Pragati Tech Services

You are here: Home / Archives for Sachin

Sachin

From WooCommerce to Shopify in a Month

· ·

We moved showbags.com.au from WooCommerce to Shopify in under a month, and the store went live in August 2026. Showbags is a family-run Australian retailer of novelty showbags, party bags and confectionery, backed by Bensons Trading and has a loyal Instagram following.

This was never a simple migration. The store runs on Microsoft Dynamics 365 Business Central, so stock, pricing, discounts, orders and tracking all had to flow cleanly between Shopify and the ERP from day one. Customers also expected their order history, wishlists and back-in-stock requests to still be there when they logged in.

Here is how we did it, and what we would tell any business planning the same move.

Why leave WooCommerce

The biggest single saving was hosting. Showbags was running on WP Engine’s P2 plan, a premium managed tier needed to keep a large-catalogue WooCommerce store fast under seasonal traffic. Shopify includes hosting, security, SSL and scaling in the subscription, so that bill disappeared entirely.

The less visible cost was maintenance. Plugin updates, PHP upgrades and compatibility testing took time every month. On Shopify that work shrinks to managing apps and the theme, which we keep in a GitHub repository so every change is versioned and reversible.

Business Central stays the single source of truth

We set up the Shopify and Business Central integration so the team keeps working in BC and Shopify simply reflects it. Nobody re-keys a price, a stock level or a tracking number.

DataDirectionWhere it comes from in BC
InventoryBC → ShopifyStock held at the online-fulfilment location, not the whole business
Regular pricesBC → ShopifyThe retail price list
Sale pricesBC → ShopifyA dedicated discount price list, written to Shopify’s Compare-at price
OrdersShopify → BCEvery web order lands in BC as a sales order
TrackingBC → ShopifyShipment tracking flows back, and Shopify emails the customer

Syncing inventory by location matters for a business like Bensons Trading, where most volume is wholesale. Online shoppers only ever see stock that is actually available to ship to them.

Shopify Flow runs the merchandising

On WooCommerce, keeping the Sale, New and Coming Soon pages accurate was manual work that was easy to forget. We rebuilt all three with Shopify Flow so they maintain themselves.

Sale page. When a discount price arrives from BC’s discount price list, Flow adds the product to an automated Sale collection. When the discount ends, it drops off. The Sale page is always exactly what is on sale, nothing more.

Coming Soon to New. Products created before stock arrives go onto Coming Soon automatically. The moment BC reports stock, Flow moves them from Coming Soon to New.

New expires on its own. Two months after a product lands in New, Flow removes it. The New page stays genuinely new without anyone keeping a calendar.

The result is a storefront the client’s team never has to tidy. They receive stock and set prices in BC, and the website follows.

Customers kept their history

A returning customer should not notice the platform changed. We imported every past WooCommerce order, so customers can still see what they bought and the team can still look up old orders in one place.

We also brought across wishlists and waiting lists. People who had saved products or asked to be notified when something came back in stock kept those requests, and the back-in-stock notifications carried on after launch.

We spot made several migration tools (Thanks Claude) to handle the bulk of the product and customer data and handled things such as WooCommerce categories becoming Shopify collections, sale prices mapping to Compare-at price, and short descriptions moving to metafields etc.

SEO rankings survived the move

Shopify uses a fixed URL structure, so every WooCommerce address changes. A product at /product/ninja-showbag becomes /products/ninja-showbag, and a category becomes a collection. Without redirects, years of Google rankings and backlinks would point at 404 pages.

We built a full 301 redirect map covering products, nearly 200 category and collection URLs, and the store’s content pages. Each old URL was checked against the live WooCommerce sitemap before it went in, and the map was implemented alongside the client’s SEO agency.

We also fixed the Open Graph tags on the new store, so product links shared on Instagram and Facebook show the right image, title and type.

What we learned along the way

  • Don’t trust a green tick in Flow. Flow’s Send internal email action only reliably reaches registered staff accounts. Sent to a shared support inbox, it reported success and delivered nothing.
  • Pick the theme on evidence. We trialled several premium themes, then launched on a customised version of Shopify’s own Dawn theme. It was faster to build on, and it keeps updating with Shopify.
  • Shipping is its own project. We built a bulk export into Australia Post Parcel Send, so the warehouse can lodge a day’s orders in one step instead of one at a time.
  • Check plan features, not just fees. Upgrading a Shopify plan rarely pays for itself through card-fee savings alone. Features such as live carrier-calculated shipping are the real reason to move up.

The result

  • Live on Shopify in under a month, with no break in trading
  • Premium WP Engine hosting cost removed entirely
  • Stock, prices, discounts, orders and tracking synced with Business Central, with no double entry
  • Sale, New and Coming Soon pages that run themselves
  • Full order history, wishlists and waiting lists preserved
  • Search rankings protected with a complete 301 redirect map

The store is also ready for what comes next. Shopify now offers native B2B features on standard plans, which opens a path to serving Bensons Trading’s wholesale and fundraising customers from the same platform.

Planning your own move?

Pragati Tech Services is a boutique agency that helps SMEs in Australia and the UK move from WooCommerce to Shopify, and connect their store properly to Microsoft Dynamics 365 Business Central. If your store is outgrowing WordPress, or your team is re-keying data between the website and the ERP, talk to us. Also since we are a registered Shopify Partner, you don’t need to pay until your store goes live as we can keep working on a Dev store which we transfer to you once ready to go live and then you can choose a plan and start paying to Shopify directly.

Microsoft calls it a trojan. It’s still in the Chrome Web Store.

· ·

In August, Microsoft Defender flagged two trojans on a colleague’s laptop. Both were inside one Chrome extension — an AI sidebar offering ChatGPT, Claude and DeepSeek beside whatever page you’re reading.

Trojan:JS/ChatGPTStealer.GVA!MTB
Trojan:Win32/Qwexlafiba!rfn
  extension ID  fnmihdojmnkclgjpcoonokmkhjpjechg

She installed it in June 2024 from the official Chrome Web Store. It had a Featured badge and four stars from thousands of reviews.

It is still there. 400,000 users. Updated three days after Defender flagged it. The listing still says the developer will not collect or use your data. (I’m linking the listing so you can verify that claim, not so you can install it. If that link is dead by the time you read this, good.)

Nobody blinked at the permissions, and they were right not to

host_permissions:  <all_urls>        read and change every page you visit
content_scripts:   <all_urls>
permissions:       storage, scripting

That’s alarming written down and completely unremarkable in context — an AI sidebar genuinely needs it. It can’t summarise the page without reading the page. For this category, the permission that enables total compromise is indistinguishable from the permission that enables the feature. There is no anomaly to spot and no prompt a careful user should refuse.

Google has known since January

LayerX, OX Security, Malwarebytes and Microsoft have all published on this family — sixteen or more extensions sharing a codebase, impersonating real AI assistants, harvesting session tokens. Microsoft’s own threat entry for the detection has been public since January.

Above links document these extensions taking AI conversations, tab URLs and ChatGPT account tokens. They do not document them reaching unrelated sites. But that’s what happened with one of our sites. They lifted our hosting credentials, logged-in, created a SFTP user, then installed files and finally injected JS into our website which started showing a fake pop-up to our visitors about a ‘Chrome Update‘, unsuspecting visitors if not careful, would be installing a malware being distributed using our site as distribution channel. When we found it out, we did fix it but it was a really scary experience.

There were probably multiple bad actors involved in all this and someone was responsible for lifting our session token, someone else used it to probably create SFTP users on our hosting panel and maybe someone else wanted to distribute the malware using our website. This was a chain of events and actions. In these extensions, permissions aren’t scoped to AI sites, and nothing in the browser makes them so. <all_urls> with content scripts on every page means read access to your webmail, your hosting panel, your bank — the same access, the same session, no additional prompt.

I reported it. The Chrome Web Store’s report form offers six radio buttons and no field for a detection name, a hash or a C2 domain. It’s product feedback, not abuse reporting.

And the shipping version isn’t detected. On one machine, Defender blocked reads on the older Edge copy while the newer Chrome copy hashed cleanly:

SHA256 — v2.0.6, undetected at time of writing
  blueBackground.js   CF4991C1AD1F96244E082091052FC8748C64DCD6ECC4D6E32909F3E33A6C51E7
  setup.html          7B9608084F09550E75E11713AC17CF2EE8FC5B7376160EFA618C089DC55B9BE9

Infrastructure referenced in the extension code
  a.gapier.com                          both versions
  chatgptextension.ai                   both versions
  costgoat.com                          v2.0.6
  agent-marketplace-ot2s.onrender.com   v2.0.6
  chatgptsidebar.pro                    v1.9.6

Probably not negligence: the malicious behavior is server-controlled, so a reviewer installing it sees a working sidebar behaving perfectly. But the consequence stands — a Featured badge (gone now) and 400,000 users tell you nothing.

Five ordinary decisions

An extension like this doesn’t cause a breach by itself. It combines with things nobody considers a problem.

  1. An extension reads every page. Necessary for AI assistants. Granted once, at install.
  2. Web apps hand tokens to the browser. Run Object.keys(sessionStorage) on your control panel. On a lot of platforms there’s an access token in there. There is no HttpOnly for web storage — every script in that origin can read it. This is common enough that the IETF published RFC 10017 this year recommending tokens never reach the browser at all.
  3. Authenticated consoles load third-party scripts. Analytics, chat, session recorders, ad pixels. I counted a dozen suppliers inside one hosting panel, each with the same access as any extension.
  4. Passwords get shared in chat tools. And stay there permanently.
  5. One-time codes get forwarded to the team. So the password and its second factor arrive in the same inbox.

Chaining used to be the expensive part

An extension like this doesn’t cause a breach by itself. It combines with things nobody considers a problem — and combining things is exactly what’s getting cheaper using AI Agents.

This isn’t speculative. Anthropic has disclosed a China-nexus actor that used its own agentic coding tool to run espionage operations against roughly thirty organisations, with 80–90% of the tactical work executed without a human in the loop — reconnaissance, vulnerability discovery, credential testing, exfiltration. It’s catalogued by MITRE ATT&CK as Campaign C0062. Palo Alto’s Unit 42 has separately demonstrated a multi-agent system chaining a four-stage attack from a single prompt, with no human intervention between pivots. The Cloud Security Alliance’s assessment is that automated exploit generation has crossed a threshold.

What you can do?

Well I don’t have a clear answer to be ready for these AI assisted breaches and all the bad actors using them to full extent, however below is what could help you against rogue extensions like the one mentioned here:

  • See what your extensions can already read. In your admin console’s developer tools:
    • document.cookie
    • Object.keys(localStorage)
    • Object.keys(sessionStorage)
      Anything returned is readable by every extension you have installed. If a session token is in that list, any extension can be you — no password, no second factor, no login event.
  • Set site access to “on click.” chrome://extensions → Details → Site access. Built in, free, almost nobody uses it. An AI sidebar works fine this way; it just can’t sit on your admin panel.
  • Audit by ID, not name. Names change — this one shipped under two. IDs don’t.
  • If you run a team, set an allowlist. Chrome Browser Cloud Management is free with Google Workspace. An afternoon’s work.
  • And stop sharing passwords in chat, and stop forwarding one-time codes. If both land in the same inbox, you have one factor with extra steps.

Extension indicators published so others can check their own estates. Platform findings reported to the vendors concerned and withheld pending response.

Unlayer Studio Shutting Down June 30, 2026 — Here’s How to Save All Your Campaigns

· ·

If you’re an Unlayer Studio user, you’ve probably received the email. Studio is retiring on June 30, 2026. All subscriptions end. No renewals. The editor goes dark.

For many teams this is manageable — if you have a handful of templates, Unlayer’s built-in HTML export works fine, and rebuilding a few designs in Klaviyo or Mailchimp takes an afternoon. Unlayer’s templates section also allows JSON export directly, so if your library is small, you may already have everything you need.

But if your team has built up a large campaign library over months or years — and your entire workflow depends on duplicating and editing those campaigns — the situation is different. You’re not rebuilding three templates. You’re looking at hundreds of campaigns, years of brand work, and a design workflow that disappears overnight.

We’ve been through this with a client who had 608 campaigns built up over two years. Here’s what we found, what we built, and how we can help teams in the same position.

What Are Your Options?

The first thing every Studio user does is click the “Download Designs & Assets” button in the yellow shutdown banner. Here’s the problem: it takes you to the Templates page, not Campaigns.

The second option people try is exporting individual HTML files one by one. That works — but HTML export is a one-way door. You get a static file you can send via Klaviyo or Mailchimp, but you lose all editability. You can’t open that HTML back up in a drag-and-drop editor and make changes.

What you actually need is the design JSON — Unlayer’s internal format that powers the drag-and-drop editor. With that, you can open any campaign in an Unlayer-based editor and edit it exactly as you did in Studio.

What We Built

After some investigation, we discovered that Unlayer Studio uses a GraphQL API to load campaign data — including the full design JSON for every campaign. We built a tool that:

  1. Connects to your Studio account using your existing login session
  2. Extracts all campaigns — not just templates, but every campaign in your library — with complete design JSON intact
  3. Downloads all your images from Unlayer’s CDN before they go offline
  4. Sets you up with a working campaign manager built on Unlayer Embed, where you can continue to create, duplicate, edit, and export HTML campaigns exactly as you did in Studio

For our client, that meant 608 campaigns extracted with zero failures, images downloaded, and a working replacement app running — all before the June 30 deadline.

The Replacement App

The campaign manager we built is a clean, browser-based tool powered by Unlayer Embed — the same drag-and-drop editor engine that powered Studio. Your muscle memory transfers directly.

What it does:

  • Sidebar with all your campaigns, searchable and sorted by last edited
  • Full Unlayer drag-and-drop editor — same blocks, same experience
  • Duplicate, edit, save — the exact workflow you’re used to
  • Export HTML — ready to paste into Klaviyo, Mailchimp, or any ESP
  • Bulk import — load all your extracted campaigns in one shot
  • Local folder storage — campaigns save as individual JSON files on your own computer or server. No size limits, no browser storage cap, no lock-in

Your campaigns, your files, your control.

What About Images?

This is the part that catches most people out. When Studio shuts down, the images hosted on Unlayer’s CDN (assets.unlayer.com) will stop loading — not just in the editor, but in emails you’ve already sent too.

Unlayer’s own shutdown notice says: “After June 30, all Unlayer-hosted images and assets will stop loading — including in emails you’ve already sent.”

As part of our migration service, we download all your images and re-host them on your own domain (typically your existing WordPress media library or an S3 bucket). Every campaign JSON file is then updated to point to the new URLs. Your campaigns continue to display correctly in both the editor and in live emails.

Who This Is For

This service is for Unlayer Studio users who:

  • Have a library of campaigns they need to preserve and keep editing
  • Are running Klaviyo, Mailchimp, or another ESP and need to keep exporting HTML
  • Don’t want to rebuild everything from scratch in a new tool
  • Want their campaigns and images safely backed up before June 30

It doesn’t matter how many campaigns you have. We’ve handled 608 in a single session — the process is fully automated.

What We Offer

This service is specifically for teams with large campaign libraries who need everything preserved and working before June 30 and includes campaign extraction, image download and re-hosting on your domain, and the campaign manager app set up and ready to use.

If you only have a small number of templates to migrate, we’re happy to point you toward the free options — just get in touch and we’ll give you an honest answer on whether you actually need us.

Get in touch at info@pragatitech.com or visit pragatitech.com/contact to discuss your situation. We’ll give you a straight answer on what’s involved and what it costs.

The June 30 Deadline Is Real

Unlayer has been clear: no extensions, no renewals, no free tier to fall back on after the shutdown date. Every day you wait is a day closer to losing access to your campaign library permanently.

The image bandwidth issue is also real — Unlayer’s CDN has already started hitting limits for some projects, causing images to fail before the shutdown date even arrives.

If you’re on Studio, now is the time to act.

A Note on Unlayer Studio Alternatives

For most Studio users, we recommend Beefree as the destination after migration.

Here’s why it’s the closest thing to a Studio replacement:

  • Free plan includes mobile design mode 
  • Professional plan is $25/month 
  • Built-in image hosting 
  • Beefree can convert your Unlayer JSON files — their migration team will take the JSON files we extract and convert them to fully editable Beefree designs

Topol PRO is a good email builder too and a reasonable long-term replacement for Studio. But it doesn’t solve the immediate problem: your existing campaign library. Topol has no way to import your Unlayer campaigns as editable designs — you’d be starting from scratch. If you have 10 templates, that’s an afternoon. If you have 100+ campaigns, that’s weeks of work, and you lose years of design history permanently.

If you’re looking to move to a native ESP builder rather than maintain a separate design tool, the honest answer is: Klaviyo and Mailchimp both have solid built-in email builders with image hosting included. If your team is already living in those platforms, rebuilding your key templates there is a reasonable option.

The catch is that imported HTML is static in both platforms — you lose drag-and-drop editability. And rebuilding 600 campaigns is not a realistic afternoon project.

Our recommendation: extract and preserve everything now, then migrate forward at your own pace with full access to your original designs.

Pragati Tech Services is a boutique IT agency based in Nagpur, India, specialising in business process solutions for SMEs. We work with clients in Australia, the UK, and beyond.

Contact us at pragatitech.com/contact

Fixing data in WooCommerce Analytics

· ·

No Orders! What?

Yesterday morning I woke up to a text message from our client, saying they don’t see any orders in WooCommerce Analytics. This got me worried about site going down or something bad happening which must have led to no orders being received since we finished work day before. I quickly login and check Orders in WordPress Admin and I am relieved to see that website is working fine and we are getting orders consistently. However we had the problem of that data not being reflected in the WooCommerce Analytics, which just showed 0 orders and 0 revenue for the day.

Management relies on WooCommerce Analytics to keep track on online sales so we needed to fix it quickly. Analytics data can’t be calculated in real-time for performance reasons so it’s handled in background using ‘Action Scheduler’, so I check pending actions at WooCommerce > Status > Scheduled Actions and see thousands of pending actions there. Most of these were Mailchimp actions. Somehow all these actions have piled up and since Analytics Data actions are stuck in the queue, they aren’t being processed and instead are waiting for their turn. Now these thousands of actions won’t be processed normally obviously so I had to process them myself.

Action Scheduler

Action Scheduler is a modern replacement for WP-Cron and has an interface in the WP-Admin, so you can always see which tasks got executed, failed or still pending. If you are a plugin developer and need to execute some actions in background, you should definitely use Action Scheduler instead of WP-Cron and if you are using WP-Cron already, it does make sense to migrate to Action Scheduler as this plugin did.

Solution

Thankfully I have WP-CLI to rescue so the first command I run there is:

> wp action-scheduler run --group="wc-admin-data" --force

This executes all the pending actions for analytics data and now Analytics starts showing correct Order count and revenue.

However this only refreshes the figures till now and doesn’t ensure that it will keep refreshing it automatically every few minutes as it should. I had to get rid of all the pending actions obviously. Ofcourse fast and dirty approach would have been to just delete all the pending actions, but it wasn’t a good idea in my opinion as those actions needed to run. So I decide to run Mailchimp actions as well in WP-CLI so I run:

wp action-scheduler run --hook="MailChimp_WooCommerce_Single_Order" --force

Now I come back to WordPress Admin and check the ‘Scheduled Actions’ again, I can now see the pending actions going down slowly. However it was still going to take a long time. So I decide to run another queue in parallel. Again this is possible because I have access to WP-CLI. I just run the above command again. Now it doubles the speed at which pending actions are being run. I don’t take chance to run more queues at this point of time as it could have overwhelmed the server. I let them run and after a few hours all the pending actions have been executed and Analytics data is being generated automatically as it should.

WP-CLI

WP-CLI or WordPress Command-Line Interface lets you do tasks like updating plugins, installing themes on your terminal so it’s a much faster way to do things which you normally do using WordPress Admin.

What caused this?

Ok so anytime you see lots of pending actions in ‘Scheduled Actions’ tab, you will probably find your analytics isn’t working properly. If you server goes down for sometime or if you migrate the server, that could cause this. However in our case it was a silly reason. We need to connect Mailchimp plugin to our Mailchimp account, this enables us to monitor which mail campaign by marketing team is resulting in orders. We had re-connected the Mailchimp a few days ago after realising that it had got disconnected, but in the meanwhile lots of Mailchimp actions couldn’t run and led to this pile of actions. So something like that can also cause this and may not be that obvious to notice at times.

Hope you found this little post helpful and if you are looking for a reliable, prompt and communicative web-agency to create your next e-commerce website or maintain your existing website, you know who to hire, right?

Overhauling IT Education in India

· ·

I feel that level of IT education is really pathetic in our country (except in maybe top 20% colleges like IITs and NITs). It may seem funny coming from a non-graduate like me, but running my own software company for over 10 years gave me enough exposure and interaction with programmers coming out of colleges and also teachers teaching them. I visited colleges often to give seminar, workshops etc.

I have observed that in most technical fields, everybody first wants to join a great company and earn big bucks. Engineers, MCAs want to join Microsoft, Google, TCS, Infosys when they come out of college. Students who are not selected by big companies, try to get job with small software companies and students who don’t get job with any software company end up finally applying for teaching positions with colleges. So basically we have failed programmers teaching programmers of future.

How can we expect this system to work? We need to change the system at many levels. Here are my thoughts in brief:

  1. We need to attract good bright people to become teachers.
  2. We need to partner with Software companies and involve working professionals to teach in colleges part-time or over the weekend.
  3. We need to make competitive coding contests compulsory to attend. Google Code Jam happens once every year. Should be mandatory for every IT engineering and MCA student.
  4. Every student should participate on challenges on websites such as HackerEarth, Codechef, Topcoder etc.
  5. Many courses from Harvard, Stanford etc. are available online and even free in many cases. May be they can be taught as it is to whole class-room with teacher just acting as facilitators.
  6. MCA is a Master’s program, but it’s considered inferior to engineering which is a Graduation program. It needs to be improved with greater stress on industrial training which is part of 6th Sem.
  7. Colleges should open incubation centers and encourage their students to become entrepreneurs. Maybe college can even have a stake in the formed company. Not all such startups will succeed, but even if a few do, govt. will easily make up the investment in other failed companies.
  8. Teachers normally don’t upgrade themselves with the time. They should be regularly asked to take courses and appear for exams themselves to keep improving.
  9. IT Teachers should also be allowed to pursue some programming related profession. Not teaching or private coaching business, but some real programming with some software company or independent programming work. It’s allowed for Architects and Doctors as they are quite practical intensive fields. It should be done for the IT teachers as well.
  10. Students should be made aware about open-source resources such as Github and made to participate in resources like StackOverFlow
  11. New and Emerging programming languages/ frameworks should be included in the curriculum — Ruby on Rails, Python, Node.js & of course Swift

Update: 27th May 2015 — Google has just published it’s own guide if you are looking at a Career in Software for yourself.

If given a chance, I would love to talk to Colleges and even Government in detail and explore how can we work along these lines and overhaul the IT education scenario in the country. Looking forward to hear thoughts from readers of this blog.