHOPMON_ACCESS_KEY and SHOPMON_ACCESS_SECRET before installing or updating FroshTools. APP_URL supplies the shop URL. With either credential missing, automatic setup leaves unconfigured shops unchanged; manual setup can generate credentials.
Existing integrations from FroshShopmon are adopted with their credentials and setup code intact. When uninstalling the old FroshShopmon plugin, keep its user data: its uninstall routine otherwise deletes the shared integration. Removing the integration from FroshTools deletes the integration, ACL role, and configuration for both plugins.
Live health checks (PHP, MySQL, queue, tasks, …) plus performance recommendations with documentation-oriented guidance.
Dependency advisories, runtime end-of-life checks, configuration risks, file integrity — and Export SBOM (CycloneDX 1.7 from composer.lock).
Open Security → Timeline to review administrator sign-ins, user and role changes,
integration and API-key changes, extension lifecycle events, and password recovery activity.
Events are stored in frosh_tools_security_activity. Existing log entries are not imported.
Filter by actor, action, client IP, or UTC date range. JSON export includes every matching
event, across pages. Access requires the existing frosh_tools_security:read privilege.
Client IPs come from Symfony's main request and respect the shop's trusted-proxy configuration. The timeline records allowed identifiers and changed field names, never passwords, recovery tokens, or secret values. IP addresses and account identifiers are personal data; restrict access and choose a retention period appropriate for your shop.
The daily frosh_tools.security_activity.cleanup scheduled task retains 90 days by default.
Keep scheduled-task and message-queue workers running. Override retention (1–3650 days) in
config/packages/frosh_tools.yaml:
frosh_tools:
security_activity:
retention_days: 90Uninstalling with keep user data preserves the timeline; removing user data drops its table. Shopware's own logging remains available independently.
List cache pools, clear individual pools, compile the theme, and clear PHP OPcache.
OPcache hit rate/memory, cache backend metrics, and database server statistics.
Transport overview (Doctrine, Redis, AMQP, …), message sizes, worker heartbeat, browse/retry/delete messages, purge or reset.
Inspect all tasks, edit interval & next run, run a single task, register missing tasks.
Interactive diagrams for order, payment, delivery, and other registered state machines.
Browse any file under var/log/ from the Admin.
List core and extension feature flags; toggle where supported.
Dedicated list/detail UI for Shopware webhooks (including inline search).
| Area | Capabilities |
|---|---|
| System Status | Health checkers (PHP/FPM, MySQL, queue lag, scheduled tasks, composer audit summary, debug/prod mode, …) and a large set of performance recommendations (admin worker, mail-over-queue, increment storage, OPcache flags, ES, product-stream indexing, …). |
| Data integrity | Data that Shopware accepts but that breaks the storefront, checkout or administration, or makes the shop silently behave wrong. Products: canonical products of other products or on products without variants, missing or foreign main variants and covers, variants without options or with duplicate options, missing configurator settings, products hidden by a missing display group, gaps or overlaps in advanced prices, maximum below minimum order quantity, deleted delivery times, layouts of the wrong type, invalid main categories, dynamic product groups without filters that are still in use, descriptions too long for Elasticsearch on Shopware < 6.6.6.0. Configuration: invalid rules, flows and dynamic product groups, rule conditions and flow actions referencing deleted entities, flow mail templates without complete default translation, payment methods and tax providers whose plugin or app is gone, tax rules for individual states that match no state, delivery times with unsupported units, currency roundings with interval zero and invalid currency factors, countries requiring a state without states, unavailable default countries, languages without translation code, inactive navigation categories, shop pages pointing to deleted layouts, link categories without target, media folders with a deleted configuration, product comparisons with a missing currency, promotion discounts for missing set groups, number ranges without type or for a sales channel, unassigned default payment/shipping methods and domain languages/currencies, active shipping methods without prices, duplicate delivery times, categories sorted after a non-sibling. Customers: shared email addresses (core uniqueness rules), missing or foreign default addresses, requested customer groups that no longer exist. Results are cached for 5 minutes; Refresh runs the checks again. |
| Security Center | Severity overview; Packagist dependency advisories; PHP / MySQL / Symfony / Shopware EOL; environment risks; core & extension file integrity; CycloneDX 1.7 SBOM export. |
| Cache | Pool listing with clear actions, theme compile, OPcache clear. |
| Statistics | OPcache, cache-adapter, and database metrics for capacity troubleshooting. |
| Queue | Multi-transport support (Doctrine, Redis, AMQP, fallback); browse without consuming (or fetch+requeue); retry failed messages; purge transport; reset queue. |
| Scheduled Tasks | List, run, deactivate; edit interval & next execution; register tasks. |
| State Machines | Diagram viewer for any registered state machine. |
| Log Viewer | Read var/log/*.log in the browser. |
| Feature Flags | Inspect and toggle flags from core/plugins. |
| Elasticsearch | Status, indices, reindex, alias switch, unused/orphaned cleanup, console. Optional show_all_indices. |
| Fastly | Purge all / by URL and basic stats when Fastly is configured. |
| Shopmon | Optional integration setup for external Shopmon monitoring. |
| Apps | External reachability of APP_URL checked by the Cloudflare Worker, Shopware account login status, current Shop App ID with password-confirmed reveal/copy, installed app list, and password-confirmed reset of the Shop App ID with uninstall of all apps. |
| Webhooks | Separate Admin module to create, search, and manage webhooks. |
The Apps reachability check uses the public Cloudflare Worker at https://app-url-check.fos.gg. The Worker calls the FroshTools probe on APP_URL and verifies a fresh challenge response.
On Shopware 6.6 / 6.7.13 the existing sw-version layout and health status dot are preserved. On Shopware 6.7.15 / trunk, warning or critical health replaces the sidebar Administration title with a badge that links to Tools, with the Shopware version beside it. The badge stays inside the header mt-text so the 40px row is not stretched. When healthy, the Administration title remains visible with a green status dot that links to Tools.
| Command | Purpose |
|---|---|
frosh:dev:robots-txt |
Block crawlers on test shops (-r to revert) |
frosh:composer-plugin:update |
Update Composer-managed plugins |
frosh:monitor <sales-channel-id> |
Email alert when queues/tasks exceed grace times |
frosh:es:delete-unused-indices |
Delete unused Elasticsearch indices |
frosh:extension:checksum:check [name] |
Verify extension file integrity |
frosh:extension:checksum:create [name] |
Create extension checksum manifests |
frosh:redis-namespace:list |
List Redis namespaces (experimental) |
frosh:redis-namespace:cleanup |
Clean Redis namespaces (--dry-run supported) (experimental) |
frosh:redis-tag:cleanup |
Clean Redis tags |
frosh:twig:warmup |
Warm Twig template cache |
frosh-tools:health-check-json |
Print merged health-check results as JSON (CI / monitoring) |
frosh-tools:data-integrity-check-json |
Print data integrity check results as JSON |
-
Shopware 6.6 or 6.7
-
PHP version required by your Shopware minor
-
Admin ACL privileges under Settings → Users & permissions (Viewer / Editor per area):
- Frosh Tools — system status, statistics, feature flags, state machines. Editor grants every Tools write privilege (and pulls in the other viewers).
- Cache / Queue / Scheduled tasks / Search indices / Security / Fastly / Shopmon / Apps — Viewer to open the tab, Editor for mutations (clear cache, retry/purge, run tasks, reindex, restore files, purge CDN, setup integration, reset Shop App ID).
- Logs — Viewer only (production log contents).
- Webhook privileges remain a separate CRUD row.
Existing roles that only had
frosh_tools:readkeep the overview tabs; re-open the role and tick the area viewers/editors they should keep. Super-admin is unchanged.
composer require frosh/tools
bin/console plugin:refresh
bin/console plugin:install --activate FroshTools
bin/console cache:clearcomposer require store.shopware.com/froshtools
bin/console plugin:refresh
bin/console plugin:install --activate FroshTools
bin/console cache:clearStore installs need a valid
packages.shopware.comComposer auth token.
git clone https://github.com/FriendsOfShopware/FroshTools.git custom/plugins/FroshTools
shopware-cli extension prepare custom/plugins/FroshTools
shopware-cli extension build custom/plugins/FroshTools
bin/console plugin:refresh
bin/console plugin:install --activate FroshTools
bin/console cache:clearAfter activation, open Settings → Plugins → Tools (or search for “Tools” in the Admin).
Optional Symfony config — create config/packages/frosh_tools.yaml:
frosh_tools:
# Skip specific health/performance checkers by id (when needed)
checker:
disabled_checks: []
# Paths that File Checker should not offer to restore
file_checker:
exclude_files:
- vendor/shopware/core/FirstFile.php
- vendor/shopware/core/SecondFile.php
# Elasticsearch manager: list every index instead of only Shopware prefixes
elasticsearch:
show_all_indices: false
# Administration "forgot password" flow (backport of shopware.api.user_recovery.enabled).
# It is generally recommended to disable it and reset passwords via
# "bin/console user:change-password" when needed. Also useful when passwords
# are managed externally, e.g. via SSO.
user_recovery:
enabled: truePlugin system config (Admin → Extensions → Frosh Tools):
- Monitor mail address — recipient for
frosh:monitor - Default queue grace time (minutes) — when a pending message is considered stuck
- Exclude failed queues — ignore transports whose name contains
failed(default on) - Queues to monitor — optional allowlist, e.g.
async, low_priority - Per-queue grace times — optional overrides, e.g.
async:15, low_priority:60 - Task grace time (minutes) — when a scheduled task is considered stuck
JSON Schema for IDE validation: frosh-tools-schema.json.
# Human-oriented mail alert (cron)
bin/console frosh:monitor <sales-channel-id>
# Machine-readable health snapshot
bin/console frosh-tools:health-check-json
# Machine-readable data integrity snapshot
bin/console frosh-tools:data-integrity-check-jsonWire the JSON command into uptime checks, deploy gates, or external monitors. The Security Center Export SBOM action produces a CycloneDX 1.7 document suitable for dependency scanners.
# Format / static checks via shopware-cli (Docker)
composer format
composer check
# PHPUnit (from a Shopware project that requires this plugin)
composer phpunit
# Administration unit tests (Shopware 6.6, 6.7, and trunk)
# Requires the Administration source + its node_modules; see
# https://github.com/FriendsOfShopware/vitest-shopware-admin-bridge
cd src/Resources/app/administration
npm ci
npm run test:unit:doctor
npm run test:unitAdmin sources live under src/Resources/app/administration. Rebuild with:
shopware-cli extension build custom/plugins/FroshTools
# or, from the Shopware root:
bin/build-administration.sh- GitHub Issues — bugs & feature requests
- FriendsOfShopware
- Shopware Store listing (search “Frosh Tools”)
- Maintainer: Soner Sayakci (@shyim)