Tahhan Conflict Detective

No. All analysis runs on demand inside the WordPress admin. The Performance Monitor records a few timestamps while plugins load, and the slow-request monitor only writes to the database when a request takes longer than 500 ms. Agency features run in WP-Cron and only when you enable them.

wp-content/debug.log and the server PHP error_log path returned by ini_get('error_log').

No. Optionally, enable WP_DEBUG and WP_DEBUG_LOG in wp-config.php to populate the error log.

Never. Safe Testing Mode uses a session cookie that is only present for your admin session. Visitors always see the live site.

The plugin detects missing database tables on every request and recreates them automatically — no activation hook required.

Yes, per site. Because the PHP error log is shared by every site on a network, the Error Log, email alerts and the Agency hub are only available to network (super) administrators. Site administrators keep access to the other tools.

Performance Monitor hooks into WordPress's plugin_loaded action, which fires once for every plugin that loads. It records a snapshot of the PHP execution time, memory usage, and database query count immediately before and after each plugin loads, then computes the delta. The results are stored in a 5-minute transient and can be refreshed on demand. Because measurements happen at request time, values vary between requests — treat them as estimates rather than precise benchmarks.

No. Only requests that take longer than 500 ms are written to the database. The log is automatically trimmed to the most recent 500 entries.

Yes. Go to Conflict Detective → Cron Monitor and click the "Run Now" button next to any event. The plugin validates the hook name against the live WP-Cron schedule before execution so arbitrary code cannot be triggered via this interface.

The Interaction Map groups your installed plugins into known ecosystem clusters (WooCommerce, Elementor, Yoast SEO, Jetpack, ACF, Gravity Forms, Contact Form 7, WPML, LearnDash, Divi, WP Rocket, and more). Plugins within the same ecosystem are more likely to interact and potentially conflict with each other. The map also reads the Requires Plugins header introduced in WordPress 6.5 to show explicit declared dependencies.

GET /wp-json/tahhan-cd/v1/status returns counts only: number of open conflicts and the top suspect's plugin name and confidence, total and last-24h fatal errors, health-scan issue counts, the last plugin change, the site name, and the WordPress, PHP and Conflict Detective versions. No file paths, log messages or personal data. It only answers requests that send a valid key in the X-Tahcd-Key header — never in the URL. It is disabled until you generate a key.

On the monitored site only a SHA-256 hash of the key is stored. On the agency site, keys of remote sites are encrypted with libsodium using a key derived from your AUTH_KEY salt — if you change your salts, re-add the remote sites. After 10 failed attempts in 15 minutes an IP is throttled; a request with a valid key is always accepted.

The API key travels in a request header. Remote URLs must use HTTPS on port 443; local, private-network, link-local and reserved addresses are refused to prevent server-side request forgery. Developers can allow plain HTTP on a test network with the tahcd_allow_insecure_remote filter. Known limitations: remote sites must have an IPv4 (A) record, and monitoring is disabled while an outbound HTTP proxy (WP_PROXY_HOST) is configured, because the destination could then not be verified.

Yes. A valid key is never throttled. If you want throttling to use the real visitor IP, map it with the tahcd_rest_client_ip filter from a header your proxy sets.

Every alert email contains a personal link. Opening it shows a confirmation button (so mail-security scanners that follow links cannot unsubscribe anyone); clicking it removes only that address. Mail clients that support one-click unsubscribe (RFC 8058) remove the address directly. The link contains a random token, never the email address. Tokens do not expire; changing your site's security salts invalidates all of them.

Slack and Mattermost incoming webhooks, Discord webhooks, Microsoft Teams Workflows ("When a Teams webhook request is received"), and a generic JSON format for your own endpoint. The webhook URL is stored encrypted and is never shown again after saving. Mentions such as @everyone or <!channel> in log text are neutralised.

Alerts and remote polling run through WP-Cron, which runs when your site receives traffic. On low-traffic sites, configure a system cron that calls wp-cron.php for timely alerts.