Tahhan Conflict Detective

"Which plugin just broke my site?" — answered automatically. Existing tools show you that an error occurred. Conflict Detective tells you which plugin caused it by correlating the plugin change timeline with the error log — and gives you a confidence score. Features Dashboard Live overview of your WordPress/PHP version, active plugins, active theme, memory limit, debug mode, recent changes, and latest errors — all on one screen. Error Log Viewer Reads debug.log and the server PHP error log automatically. Each entry is attributed to the plugin that owns the file where the error occurred. Filter by Fatal / Warning / Notice / Deprecated. Change History Full audit trail of every plugin activation, deactivation, update, and deletion — with exact timestamps and version diffs (e.g. 8.3.0 → 8.4.0). Health Scan On-demand scan that detects:

• Duplicate plugin functionality (multiple SEO, caching, security, or backup plugins)
• Known incompatibilities between specific plugin pairs
• Outdated plugins (not updated in more than 2 years)
• Missing theme files or a missing parent theme
• PHP version, memory limit, and max_execution_time misconfigurations
• Pending WordPress core updates

Conflict Scanner Automatically correlates plugin update timestamps with error spikes and reports a suspect plugin with a confidence percentage. Detected conflicts are stored in the database and can be marked as resolved with one click. Safe Testing Mode Disable any plugin for your own admin session while visitors remain completely unaffected. Cookie-isolated — the live site is never touched. Conflict Wizard Step-by-step guided diagnosis. Choose your symptom (white screen, login problem, WooCommerce issue, slow site, broken admin, front-end error, or other) and the wizard automatically analyses recent changes and errors to produce a tailored action plan. Performance Monitor (new in 2.6.0) Tracks the estimated load time, memory delta, and database query count for every active plugin during the current page load. Results are color-coded as Fast / Slow / Heavy and refreshed on demand. Cron Monitor (new in 2.6.0) Lists all scheduled WordPress Cron events with their next run time and interval. Overdue events are highlighted in red. Each event can be triggered manually via a "Run Now" button — validated against the live WP-Cron schedule before execution. AJAX / REST Monitor (new in 2.6.0) Automatically logs slow AJAX and REST API calls (those taking more than 500 ms) to a dedicated database table. Filter by All / AJAX / REST / Slow to quickly identify bottleneck endpoints. Plugin Interaction Map (new in 2.6.0) Visualises your plugins grouped into known ecosystem clusters (WooCommerce, Elementor, Yoast SEO, Jetpack, ACF, Gravity Forms, and more). Highlights declared plugin dependencies and shows active/inactive state at a glance. Plugins that don't belong to a known ecosystem are listed separately as Standalone Plugins.

1. Upload the tahhan-conflict-detective folder to the /wp-content/plugins/ directory.
2. Activate the plugin through the Plugins menu in WordPress.
3. Navigate to Conflict Detective in the WordPress admin sidebar.

No configuration is required. All scanning is done on demand inside the admin area — zero front-end overhead.

2.6.5

• Fix: Safe_Mode::ajax_toggle_plugin() — hardcoded 'Forbidden' string now translatable via __().
• Fix: Dashboard::ajax_clear_log() — missing return after error response when log file does not exist.
• Fix: Dashboard::ajax_clear_log() — missing return after error response when put_contents() fails.
• Fix: Cron_Monitor::ajax_run_cron_event() — missing return after error response for unknown-hook validation; run_event() would execute despite the error already being sent.

2.6.4

• Fix: cd_ajax_log.created_at schema now includes DEFAULT CURRENT_TIMESTAMP — prevents INSERT failure under MySQL strict mode.
• Fix: cd_conflicts.changed_at schema changed to DEFAULT NULL — prevents INSERT failure if the column is omitted in strict mode.
• Fix: drop_tables() now also deletes the tahcd_main_table_exists transient on uninstall — no orphaned wp_options row.
• Fix: tables_exist() now checks both cd_plugin_changes (v1) and cd_ajax_log (v3) — a partial install is correctly detected.
• Fix: Health_Scan::run() checks $wpdb->insert() return value and sets db_error flag in result on failure.
• Fix: Health_Scan::run() scanned_at in the returned array now uses the same UTC timestamp stored in the database — was returning local time while the DB row held UTC.
• Fix: scan_theme() guards get_site_transient('update_themes') with is_object() before property access.
• Fix: scan_server() guards get_site_transient('update_core') with is_object() before property access.
• Fix: Change_History::get_recent() returns an empty array on DB error instead of propagating null (which violated the declared array return type).
• Fix: Change_History::on_update() option key for previous-version tracking now uses md5() instead of sanitize_key() — sanitize_key() strips / and ., causing path collisions between plugins with similar names.
• Fix: Change_History::write() now returns bool so callers can check whether the DB insert succeeded.
• Fix: Change_History::on_update() only advances the previous-version baseline (update_option) when the audit-log write actually succeeded.

2.6.3

• Fix: get_site_transient('update_plugins') return value guarded with is_object() before property access — prevents PHP 8.x warning on fresh installs.
• Fix: WP_Filesystem() return value checked before calling put_contents() — prevents fatal on FTP/SSH filesystem environments.
• Fix: AJAX log timestamps stored as UTC (current_time('mysql', true)) instead of local WordPress time — fixes time-correlation bugs on non-UTC sites.
• Fix: verify_token() result cached with a static variable — prevents a duplicate DB query per request when Safe Mode is active.
• Fix: on_delete hook now correctly reads plugin data before deletion (fires on delete_plugin, not deleted_plugin).
• Fix: read_plugin_data() validates path stays within WP_PLUGIN_DIR via realpath() — path-traversal hardening.
• Fix: get_plugins() cached with a static variable in attribute_to_plugin() — eliminates N+1 calls when attributing log entries.
• Fix: strtotime() return value validated in score_plugin() — avoids incorrect confidence scores from invalid timestamps.
• Fix: usort comparator in Wizard timeline uses <=> instead of integer subtraction — prevents overflow on 32-bit PHP.
• Fix: Plugin name in Wizard advice string escaped with esc_html() before interpolation.
• Fix: str_replace('.php', …) in Interaction Map now only removes the trailing extension, not mid-name occurrences.
• Fix: Missing return after wp_send_json_error() added to all AJAX capability-check guards.
• Fix: Hard-coded 'Forbidden', 'Invalid plugin.', 'Unknown plugin.' strings now passed through __().
• Fix: Cron Monitor display key access guarded with isset().
• Fix: SHOW TABLES query in maybe_upgrade() cached with a 1-hour transient — eliminates a raw DB query on every page load.
• Fix: Multisite uninstall now iterates all sub-sites via switch_to_blog() / restore_current_blog().
• Fix: $ajax_start static property reset to null after logging to prevent duplicate entries.

2.6.2

• Security: plugin path in Safe Mode now validated with plugin_basename() to prevent path traversal.
• Security: AJAX monitor now reads from $_POST instead of $_REQUEST.
• Fix: all early-exit AJAX error responses now include return for clarity.
• Fix: filemtime() calls for CSS/JS assets now guarded with file_exists().
• Fix: Change History table uses null-coalescing guards on DB result properties.
• Fix: strtok() replaced with stateless explode() in Error Log file attribution.
• Fix: Health Scan issue count now guards against non-array scan section returns.
• Code: Wizard symptom labels moved to a symptoms() method so they are translatable.
• Code: Hardcoded "Plugin:" label in Error Log Viewer is now translatable.

2.6.1

• Updated: Tested up to WordPress 7.0.

2.6.0

• New: Performance Monitor tab — tracks per-plugin load time, memory delta, and DB query count during page load; color-coded Fast / Slow / Heavy badges; Refresh Data button.
• New: Cron Monitor tab — lists all scheduled WP-Cron events with next run time and overdue detection; "Run Now" button per event; overdue count summary badge at top.
• New: AJAX / REST Monitor tab — logs slow AJAX and REST API calls (>500 ms) to a dedicated DB table; filter bar for All / AJAX / REST / Slow views.
• New: Plugin Interaction Map tab — visualises plugin dependency clusters (WooCommerce, Elementor, Yoast, Jetpack, ACF, etc.) and standalone plugins with active/inactive state.
• Security: cron "Run Now" AJAX handler now validates the hook against the live WP-Cron schedule before execution.
• Security: AJAX monitor REST timing now reads from $_SERVER directly (was using non-standard $GLOBALS['_SERVER']).
• Security: AJAX log get_entries() now selects only required columns instead of SELECT *.
• DB: new {prefix}cd_ajax_log table (schema version 3).

2.5.1

• Fixed: uninstall routine now correctly deletes tahcd_prev_version_* options (was using the stale pcd_prev_version_ prefix, leaving orphaned rows in wp_options).
• Fixed: Safe Mode plugin list no longer shows Conflict Detective itself (self-exclusion filter used the old slug conflict-detective/conflict-detective.php).
• Docs: readme.txt changelog updated with entries for v2.2.0 through v2.5.0.

2.5.0

• All plugin-specific prefixes standardised to tahcd_ / TAHCD_ to satisfy WordPress.org uniqueness requirements (constants, AJAX actions, nonce, user meta, cookie, option keys, script handle, JS data object).

2.4.0

• Plugin renamed to Tahhan Conflict Detective (slug: tahhan-conflict-detective) for WordPress.org compliance. Namespace changed to TahhanConflictDetective. Text domain changed to tahhan-conflict-detective.
• Debug log clear handler now uses WP_Filesystem::put_contents() instead of file_put_contents().

2.3.1

• Fixed critical infinite recursion crash: maybe_filter_active_plugins() called get_option('active_plugins') which re-triggered the same filter, causing a stack overflow. Fixed by reading directly from $wpdb.

2.3.0

• CI action SHA pinning for security hardening. Code cleanup in class-dashboard.php and class-error-log.php.

2.2.0

• Safe Mode tab fully functional: Start/Stop button now triggers AJAX and reloads on success.
• Architecture fix: Safe_Mode::init() and Database::maybe_upgrade() moved to file-load time.

2.1.4

• Fixed critical bug: Safe_Mode::init() and Database::maybe_upgrade() were registered inside Plugin::init() on plugins_loaded priority 5, meaning they were never called (priority 1 and 0 already fired). Both are now wired up directly at file load time, outside the Plugin class.
• Safe Mode tab fully redesigned: inactive state shows a card with instructions and a Start button; active state shows an amber banner with plugin count and a Stop button above the plugin toggle list.
• JavaScript Safe Mode toggle now uses delegated event binding ($(document).on) so it works regardless of DOM load order, and reloads the page on success to reflect the new state.
• Added safeModeLoading and safeModeStop localised strings for button feedback during AJAX calls.
• Added CSS for .pcd-safe-mode-banner, .pcd-btn-stop, .pcd-safe-mode-steps, and .pcd-safe-mode-count.

2.1.3

• Added Safe Mode tab UI (render_safe_mode placeholder).

2.1.1

• Security: plugin slug from AJAX request now validated against the installed plugins list before being stored in user meta
• All JavaScript UI strings are now translatable via wp_localize_script — no hardcoded English in JS
• Replaced last remaining emoji with a Dashicon in the Conflict Wizard
• Fixed menu position conflict with WordPress core Plugins menu (changed from 65 to 65.1)
• Added languages/ directory to match the Domain Path declaration in the plugin header
• Fixed navigation instructions in documentation (plugin is a top-level menu, not under Tools)
• LICENSE updated to full GPL-2.0-or-later text including the "or any later version" clause

2.0.0

• Added Conflict Scanner with confidence percentage
• Added Safe Testing Mode (admin-only plugin toggle, visitors unaffected)
• Added Conflict Wizard with 7 symptom categories and automatic analysis
• New database table for storing scanner results

1.0.0

• Initial release — Dashboard, Error Log Viewer, Plugin Change History, Health Scan