Everything below reflects the current release (v1.0.0). Install to first verdict is about five minutes, most of it spent reproducing the behaviour you are chasing.
You need WordPress 6.0+ on PHP 7.4+ and an administrator login, plus the plugin zip and licence key from your purchase email. Two honest notes. First, this observes and never intervenes — no plugin is deactivated, no setting is changed and no output is altered, which is what makes it safe to run on a site that is taking orders. Second, it can only see what happens inside PHP; a library that writes files through its own C code is invisible to it, and rather than guess in that situation it tells you plainly that something appeared it could not attribute.
Go to Plugins → Add New → Upload Plugin, choose the zip from your purchase email, install and activate. It adds a Detective item to the admin menu. Activation changes nothing about how the site behaves: it creates two tables and waits to be asked a question.
Open Detective → Licence and paste the key from your purchase email. It is a long code starting VPC1., so paste the whole thing rather than typing it. Keys are domain-based, with no account and no phoning home. Without a key the detective still works in full; the client reports and the AI second opinion stay dormant.
The first screen offers to install it, and you should say yes. It is a small file in mu-plugins that lets recording start before your other plugins load — which matters because a plugin can write files and register behaviour while it is still loading, and anything that starts later cannot see it. When no investigation is running it reads one option and returns. Remove it any time from the settings screen.
Open Detective → Investigate and choose the sentence that matches your problem. Twelve ship with the plugin: images being converted, memory being eaten, a broken block editor, unexplained redirects, a plugin phoning home, mail going out, settings that will not stay saved, content appearing on its own, page HTML being rewritten, a slow site, background jobs, and file writes. The preset decides which hooks and probes are needed. You are not configuring a profiler.
Press start, then go and do the thing. Upload the image, save the setting, submit the form, load the slow page. The panel tells you what to do and counts down. If you need longer, extend it; if you finish early, stop it. Either way it expires by itself.
Come back to the Investigate screen. The findings are ranked with the strongest first, each with a confidence level, the plugin responsible, the file and line, and the events that support it. Open the evidence to see the before and after of every change.
Open Detective → Report branding and add your agency name, logo, brand colour and a footer note. It takes a minute and it applies to every report from then on. Doing it now beats doing it while a client waits for the PDF.
The behaviours and limits you will actually live with.
While one is running, the probes it needs are active for the request types you scoped it to. While one is not, the plugin reads a single option WordPress has already loaded and returns. There is no background scan, no cron sweep and no permanent logging. Every investigation carries a hard expiry — fifteen minutes by default, two hours as the absolute ceiling — so a site cannot be left recording by accident.
Ten plugins might hook the_content and nine of them pass it straight through. Rather than list all ten, each callback is measured for whether the value coming out differs from the value going in. A filter only becomes evidence when it changed something. That single distinction is what turns a list of suspects into a named culprit.
Every file written, renamed or deleted inside your uploads folder is recorded with a trace back to the line of code that did it. This is what catches a plugin writing files with plain PHP, completely outside the WordPress media pipeline — the case that no hook-based tool can see.
Image editors built on Imagick write through their own C library and never touch PHP, so no PHP tool can observe the write. Instead of guessing, the report lists files that appeared with nothing claiming responsibility, and separately names any plugin that replaced the image editor — which is nearly always your answer. The same honest gap covers WP-CLI, system cron, and anything at server or CDN level.
Every recorded request, in order, with each event attributed. Open one to see exactly what happened and when: which plugin ran, what it changed, how long it took, and the raw detail behind each entry. This is where you go when the verdict is right but you want to understand the mechanism.
A standing list of every plugin subscribed to each watched hook, with its callback, file, line and priority. Being on this list proves nothing on its own — it is the suspect list, not the verdict — but it is the fastest way to see how crowded a hook has become.
Stated honestly and deliberately not always high. A plugin returning image/avif from the filter whose only purpose is choosing the output format is a confession and scores in the mid-nineties. A plugin that merely appears in a stack trace scores far lower. Every finding lists the events behind it so you can check the reasoning instead of trusting the number.
Your agency name, logo, brand colour and footer note on a print-ready A4 document: what was investigated, what was found, the recommendation, and the code location behind each finding. Download it as a PDF or email it from the admin with the PDF attached. The rendering engine ships inside the plugin, so there is nothing to install. If your host cannot run it, the report still previews and emails as HTML.
The same case as a plain-text file for a support ticket, a developer handover or an internal note. Support requests that arrive with attributed evidence tend to get answered rather than argued with.
Off until you switch it on, and never required. Add an Anthropic API key and you can ask for a plain-language read on a specific case. Nothing is sent until you press the button for that case, and the exact payload is shown on screen first, with your site URL, hostnames, email addresses, server paths and anything key-shaped stripped out of it.
Evidence lives in two tables on your own server, is capped per request, and is pruned daily on a schedule you set. Nothing is transmitted anywhere unless you deliberately enable the AI module and press send. Uninstalling drops both tables, removes the options and deletes the loader.
Deactivate and the loader is removed and recording stops immediately. Delete the plugin and the two tables, every option and the scheduled prune go with it. Nothing is left behind in your theme or anywhere else on disk.