UsageRay – See Where Plugins Are Used

Know what depends on a plugin before you turn it off. UsageRay is a read-only plugin usage and dependency auditor for WordPress administrators, developers, agencies, and maintenance teams. It answers a practical maintenance question: what could this plugin still support? UsageRay gathers evidence from content and background systems, explains why each result was attributed, and links to matching content when WordPress provides an edit screen. Audit your entire plugin stack Run one site-wide audit to review every installed plugin from a single dashboard. UsageRay scans shared content and storage in bounded batches instead of repeating the same work for each plugin, then prioritizes confirmed dependencies, stored footprints, incomplete coverage, manual review, and cleanup candidates. You can monitor progress, cancel safely, resume after a page reload, search the results, filter by evidence status, expand the supporting details, and export the completed audit as CSV or JSON. Record a shared Keep, Investigate, or Removal reviewed decision with a short handoff note for each plugin. Review-progress cards and a safety-prioritized queue show what still needs attention. Select several audited plugins to apply one confirmed decision or export a focused CSV or JSON handoff report. UsageRay marks a saved decision as needing re-review when the plugin version or its health classification changes. These records document administrator judgment only; they never deactivate or delete a plugin, and “Removal reviewed” is not a guarantee of safety. Keep audit history current Scheduled site-wide audits are optional and off by default. An administrator can choose Daily or Weekly from the Scan History card. UsageRay uses WordPress cron, prevents overlapping scheduled runs, continues large audits in bounded steps, and shows the next run, progress, completion, or failure status. It makes no external scheduling or tracking request and saves only the same compact, privacy-safe history summary as a manual site-wide audit. Review before deactivation UsageRay adds a Find usage action to the Installed Plugins screen. For active plugins, Deactivation Preflight places an evidence and risk review before the normal WordPress deactivation action. It also adds Review deactivation with UsageRay to the bulk-action menu so several selected plugins can be reviewed together, including declared plugin dependency warnings. Opening a scan or preflight never deactivates anything. Deactivation requires a separate explicit confirmation and is then handled by WordPress's normal protected workflow. Evidence instead of false certainty UsageRay separates visible dependency evidence, stored footprint, and uncertainty. An old option, metadata key, empty custom table, or inactive widget is useful cleanup evidence, but it is not treated as proof that the plugin is currently active on the site. An inactive plugin becomes a cleanup candidate only when UsageRay can attribute supported components and finds neither visible usage nor stored footprint. A candidate still requires manual confirmation. No visible evidence never means safe to delete. Background, security, caching, backup, SEO, and integration plugins may leave no supported content evidence. What UsageRay checks

• Individual plugin deactivation links, with a cautious High, Medium, or Unknown preflight assessment.
• Selected-plugin bulk preflights, with separate risks, combined evidence, and declared Requires Plugins relationships.
• Gutenberg blocks declared or registered by the selected plugin.
• Shortcodes registered by the selected plugin or declared literally in its source.
• Active legacy widgets registered by the selected plugin.
• Attributable legacy widget options, classified as active, inactive, or orphaned instances without exposing their settings.
• Content stored in custom post types declared literally by the selected plugin.
• Reusable blocks, Site Editor templates and template parts containing detected blocks or shortcodes.
• Classic and block navigation records that reference attributed custom post types.
• Recurring and one-time WordPress cron events attributed through registered callbacks or conservative literal scheduling calls. Event arguments are never displayed or exported.
• Custom database tables attributed through maintained mappings or conservative literal creation patterns. UsageRay checks existence and COUNT(*) only; row and column values are never read or exported.
• Conservative references in the active child and parent themes for attributed blocks, shortcodes, custom post types, and plugin-owned function calls. Only relative filenames and line numbers are retained.
• Plugin-associated post metadata keys and generic option names. Generic option values are never read.
• Versioned adapter signals for Elementor, WooCommerce, ACF, Contact Form 7, WPForms, Gravity Forms, Formidable Forms, Ninja Forms, Yoast SEO, Rank Math, All in One SEO, The Events Calendar, Redirection, UpdraftPlus, LiteSpeed Cache, Wordfence, and WP Super Cache.

Transparent scan coverage Every focused scan, site-wide audit, and Deactivation Preflight includes a Scan Coverage manifest. It distinguishes checked surfaces from surfaces that were not applicable, are not yet supported, failed, or were only partially inspected because of a safety limit. This makes the result's limitations visible instead of implying complete detection. Privacy-conscious and read-only UsageRay does not modify content, delete plugins, or silently deactivate anything. Generic option values, post metadata values, scheduled-event arguments, custom-table row values, theme source text, and absolute filesystem paths are not retained in results or exports. Use UsageRay when cleaning up an inherited site, replacing a form or page-builder plugin, preparing a client maintenance report, or investigating whether an installed extension still supports content or background behavior. Use UsageRay from WP-CLI Developers, agencies, and automation systems can run the same read-only audit engine without opening wp-admin. Use wp usageray audit to inspect the installed plugin stack or wp usageray inspect <plugin> for one plugin by slug or complete basename. List retained audits with wp usageray history list, compare previous with latest, or export a retained audit without rescanning content. Commands support concise tables and privacy-safe JSON or CSV output. Machine-readable formats include stable schema identifiers, automatically suppress interactive progress, and can use optional --fail-on policies for CI. Exit code 2 means a requested policy matched after successful output; operational failures remain exit code 1. See UsageRay in action Watch the short UsageRay overview: https://www.youtube.com/watch?v=TWtoWhgtr2w The video narration is AI-generated.

0.7.0

• Added read-only WP-CLI commands to audit all installed plugins, inspect one plugin, list history, compare saved audits, and export retained results.
• Added stable success, operational-error, and policy-match exit codes plus optional --fail-on policies for CI and maintenance automation.
• Added four named Draft 2020-12 JSON schemas and validated actual command output against every packaged schema.
• Added a privacy-safe one-time audit completion action and a versioned, bounded PHP API for hosting dashboards and maintenance agents.
• Added fail-closed handling for interrupted, inaccessible, or structurally damaged audit progress without changing content or plugin state.
• Reverified the eighteen-plugin compatibility matrix, including the maintained Wordfence Security 9.0.1 ownership signals.

0.7.0-rc.1

• Froze the complete 0.7.0 developer and agent interface for final release-candidate verification.
• Changed no scanning, user-interface, command, schema, hook, or PHP API behavior from beta 1.
• Repeated command, compatibility, upgrade, multisite, stress, real-plugin, responsive, accessibility, privacy, and Plugin Check validation against the exact package.

0.7.0-beta.1

• Froze the 0.7.0 WP-CLI, JSON schema, completion-hook, and PHP API feature set for regression testing.
• Added fail-closed validation that discards structurally damaged audit progress before phase processing or report generation.
• Added real-command tests for successful, operational-error, and policy-match exit codes while preserving JSON output before exit 2.
• Added interrupted, damaged, user-isolated, bounded-batch, and private-output regression coverage for the PHP integration API.
• Reverified the maintained Wordfence Security ownership signals against version 9.0.1 after its release during beta testing.

0.7.0-alpha.4

• Added a versioned, read-only PHP integration API for hosting panels, maintenance agents, and systems that cannot invoke WP-CLI.
• Added bounded site-audit control plus privacy-safe history, retained-audit, comparison, and schema-catalog methods.
• Documented the stable developer surface and the authentication responsibilities of integrations that expose it through another transport.
• Added contract tests that validate real WP-CLI JSON output against all four packaged Draft 2020-12 schemas.

0.7.0-alpha.3

• Added stable WP-CLI exit codes: 0 for a successful policy pass, 1 for invalid input or operational failure, and 2 when a requested policy matches after successful output.
• Added optional --fail-on policies for audits, focused inspections, and retained-history comparisons.
• Added named version-1 JSON schemas for audit, history, comparison, and retained-audit documents.
• Added a privacy-safe usageray_audit_completed hook plus CI and hosting-integration documentation.
• Reverified the Rank Math SEO adapter with version 1.0.278 in the eighteen-plugin compatibility matrix.

0.7.0-alpha.2

• Added wp usageray history list with table, JSON, and CSV output.
• Added deterministic wp usageray compare <baseline> <current> output without rescanning content, including convenient previous and latest selectors.
• Added wp usageray export <audit> for privacy-safe retained audit snapshots in table, JSON, or CSV format.
• Added missing, invalid, and unavailable audit-ID handling plus formula-safe history and comparison CSV output.

0.7.0-alpha.1

• Added read-only wp usageray audit and wp usageray inspect <plugin> commands with slug and complete-basename support.
• Added table, privacy-safe JSON, and spreadsheet-safe CSV output.
• Reused the bounded audit engine so command-line results retain the same evidence, coverage, history, and privacy rules as wp-admin.
• Added interactive progress for terminal tables and quiet machine output for automation.

0.6.0

• Added privacy-safe history for completed site-wide audits, with bounded 20-record and 90-day retention plus protected deletion controls.
• Added deterministic audit comparisons for plugin, evidence, review, health, and scan-coverage changes.
• Added optional Daily or Weekly site-wide audits using WordPress cron, with bounded continuation, overlap protection, recovery, and visible status.
• Hardened cancellation, stale-lock recovery, permission loss, damaged settings, disabled WP-Cron guidance, multisite isolation, and large-site processing.
• Verified the release across eighteen real plugins, including Ninja Forms 3.15.3, and retained read-only, privacy-conscious behavior.

0.6.0-rc.1

• Froze the complete 0.6.0 feature set for final release-candidate verification.
• Verified the existing Ninja Forms signals against version 3.15.3 after its public release.
• Repeated compatibility, upgrade, multisite, stress, real-plugin, accessibility, responsive, and Plugin Check validation against the exact package.

0.6.0-beta.1

• Froze the 0.6.0 History, Comparison, and optional scheduled-audit feature set for regression testing.
• Hardened cancellation during a running scheduled audit, stale-lock recovery, administrator permission loss, and damaged schedule-setting recovery.
• Added disabled WP-Cron guidance and scheduled-audit continuation testing on a 2,500-record site.

0.6.0-alpha.4

• Added explicitly opt-in Daily and Weekly site-wide audits using WordPress cron with no external scheduling or tracking service.
• Added bounded continuation, overlap protection, stale-lock recovery, and protection against an older cron request overwriting a newer administrator choice.
• Added visible next-run, progress, completion, failure, and WP-Cron status in the Scan History card.
• Kept scheduled results within the existing privacy-safe history limits and preserved the administrator who enabled the schedule as the audit owner.

0.6.0-alpha.3

• Added focused comparison filters for plugin additions, removals, state, health, reviews, evidence, and coverage.
• Added exact before-and-after evidence counts with signed differences.
• Added detailed coverage-total and coverage-surface changes instead of generic change notices.
• Added second-level comparison timestamps so closely completed audits remain distinguishable.

0.6.0-alpha.2

• Added deterministic comparisons between two saved site-wide audits.
• Added clear Added, Removed, Changed, and Unchanged plugin-state summaries with field-level change explanations.
• Added capacity warnings when a comparison includes a limited snapshot.
• Kept comparisons read-only and based only on privacy-safe saved counts and statuses.

0.6.0-alpha.1

• Added bounded, privacy-safe history summaries for completed site-wide audits.
• Added a Scan History list with protected controls for deleting one or all saved summaries.
• Excluded focused scans, Deactivation Preflights, cancelled scans, and unfinished scans from history.
• Kept history in non-autoloaded, per-site WordPress options with record, age, plugin-count, and byte limits.

0.5.1

• Made the display name and short description clearer for non-technical site owners.
• No scanning, storage, privacy, or plugin-management behavior changed.

0.5.0

• Froze the 0.5.0 feature set for release-candidate verification.
• Refined the WordPress.org summary, dashboard description, and screenshot captions around Plugin Health and maintenance handoff.
• Retained the beta confirmation hardening that requires a fresh review after any selected-plugin, decision, or shared-note change.

0.5.0-beta.1

• Hardened bulk-review confirmation so changes to the selected plugins, decision, or shared note require a fresh confirmation.
• Completed regression hardening for the private 0.5.0 beta without expanding the read-only feature scope.

0.5.0-alpha.4

• Added live review-progress cards for Pending, Keep, Investigate, Removal reviewed, and Needs re-review states.
• Added a safety-prioritized review queue with review-state and plugin-name sorting.
• Added bounded bulk review decisions and shared notes with an explicit confirmation step.
• Added selected-plugin CSV and JSON exports for focused handoff reports.
• Kept bulk review operations advisory and read-only; they never deactivate, delete, or otherwise change plugins.

0.5.0-alpha.3

• Added a durable, site-level review workflow with Keep, Investigate, and Removal reviewed decisions.
• Added bounded administrator notes, reviewer attribution, and decision filtering to the site-wide dashboard.
• Marked decisions for re-review when the plugin version or UsageRay health classification changes.
• Included current review records in administrator-only JSON and spreadsheet-safe CSV exports.
• Kept every review action advisory and read-only; UsageRay never deactivates or deletes a plugin through this workflow.

0.5.0-alpha.2

• Made every Plugin Health overview card a keyboard-accessible filter with visible selected state.
• Added a dedicated health selector that combines with plugin search and audit-result filters.
• Added live filtered-result counts and empty-state feedback.
• Added health-specific evidence actions plus nonce-protected focused-scan and deactivation-preflight links.
• Improved responsive filter and action layouts while preserving intentional touch scrolling for the audit table.

0.5.0-alpha.1

• Added a versioned, deterministic plugin-health classification engine for completed site-wide audits and exports.
• Added prioritized health states for confirmed dependencies, stored footprints, incomplete scans, manual review, and cleanup candidates.
• Prevented incomplete scan coverage from being presented as a cleanup-candidate health state.
• Added a responsive six-card Plugin Health overview and per-plugin health badges to the audit dashboard.
• Prioritized audit results by safety-first health severity while preserving alphabetical order within each state.

0.4.0

• Added a public, versioned integration-adapter contract and declarative array adapter for plugin authors.
• Added bounded validation for adapter identity, plugin basenames, compatibility metadata, evidence rules, table identifiers, and admin links.
• Moved every maintained integration mapping into the same validated registry used by third-party adapters.
• Added verified adapters for Redirection, UpdraftPlus, and LiteSpeed Cache, plus source-reviewed maintained Wordfence Security and WP Super Cache adapters.
• Added visible Verified, Maintained, and Experimental compatibility labels in focused scans, preflights, site-wide audits, and JSON exports.
• Isolated adapter registration and profile failures so one broken integration cannot stop healthy adapters or UsageRay scans.
• Added maintained-definition collision protection and a 250-adapter per-request safety limit.
• Published the frozen version 1 machine-readable adapter schema and a copy-ready PHP registration example in the included documentation.
• Expanded reproducible QA to eighteen current real plugins across two isolated test matrices.
• Improved responsive evidence cards so long integration identifiers wrap without horizontal page overflow.

0.3.0

• Added a versioned Scan Coverage manifest across focused scans, site-wide audits, Deactivation Preflight, JSON, and CSV exports.
• Added privacy-safe recurring and one-time WordPress scheduled-event detection without retaining or exporting event arguments.
• Added legacy widget storage inspection with active, inactive, and orphaned instance classification.
• Added conservative custom-database-table attribution using existence and COUNT(*) checks only; table row and column values are never read.
• Added bounded active child and parent theme reference detection for attributed blocks, shortcodes, custom post types, and plugin-owned functions.
• Reports theme evidence using relative filenames and line numbers without retaining or exporting source text or absolute paths.
• Strengthened shortcode and function matching against comments, declarations, method calls, static calls, malformed patterns, and documentation-only strings.
• Improved long-identifier wrapping and narrow-screen evidence-card layouts.
• Added upgrade, compatibility, multisite, privacy, false-positive, high-volume, accessibility, and real-plugin stabilization checks.

0.2.0

• Added a site-wide dashboard that audits all installed plugins together.
• Scans each content batch once against components discovered across every plugin.
• Added batched progress, cancellation, and automatic resume after page reloads.
• Added result summaries, search and status filters, and expandable evidence explanations.
• Added reusable block, Site Editor template, navigation, post-metadata, and option-name evidence.
• Added conservative adapters for Elementor, WooCommerce, ACF, The Events Calendar, major form plugins, and major SEO plugins.
• Added cleanup-candidate guidance that never claims a plugin is safe to remove.
• Added administrator-only CSV and JSON audit reports with spreadsheet-formula protection.
• Preserved the focused single-plugin scan and read-only safety model.
• Added individual Deactivation Preflight with cautious High, Medium, or Unknown risk assessments.
• Added “Review deactivation with UsageRay” for selected plugins in the Installed Plugins bulk-action menu.
• Added separate risk summaries, combined evidence, and declared Requires Plugins relationship warnings for bulk reviews.
• Added focused, resumable preflight scans and 10-minute reuse of recent completed results.
• Kept deactivation behind a separate explicit action handled by WordPress's native nonce-protected workflow.

0.1.2

• Added a short demonstration video to the plugin page.
• Added a third screenshot showing Find usage links on the Installed Plugins screen.
• Added a scalable SVG directory icon while retaining PNG fallbacks.

0.1.1

• Added a custom icon, banner, and real interface screenshots.
• Improved the directory description to explain the plugin's purpose more clearly.

0.1.0

• Initial read-only MVP.
• Added block, shortcode, widget, and custom post type evidence scanning.
• Added Find usage links to the Installed Plugins screen.