Agency Edition: multi-site monitoring, read-only API keys and email alerts. All new features are off until you enable them.<\/p>","2.1.1":"
Security and quality patch. Upgrade recommended for all users on 2.1.0.<\/p>","2.0.0":"
Major feature release: Conflict Scanner, Safe Testing Mode, and Conflict Wizard.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3572689,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3572689,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3574302,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3574302,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.7.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3572694,"resolution":"1","location":"assets","locale":"","width":1280,"height":800},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3572694,"resolution":"2","location":"assets","locale":"","width":1280,"height":800},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3572694,"resolution":"3","location":"assets","locale":"","width":1280,"height":800},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3572694,"resolution":"4","location":"assets","locale":"","width":1280,"height":800},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3572694,"resolution":"5","location":"assets","locale":"","width":1280,"height":800},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3572694,"resolution":"6","location":"assets","locale":"","width":1280,"height":800},"screenshot-7.png":{"filename":"screenshot-7.png","revision":3572694,"resolution":"7","location":"assets","locale":"","width":1280,"height":800}},"screenshots":{"1":"Dashboard \u2014 live system overview: active plugins, stat cards, recent changes and the likely conflict culprit widget.","2":"Conflict Scanner \u2014 detected conflicts ranked by confidence score with one-click \"Mark Resolved\".","3":"Safe Testing Mode \u2014 amber active banner shows disabled-plugin count; toggle any plugin on\/off for your session only.","4":"Conflict Wizard \u2014 step-by-step diagnosis selects your symptom and produces a tailored action plan.","5":"Error Log Viewer \u2014 PHP errors parsed from debug.log and server error_log, attributed to the owning plugin with type filters.","6":"Change History \u2014 full audit trail of every plugin activation, deactivation, update, installation and deletion with timestamps.","7":"Health Scan \u2014 on-demand scan for duplicate functionality, outdated plugins, incompatibilities and server configuration issues."}},"plugin_section":[],"plugin_tags":[191246,94,93,1508,2391],"plugin_category":[59],"plugin_contributors":[266135],"plugin_business_model":[],"class_list":["post-322338","plugin","type-plugin","status-publish","hentry","plugin_tags-conflict","plugin_tags-debug","plugin_tags-errors","plugin_tags-health","plugin_tags-plugins","plugin_category-utilities-and-tools","plugin_contributors-mustafatahhan","plugin_committers-mustafatahhan"],"banners":{"banner":"https:\/\/ps.w.org\/tahhan-conflict-detective\/assets\/banner-772x250.png?rev=3574302","banner_2x":"https:\/\/ps.w.org\/tahhan-conflict-detective\/assets\/banner-1544x500.png?rev=3574302","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/tahhan-conflict-detective\/assets\/icon-128x128.png?rev=3572689","icon_2x":"https:\/\/ps.w.org\/tahhan-conflict-detective\/assets\/icon-256x256.png?rev=3572689","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/tahhan-conflict-detective\/assets\/screenshot-1.png?rev=3572694","caption":"Dashboard \u2014 live system overview: active plugins, stat cards, recent changes and the likely conflict culprit widget."},{"src":"https:\/\/ps.w.org\/tahhan-conflict-detective\/assets\/screenshot-2.png?rev=3572694","caption":"Conflict Scanner \u2014 detected conflicts ranked by confidence score with one-click \"Mark Resolved\"."},{"src":"https:\/\/ps.w.org\/tahhan-conflict-detective\/assets\/screenshot-3.png?rev=3572694","caption":"Safe Testing Mode \u2014 amber active banner shows disabled-plugin count; toggle any plugin on\/off for your session only."},{"src":"https:\/\/ps.w.org\/tahhan-conflict-detective\/assets\/screenshot-4.png?rev=3572694","caption":"Conflict Wizard \u2014 step-by-step diagnosis selects your symptom and produces a tailored action plan."},{"src":"https:\/\/ps.w.org\/tahhan-conflict-detective\/assets\/screenshot-5.png?rev=3572694","caption":"Error Log Viewer \u2014 PHP errors parsed from debug.log and server error_log, attributed to the owning plugin with type filters."},{"src":"https:\/\/ps.w.org\/tahhan-conflict-detective\/assets\/screenshot-6.png?rev=3572694","caption":"Change History \u2014 full audit trail of every plugin activation, deactivation, update, installation and deletion with timestamps."},{"src":"https:\/\/ps.w.org\/tahhan-conflict-detective\/assets\/screenshot-7.png?rev=3572694","caption":"Health Scan \u2014 on-demand scan for duplicate functionality, outdated plugins, incompatibilities and server configuration issues."}],"raw_content":"\n
\"Which plugin just broke my site?\"<\/strong> \u2014 answered automatically.<\/p>\n\n Existing tools show you that<\/em> an error occurred. Conflict Detective tells you which plugin caused it<\/em> by correlating the plugin change timeline with the error log \u2014 and gives you a confidence score.<\/p>\n\n Dashboard<\/strong>\nLive overview of your WordPress\/PHP version, active plugins, active theme, memory limit, debug mode, recent changes, and latest errors \u2014 all on one screen.<\/p>\n\n Error Log Viewer<\/strong>\nReads Change History<\/strong>\nFull audit trail of every plugin activation, deactivation, update, and deletion \u2014 with exact timestamps and version diffs (e.g. Health Scan<\/strong>\nOn-demand scan that detects:<\/p>\n\n Conflict Scanner<\/strong>\nAutomatically correlates plugin update timestamps with error spikes and reports a suspect plugin with a confidence percentage. Detected conflicts are stored in the database and can be marked as resolved with one click.<\/p>\n\n Safe Testing Mode<\/strong>\nDisable any plugin for your own admin session while visitors remain completely unaffected. Cookie-isolated \u2014 the live site is never touched.<\/p>\n\n Conflict Wizard<\/strong>\nStep-by-step guided diagnosis. Choose your symptom (white screen, login problem, WooCommerce issue, slow site, broken admin, front-end error, or other) and the wizard automatically analyses recent changes and errors to produce a tailored action plan.<\/p>\n\n Performance Monitor<\/strong> (new in 2.6.0)<\/em>\nTracks the estimated load time, memory delta, and database query count for every active plugin during the current page load. Results are color-coded as Fast \/ Slow \/ Heavy and refreshed on demand.<\/p>\n\n Cron Monitor<\/strong> (new in 2.6.0)<\/em>\nLists all scheduled WordPress Cron events with their next run time and interval. Overdue events are highlighted in red. Each event can be triggered manually via a \"Run Now\" button \u2014 validated against the live WP-Cron schedule before execution.<\/p>\n\n AJAX \/ REST Monitor<\/strong> (new in 2.6.0)<\/em>\nAutomatically logs slow AJAX and REST API calls (those taking more than 500 ms) to a dedicated database table. Filter by All \/ AJAX \/ REST \/ Slow to quickly identify bottleneck endpoints.<\/p>\n\n Plugin Interaction Map<\/strong> (new in 2.6.0)<\/em>\nVisualises your plugins grouped into known ecosystem clusters (WooCommerce, Elementor, Yoast SEO, Jetpack, ACF, Gravity Forms, and more). Highlights declared plugin dependencies and shows active\/inactive state at a glance. Plugins that don't belong to a known ecosystem are listed separately as Standalone Plugins.<\/p>\n\n Multi-site monitoring dashboard<\/strong>\nMonitor up to 50 client sites from one WordPress install. Each row shows the site's status (All clear \/ Warning \/ Critical), open conflicts with the top suspect, fatal errors in the last 24 hours, critical health issues and when it was last checked. Sites are polled automatically every 5, 15 or 60 minutes, or on demand.<\/p>\n\n Read-only API keys<\/strong>\nEach monitored site generates its own key under Agency \u2192 Remote Access<\/strong>. Keys are shown once, stored only as a SHA-256 hash, can expire after 30\/90\/365 days, and can be rotated or revoked instantly. A key can only read status counts \u2014 it cannot change anything.<\/p>\n\n Email alerts<\/strong>\nAn hourly digest email when something new<\/em> happens: fatal errors, conflicts with 50 %+ confidence, or critical health issues. Choose the severity (critical \/ high \/ everything) and up to 10 recipients. The same conflict or issue is never emailed twice, and switching alerts on does not email the existing backlog.<\/p>\n\n Conflict Detective does not contact the plugin author or any third-party service. Two optional features, both off by default and configured by an administrator, send data elsewhere:<\/p>\n\n No configuration is required for the diagnostic tools \u2014 all scanning is done on demand inside the admin area. The optional Agency features (remote monitoring, email alerts) are off until you enable them under Conflict Detective \u2192 Agency<\/strong>.<\/p>\n\n\n No. All analysis runs on demand inside the WordPress admin. The Performance Monitor records a few timestamps while plugins load, and the slow-request monitor only writes to the database when a request takes longer than 500 ms. Agency features run in WP-Cron and only when you enable them.<\/p><\/dd>\n wp-content\/debug.log and the server PHP No. Optionally, enable Never. Safe Testing Mode uses a session cookie that is only present for your admin session. Visitors always see the live site.<\/p><\/dd>\n The plugin detects missing database tables on every request and recreates them automatically \u2014 no activation hook required.<\/p><\/dd>\n Yes, per site. Because the PHP error log is shared by every site on a network, the Error Log, email alerts and the Agency hub are only available to network (super) administrators. Site administrators keep access to the other tools.<\/p><\/dd>\n Performance Monitor hooks into WordPress's No. Only requests that take longer than 500 ms are written to the database. The log is automatically trimmed to the most recent 500 entries.<\/p><\/dd>\n Yes. Go to Conflict Detective \u2192 Cron Monitor<\/strong> and click the \"Run Now\" button next to any event. The plugin validates the hook name against the live WP-Cron schedule before execution so arbitrary code cannot be triggered via this interface.<\/p><\/dd>\n The Interaction Map groups your installed plugins into known ecosystem clusters (WooCommerce, Elementor, Yoast SEO, Jetpack, ACF, Gravity Forms, Contact Form 7, WPML, LearnDash, Divi, WP Rocket, and more). Plugins within the same ecosystem are more likely to interact and potentially conflict with each other. The map also reads the GET \/wp-json\/tahhan-cd\/v1\/status returns counts only: number of open conflicts and the top suspect's plugin name and confidence, total and last-24h fatal errors, health-scan issue counts, the last plugin change, the site name, and the WordPress, PHP and Conflict Detective versions. No file paths, log messages or personal data. It only answers requests that send a valid key in the On the monitored site only a SHA-256 hash of the key is stored. On the agency site, keys of remote sites are encrypted with libsodium using a key derived from your The API key travels in a request header. Remote URLs must use HTTPS on port 443; local, private-network, link-local and reserved addresses are refused to prevent server-side request forgery. Developers can allow plain HTTP on a test network with the Yes. A valid key is never throttled. If you want throttling to use the real visitor IP, map it with the Alerts and remote polling run through WP-Cron, which runs when your site receives traffic. On low-traffic sites, configure a system cron that calls Features<\/h4>\n\n
debug.log<\/code> and the server PHP error log automatically. Each entry is attributed to the plugin that owns the file where the error occurred. Filter by Fatal \/ Warning \/ Notice \/ Deprecated.<\/p>\n\n8.3.0 \u2192 8.4.0<\/code>).<\/p>\n\n\n
max_execution_time<\/code> misconfigurations<\/li>\nAgency Edition (new in 2.7.0)<\/h4>\n\n
External services<\/h3>\n\n
\n
\/wp-json\/tahhan-cd\/v1\/status<\/code> endpoint at the interval you choose. The request contains the remote site's API key (in the X-Tahcd-Key<\/code> header) and the user agent TahhanConflictDetective\/<version><\/code>. Only sites you add are contacted; their own terms and privacy policies apply.<\/li>\nwp_mail()<\/code> configuration to the recipients you enter. They contain error-log excerpts, plugin names and health-scan messages from this site.<\/li>\n<\/ul>\n\n\n\n
tahhan-conflict-detective<\/code> folder to the \/wp-content\/plugins\/<\/code> directory.<\/li>\n\n
Does this plugin slow down my site?<\/h3><\/dt>\n
What log files does it read?<\/h3><\/dt>\n
error_log<\/code> path returned by ini_get('error_log')<\/code>.<\/p><\/dd>\nDo I need to configure anything?<\/h3><\/dt>\n
WP_DEBUG<\/code> and WP_DEBUG_LOG<\/code> in wp-config.php<\/code> to populate the error log.<\/p><\/dd>\nDoes Safe Testing Mode affect my visitors?<\/h3><\/dt>\n
What happens if I install the plugin via FTP?<\/h3><\/dt>\n
Is this plugin compatible with Multisite?<\/h3><\/dt>\n
How does the Performance Monitor work?<\/h3><\/dt>\n
plugin_loaded<\/code> action, which fires once for every plugin that loads. It records a snapshot of the PHP execution time, memory usage, and database query count immediately before and after each plugin loads, then computes the delta. The results are stored in a 5-minute transient and can be refreshed on demand. Because measurements happen at request time, values vary between requests \u2014 treat them as estimates rather than precise benchmarks.<\/p><\/dd>\nDoes the AJAX \/ REST Monitor log every request?<\/h3><\/dt>\n
Can I manually trigger a WordPress Cron event?<\/h3><\/dt>\n
What is the Plugin Interaction Map?<\/h3><\/dt>\n
Requires Plugins<\/code> header introduced in WordPress 6.5 to show explicit declared dependencies.<\/p><\/dd>\nWhat does the remote status endpoint expose?<\/h3><\/dt>\n
X-Tahcd-Key<\/code> header \u2014 never in the URL. It is disabled until you generate a key.<\/p><\/dd>\nHow are API keys protected?<\/h3><\/dt>\n
AUTH_KEY<\/code> salt \u2014 if you change your salts, re-add the remote sites. After 10 failed attempts in 15 minutes an IP is throttled; a request with a valid key is always accepted.<\/p><\/dd>\nWhy is HTTPS required for remote sites?<\/h3><\/dt>\n
tahcd_allow_insecure_remote<\/code> filter. Known limitations: remote sites must have an IPv4 (A) record, and monitoring is disabled while an outbound HTTP proxy (WP_PROXY_HOST<\/code>) is configured, because the destination could then not be verified.<\/p><\/dd>\nMy site is behind Cloudflare or a reverse proxy. Does throttling still work?<\/h3><\/dt>\n
tahcd_rest_client_ip<\/code> filter from a header your proxy sets.<\/p><\/dd>\nDo email alerts need a real cron job?<\/h3><\/dt>\n
wp-cron.php<\/code> for timely alerts.<\/p><\/dd>\n\n<\/dl>\n\n\n2.7.0<\/h4>\n\n
\n
GET \/wp-json\/tahhan-cd\/v1\/status<\/code>, protected by a per-site API key (hash-only storage, expiry, rotation, revocation, per-IP throttling of failed attempts).<\/li>\nplugins_loaded<\/code>) and never ran on activation; tables were only created on the next request.<\/li>\n2.6.6<\/h4>\n\n
\n
Error_Log::tail()<\/code> \u2014 fread()<\/code> return now checked; read errors no longer inject the word \"false\" into parsed log entries.<\/li>\nConflict_Scanner::get_recent_changes()<\/code> \u2014 $wpdb->get_results()<\/code> null return now guarded; prevents TypeError on DB failure.<\/li>\nDashboard::render_dashboard()<\/code> \u2014 strtotime()<\/code> false guard on culprit banner timestamp; corrupt dates no longer show \"01-01-1970\".<\/li>\nDashboard::render_scanner()<\/code> \u2014 same false guard applied to suspect card timestamps.<\/li>\nDashboard::render_dashboard()<\/code> \u2014 eliminated one redundant log-file parse and one extra DB query; both data sources now fetched once.<\/li>\n<\/ul>\n\n2.6.5<\/h4>\n\n
\n
Safe_Mode::ajax_toggle_plugin()<\/code> \u2014 hardcoded 'Forbidden' string now translatable via __()<\/code>.<\/li>\nDashboard::ajax_clear_log()<\/code> \u2014 missing return<\/code> after error response when log file does not exist.<\/li>\nDashboard::ajax_clear_log()<\/code> \u2014 missing return<\/code> after error response when put_contents()<\/code> fails.<\/li>\nCron_Monitor::ajax_run_cron_event()<\/code> \u2014 missing return<\/code> after error response for unknown-hook validation; run_event()<\/code> would execute despite the error already being sent.<\/li>\n<\/ul>\n\n2.6.4<\/h4>\n\n
\n
cd_ajax_log.created_at<\/code> schema now includes DEFAULT CURRENT_TIMESTAMP<\/code> \u2014 prevents INSERT failure under MySQL strict mode.<\/li>\ncd_conflicts.changed_at<\/code> schema changed to DEFAULT NULL<\/code> \u2014 prevents INSERT failure if the column is omitted in strict mode.<\/li>\ndrop_tables()<\/code> now also deletes the tahcd_main_table_exists<\/code> transient on uninstall \u2014 no orphaned wp_options row.<\/li>\ntables_exist()<\/code> now checks both cd_plugin_changes<\/code> (v1) and cd_ajax_log<\/code> (v3) \u2014 a partial install is correctly detected.<\/li>\nHealth_Scan::run()<\/code> checks $wpdb->insert()<\/code> return value and sets db_error<\/code> flag in result on failure.<\/li>\nHealth_Scan::run()<\/code> scanned_at<\/code> in the returned array now uses the same UTC timestamp stored in the database \u2014 was returning local time while the DB row held UTC.<\/li>\nscan_theme()<\/code> guards get_site_transient('update_themes')<\/code> with is_object()<\/code> before property access.<\/li>\nscan_server()<\/code> guards get_site_transient('update_core')<\/code> with is_object()<\/code> before property access.<\/li>\nChange_History::get_recent()<\/code> returns an empty array on DB error instead of propagating null<\/code> (which violated the declared array<\/code> return type).<\/li>\nChange_History::on_update()<\/code> option key for previous-version tracking now uses md5()<\/code> instead of sanitize_key()<\/code> \u2014 sanitize_key()<\/code> strips \/<\/code> and .<\/code>, causing path collisions between plugins with similar names.<\/li>\nChange_History::write()<\/code> now returns bool<\/code> so callers can check whether the DB insert succeeded.<\/li>\nChange_History::on_update()<\/code> only advances the previous-version baseline (update_option<\/code>) when the audit-log write actually succeeded.<\/li>\n<\/ul>\n\n2.6.3<\/h4>\n\n
\n
get_site_transient('update_plugins')<\/code> return value guarded with is_object()<\/code> before property access \u2014 prevents PHP 8.x warning on fresh installs.<\/li>\nWP_Filesystem()<\/code> return value checked before calling put_contents()<\/code> \u2014 prevents fatal on FTP\/SSH filesystem environments.<\/li>\ncurrent_time('mysql', true)<\/code>) instead of local WordPress time \u2014 fixes time-correlation bugs on non-UTC sites.<\/li>\nverify_token()<\/code> result cached with a static variable \u2014 prevents a duplicate DB query per request when Safe Mode is active.<\/li>\non_delete<\/code> hook now correctly reads plugin data before deletion (fires on delete_plugin<\/code>, not deleted_plugin<\/code>).<\/li>\nread_plugin_data()<\/code> validates path stays within WP_PLUGIN_DIR<\/code> via realpath()<\/code> \u2014 path-traversal hardening.<\/li>\nget_plugins()<\/code> cached with a static variable in attribute_to_plugin()<\/code> \u2014 eliminates N+1 calls when attributing log entries.<\/li>\nstrtotime()<\/code> return value validated in score_plugin()<\/code> \u2014 avoids incorrect confidence scores from invalid timestamps.<\/li>\nusort<\/code> comparator in Wizard timeline uses <=><\/code> instead of integer subtraction \u2014 prevents overflow on 32-bit PHP.<\/li>\nesc_html()<\/code> before interpolation.<\/li>\nstr_replace('.php', \u2026)<\/code> in Interaction Map now only removes the trailing extension, not mid-name occurrences.<\/li>\nreturn<\/code> after wp_send_json_error()<\/code> added to all AJAX capability-check guards.<\/li>\n__()<\/code>.<\/li>\ndisplay<\/code> key access guarded with