Something is doing it. Find out what.

Deactivating tells you that a plugin is involved. It does not tell you what that plugin did, and it costs you a broken site in front of live visitors for as long as the test runs. This never deactivates anything. It watches the site work normally and records who did what, so at the end you have a plugin name, a file, a line number, and the before and after value it changed. On a site where the problem only happens on upload, or only for logged-in users, or only once a day on cron, bisection can take days of appointments. This takes one reproduction.

Only while an investigation is running, and only for the request types you scoped it to. The rest of the time the plugin reads one option WordPress has already loaded into memory and returns. There is no background scanning, no cron sweep and no always-on logging. Every investigation also expires by itself — fifteen minutes by default, two hours at the absolute maximum — so a site cannot be left recording because somebody forgot.

It observes and never intervenes. No plugin is deactivated, no setting is changed, no output is altered and visitors see exactly what they saw before. That is the whole design brief: the tools that find conflicts by switching things off cannot be run at 2pm on a Tuesday on a shop that is taking orders. This can.

Hook callbacks, and here it does something more useful than listing subscribers: it measures whether each callback actually changed the value passing through it, so you can tell the plugin that is merely listening from the plugin that is responsible. Alongside that it records every file written, renamed or deleted in your uploads folder with the line of code that did it, every outbound HTTP request, every email, every option write, the scheduled jobs each plugin owns, and slow database queries traced back to the plugin that ran them.

Because it would rather say so than guess. Image editors built on Imagick write files through their own C library, which never touches PHP, so no PHP tool can see the write happen. Rather than pretend, the report lists the files that appeared with nothing claiming responsibility, and separately names any plugin that replaced the image editor — which is almost always your answer. The same honest gap covers WP-CLI, system cron and anything happening at server or CDN level.

A small loader that starts recording before your other plugins load, because a plugin can do things while it is still loading and nothing that starts later can see them. It does nothing at all unless an investigation is running. You can remove it from the settings screen whenever you like and the plugin carries on working — it just starts watching a little later in the request.

That is what the branded report is for. Put your agency name, logo, brand colour and a footer note in once, and every investigation becomes a print-ready A4 document: what was investigated, what was found, the confidence level, the recommendation, and the code location behind each finding. Download it as a PDF or email it straight from the admin with the PDF attached. The PDF engine ships with the plugin, so there is nothing to install.

How strongly the evidence supports that specific conclusion, and it is deliberately not always 100. A plugin returning "image/avif" from the WordPress filter whose only purpose is choosing the output format is a confession, and scores in the mid-nineties. A plugin that merely appears somewhere in a stack trace is not, and scores far lower. Findings are ranked so the strongest sits at the top, and every one lists the events behind it so you can check the reasoning rather than take it on trust.

No, and it is switched off until you decide otherwise. Every verdict on this page is produced on your own server by rules, with no external service involved. If you want a plain-language second opinion you can add an Anthropic key, and even then nothing is sent until you press the button on a specific case — and you see the exact payload first, with your site URL, email addresses, server paths and anything key-shaped already stripped out of it.

A profiler shows you what happened. This tells you who caused it. Query Monitor is superb at showing that a hook fired and a query ran, but it leaves you to work out which of your thirty plugins is behind it. Plugin Detective starts from the plugin: it resolves every callback and every file write back to the plugin that owns the code, then reasons over that evidence and states a conclusion in a sentence you could read out to a client.

Free is the whole detective: every investigation type, the full request timeline, the hook inventory and the findings with their confidence and evidence. The part that catches culprits is not the part we hold back. Pro adds the client-facing layer — branded reports, PDF download, emailing the report, Markdown export — and the optional AI second opinion.

Order through the form and your licence key and invoice arrive by email, usually within the hour. Keys are long codes starting VPC1. so paste the whole thing into the licence box rather than typing it. Domain-based, no account, no phoning home, no lock-in.

14-day money-back guarantee, no questions. Email us and we refund you.