Tools

Tools

by Friends of Shopware


Centralize Shopware 6 maintenance and diagnostics with tools for system status, cache, tasks, queues, logs, and search index management in the Administration.

This plugin is compatible with the following Shopware 6 versions:

6.6 6.7
  • Future updates
  • MIT license

Frosh Tools is the official open-source extension developed by the Friends of Shopware community. It enhances the Shopware Administration with a robust suite of tools for system diagnostics, maintenance, and day-to-day store management.

This plugin consolidates various functions that typically require server-level or database access into a user-friendly interface within the backend. It significantly reduces troubleshooting time and optimizes workflows for both administrators and developers.

Key Features at a Glance

  • System Health Check: Instantly verify critical server parameters and Shopware components.
  • Advanced Cache Manager: Clear specific caches and compile themes directly from the dashboard.
  • Task Management: Monitor and manually trigger Scheduled Tasks or adjust execution intervals.
  • Queue Monitoring: Gain insights into the message queue and background process status.
  • Elasticsearch & OpenSearch: Specialized tools for index management, status queries, and console functions.
  • Integrated Log Viewer: Easily browse and analyze Shopware log files within your browser.
  • File Integrity Check: Verify Shopware core files to detect unauthorized or accidental modifications.
  • State Machine Visualization: Graphical overview of order, payment, and delivery state transitions.

Frosh Tools provides developers and agencies with an essential toolkit to manage Shopware installations more efficiently and identify configuration or performance issues before they impact the store.

Open Source and License Notice

This plugin is based on the open-source project Frosh Tools by Friends of Shopware and is distributed through our platform. Unless stated otherwise, this plugin is provided under the terms of the MIT License. The original copyright notice and the full license text are included in the plugin package.

Copyright (c) Friends of Shopware

The software is provided “as is”, without warranty of any kind, to the extent permitted by applicable law. The terms of the MIT License shall prevail. You can find the full license text in the plugin package and at: https://github.com/FriendsOfShopware/FroshTools/blob/main/LICENSE.md.

Source: Github Repository


Changelogs

Queue message browsing now shows when messages were queued, and operators can keep selected checks visible as informational findings with a documented reason. This release also corrects OPcache statistics under FrankenPHP.

Added

  • Queue messages display their queued-at time where the transport provides it: Redis stream IDs, AMQP message timestamps, or Doctrine created_at values. #517 (@vanWittlaer)
  • Configure frosh_tools.checker.acknowledged_checks as a map of check IDs to required reasons to keep health, performance, data-integrity, and security findings visible as info without counting them as open errors or warnings. disabled_checks still hides a check, including one that is also acknowledged. #512 (@Aragon33)

Fixed

  • OPcache memory and wasted-percentage statistics now use the configured memory limit when available, avoiding invalid values in FrankenPHP worker threads. #518 (@tinect)

The Shopmon integration role now includes additional default ACL permissions required for language and locale reads and log-entry creation.

Fixed

  • Added the missing default permissions to the Shopmon integration role. #516 (@M-arcus)

Shopmon setup credentials are now shown only when an integration is created, and the product health check no longer flags a main product that uses a variant’s cover.

Fixed

  • The invalid product-cover check now accepts a main product cover that references media assigned to one of its variants. #513 (@M-arcus)

Changed

  • Shopmon credentials and the quick setup code are returned and displayed only once, immediately after creating an integration. Existing integrations remain valid, but their credentials are not recoverable from FroshTools; to get a new setup code, remove and recreate the integration, then reconnect Shopmon. The update also deletes previously stored credential copies from FroshTools and FroshShopmon configuration. #514 (@shyim)

Data integrity checks now report actionable duplicate-customer details and identify products without a usable visible category, while avoiding several false positives. The Administration also improves accessibility across FroshTools pages, controls, dialogs, and task actions.

Added

  • Added a data integrity check for active products visible in a sales channel but lacking an active, visible category in that channel. It reports the issue on the product holding the category assignments; categories surfaced only through dynamic product groups are not considered. #510 (@M-arcus)
  • Duplicate customer email results now list the other affected customer accounts, making it easier to identify which records share an address. #510 (@M-arcus)

Fixed

  • Improved data integrity results: guest accounts are excluded from invalid default-address checks, inactive duplicate-option variants are ignored, and covers pointing to another product's media are not flagged when that same image is among the product's own media. Number-range checks now distinguish core-resolved types from extension types that are not assigned per sales channel. #510 (@M-arcus)
  • Improved Administration accessibility with labeled native selectors, named dialogs and actions, corrected heading and landmark semantics, and focus restoration after task menus close. Controls also fit narrow panels, and clearing security activity filters resets actor search. #506 (@shyim)

Breaking Changes

  • ft-button now defaults to type="button" to avoid unintended form submissions. Set type="submit" explicitly for buttons intended to submit forms. #506 (@shyim)

New Contributors

  • @M-arcus made their first contribution in #510.

Shopmon integrations can now retrieve queue statistics, and recommendation code in the Administration no longer includes unwanted surrounding whitespace.

Fixed

  • Added message_queue_stats:read to the Shopmon integration role, fixing authorization failures when Shopmon requests queue statistics. Existing integrations receive the permission when the role is refreshed on plugin update. #508 (@mbortkiewicz-crehler)
  • Removed unwanted whitespace around recommendation code displayed in the Administration. #507 (@lacknere)

No user-facing changes in this release.

Shopware Tools 3.17.0 makes data integrity findings easier to investigate by listing affected records in the Administration, and adds an API inventory of accounts and roles that can access the Admin API. It also improves Administration text readability by using the module’s base font size and Shopware’s font family.

Added

  • Data integrity check Info dialogs now show affected records in paginated lists with links to their Administration pages. Checks can supply these records through the new AffectedEntitiesProviderInterface; entities without a known Administration page are listed by ID, and the corresponding {entity}:read privilege is required to query records. The release also adds a duplicate-rules check and corrects payment and shipping method checks to exclude product-comparison sales channels. #501 (@M-arcus)
  • GET /api/_action/frosh-tools/security/accounts returns a snapshot of admin users, integrations, and ACL roles for external monitoring. It includes security-relevant metadata and hashed role privileges, but excludes usernames, names, and credentials; email addresses are masked. The endpoint requires frosh_tools_security:read. #495 (@pumpi)

Fixed

  • Administration text that was rendered too small now inherits the module’s base font size; the module also uses the Administration’s font family. #502 (@tinect)

Shopware Tools 3.16.0 adds a persistent Security activity timeline, refreshes the Administration navigation and task pages, and improves queue health checks and Shopmon integration setup.

Added

  • Security → Timeline records sign-ins, account and role changes, integration and API-key changes, password recovery, and available extension lifecycle events. Filter by actor, action, client IP, and UTC date; inspect event details and export all matching entries as JSON. Retention defaults to 90 days and is configurable from 1–3650 days with frosh_tools.security_activity.retention_days. Access uses the existing frosh_tools_security:read privilege. Existing logs are not imported. #477, #496, #497
  • Shopmon integration setup can be automated by setting both SHOPMON_ACCESS_KEY and SHOPMON_ACCESS_SECRET before installing or updating FroshTools; APP_URL supplies the shop URL. Existing FroshShopmon integrations and credentials are adopted without rotation. When uninstalling FroshShopmon, keep its user data to avoid deleting the adopted integration. #494

Changed

  • The Administration has a refreshed design and reorganized tools navigation, with focused subpages for Statistics, Apps, Search, and Fastly. Section URLs support deep links and browser history; restricted actions remain permission-aware. #487
  • Queue health checks now inspect configured transports rather than unrelated database rows. Empty queues no longer trigger stale-message warnings; known overdue messages still warn, and transports that cannot report message age show an informational result. #491

Fixed

  • SBOM generation strips URL credentials and query parameters from source references and omits distribution URLs, preventing credentials embedded in package URLs from appearing in the exported SBOM. Distribution hashes remain available. #500
  • Removed a redundant type check in the backward line reader. #493

Breaking Changes

  • The Security timeline creates a new activity table through the plugin migration. Uninstalling FroshTools without choosing keep user data drops that table. To retain activity history, keep user data when uninstalling.