Modules Insight

Risk is based on two signals pulled from the WordPress.org plugin directory for each plugin: 1. Last Updated — how recently the plugin received a published release. 2. Minimum PHP Declared — the Requires PHP value the author set on WordPress.org. The rating is assigned as follows:

• High — Not updated in over 3 years, OR declares a minimum PHP below 7.0. Investigate before upgrading.
• Low — Updated within 12–18 months AND declares PHP 7.4 or higher as its minimum.
• Medium — Anything between High and Low. Test on staging before upgrading production.
• Not on WP.org — Plugin not found in the directory. Risk must be assessed manually.

The most common reason is that the plugin’s Requires PHP field on WordPress.org is set below 7.4 — even if the plugin runs perfectly on modern PHP. Authors often set this conservatively and forget to update it. In this case Medium does not mean the plugin is broken; it means the metadata is incomplete. Check the plugin’s own changelog or test directly on staging.

The plugin was not found in the WordPress.org directory. This is normal for premium plugins (WooCommerce extensions, page builder add-ons, etc.) and custom-built plugins. Their compatibility cannot be assessed automatically — check with the vendor or test directly on a staging environment running the target PHP version.

No. They are a triage guide based on publicly available metadata. A Low-rated plugin could still have incompatibilities; a High-rated plugin might work perfectly. The table helps you decide where to focus your testing effort, not whether to skip testing altogether.

No. MI does not activate, deactivate, install, or delete any plugins, and it never modifies your site's data. The only write it performs anywhere is appending report rows to a Google Sheet you configure — and only when you press Send report to Google Sheet.

No Google Cloud project, no API keys. You create a normal Google Sheet, add a short Google Apps Script (provided on the settings page) and deploy it as a Web App. You then paste that Web App URL and a shared secret token into Settings → Modules Insight. The plugin POSTs the report to your script, which appends the rows. The token is stored in your database (or a wp-config.php constant) and is never shown again after saving.

WordPress 7.0 or newer (the AI Client ships in core from 7.0), with an AI provider (Anthropic, Google, or OpenAI) configured by an administrator in your site's AI settings. Modules Insight uses the core AI Client — it stores no API keys of its own. If no provider can serve a request, the "Ask AI" button doesn't appear and the settings page explains why. If the "Connector Approvals" experiment is enabled, an administrator must approve Modules Insight after its first request. Answers are cached for 12 hours per question to limit provider costs.

Only users with the activate_plugins capability (typically Administrators). The settings page requires manage_options.

JSON, CSV, or a Google Sheet. All include the PHP and WordPress compatibility data (last updated, "tested up to", minimum PHP, both risk levels) for any plugin that has been checked. Plugins not yet checked show not_checked in those fields.

Yes. MI loads no assets unless an admin explicitly presses Scan, and makes no outbound requests except the admin-initiated ones listed under "External services" above.