{"id":357220,"date":"2026-10-15T19:28:21","date_gmt":"2026-10-15T19:28:21","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/bisect\/"},"modified":"2026-10-16T07:46:08","modified_gmt":"2026-10-16T07:46:08","slug":"tracedown-culprit-finder","status":"publish","type":"plugin","link":"https:\/\/sw.wordpress.org\/plugins\/tracedown-culprit-finder\/","author":23549866,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"0.1.0","stable_tag":"0.1.0","tested":"7.1.3","requires":"6.2","requires_php":"7.4","requires_plugins":null,"header_name":"Tracedown Culprit Finder","header_author":"Kuber Gupta","header_description":"Finds the plugin that broke the site. Tracedown runs a private, expiring safe-mode session for one logged-in administrator and narrows the active-plugin list down to the culprit without ever writing the active_plugins option, so there is nothing to restore.","assets_banners_color":"2845e3","last_updated":"2026-10-16 07:46:08","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":64,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"0.1.0":{"tag":"0.1.0","author":"kuber8821","date":"2026-10-16 07:46:08","revision":3749883}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3749192,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3749192,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3749192,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3749192,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{"blueprint.json":{"filename":"blueprint.json","revision":3749883,"resolution":false,"location":"assets","locale":"","contents":"{\"$schema\":\"https:\\\/\\\/playground.wordpress.net\\\/blueprint-schema.json\",\"landingPage\":\"\\\/wp-admin\\\/admin.php?page=tracedown\",\"preferredVersions\":{\"php\":\"8.2\",\"wp\":\"latest\"},\"features\":{\"networking\":true},\"steps\":[{\"step\":\"login\",\"username\":\"admin\",\"password\":\"password\"},{\"step\":\"installPlugin\",\"pluginData\":{\"resource\":\"wordpress.org\\\/plugins\",\"slug\":\"tracedown-culprit-finder\"},\"options\":{\"activate\":true}}]}"}},"all_blocks":[],"tagged_versions":["0.1.0"],"block_files":[],"assets_screenshots":{"screenshot-1.jpg":{"filename":"screenshot-1.jpg","revision":3749192,"resolution":"1","location":"assets","locale":"","width":1456,"height":839},"screenshot-2.jpg":{"filename":"screenshot-2.jpg","revision":3749192,"resolution":"2","location":"assets","locale":"","width":1495,"height":812},"screenshot-3.jpg":{"filename":"screenshot-3.jpg","revision":3749192,"resolution":"3","location":"assets","locale":"","width":1456,"height":839},"screenshot-4.jpg":{"filename":"screenshot-4.jpg","revision":3749192,"resolution":"4","location":"assets","locale":"","width":1495,"height":812}},"screenshots":{"1":"The start screen: what the site looks like right now, and one button.","2":"The result: the smallest set of plugins that still reproduces the fault, and proof that no smaller set does.","3":"Probes: the pages and content markers every verdict is built from.","4":"Content markers: a piece of text that proves a page is right, so a silent break is not scored as healthy."}},"plugin_section":[],"plugin_tags":[284831,49506,54705,8541,274713],"plugin_category":[52,59],"plugin_contributors":[286977],"plugin_business_model":[],"class_list":["post-357220","plugin","type-plugin","status-publish","hentry","plugin_tags-critical-error","plugin_tags-plugin-conflict","plugin_tags-safe-mode","plugin_tags-troubleshooting","plugin_tags-white-screen","plugin_category-performance","plugin_category-utilities-and-tools","plugin_contributors-kuber8821","plugin_committers-kuber8821"],"banners":{"banner":"https:\/\/ps.w.org\/tracedown-culprit-finder\/assets\/banner-772x250.png?rev=3749192","banner_2x":"https:\/\/ps.w.org\/tracedown-culprit-finder\/assets\/banner-1544x500.png?rev=3749192","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/tracedown-culprit-finder\/assets\/icon-128x128.png?rev=3749192","icon_2x":"https:\/\/ps.w.org\/tracedown-culprit-finder\/assets\/icon-256x256.png?rev=3749192","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/tracedown-culprit-finder\/assets\/screenshot-1.jpg?rev=3749192","caption":"The start screen: what the site looks like right now, and one button."},{"src":"https:\/\/ps.w.org\/tracedown-culprit-finder\/assets\/screenshot-2.jpg?rev=3749192","caption":"The result: the smallest set of plugins that still reproduces the fault, and proof that no smaller set does."},{"src":"https:\/\/ps.w.org\/tracedown-culprit-finder\/assets\/screenshot-3.jpg?rev=3749192","caption":"Probes: the pages and content markers every verdict is built from."},{"src":"https:\/\/ps.w.org\/tracedown-culprit-finder\/assets\/screenshot-4.jpg?rev=3749192","caption":"Content markers: a piece of text that proves a page is right, so a silent break is not scored as healthy."}],"raw_content":"<!--section=description-->\n<p>Site broken after a plugin update? Seeing \"There has been a critical error on this website\", a white screen of death, a checkout or contact form that silently stopped working, or a 500 error? Something in your plugin list did it, and Tracedown finds out which one, in minutes, without deactivating anything and without touching what your visitors see.<\/p>\n\n<p><strong>You cannot get stuck.<\/strong> Tracedown never writes the <code>active_plugins<\/code> option. Not once, on any code path. It filters the active plugin list in memory, for one signed-in administrator, for the length of one expiring session. Because nothing is written, restoring is not an operation Tracedown has to perform correctly. There is nothing to undo. Doing nothing restores the site when the session expires. Deleting one file restores it instantly.<\/p>\n\n<p>That is a checkable claim, not a slogan. Search this plugin for a write to the <code>active_plugins<\/code> option, or for a call to core's plugin activation and deactivation helpers, and you will not find one. The build fails automatically if anyone ever adds one.<\/p>\n\n<p><strong>And it names the culprit.<\/strong> Tracedown does not hand you a list of 86 checkboxes to toggle one at a time. It runs a deterministic delta-debugging search (ddmin) over the plugins that were active when the session started and returns a minimal failing set, which stays correct when two plugins only break the site <em>together<\/em>, the case a naive one-at-a-time or split-in-half search reports as \"everything looks fine\".<\/p>\n\n<h4>How the safety works<\/h4>\n\n<ul>\n<li><strong>Four independent ways out, all of them a delete or a no-op, never a repair.<\/strong>\n\n<ol>\n<li>Add <code>define( 'TRACEDOWN_DISABLE', true );<\/code> to <code>wp-config.php<\/code>. It is the first thing the safe-mode file checks.<\/li>\n<li>Delete <code>wp-content\/mu-plugins\/tracedown-safe-mode.php<\/code> over FTP, SFTP or your file manager.<\/li>\n<li>Run <code>wp tracedown abort<\/code>. The command is registered from the safe-mode file itself, so it works even while the plugin is filtered out.<\/li>\n<li>Wait. Sessions expire on their own: 30 minutes by default, 15 minutes idle, and a hard one-hour ceiling that is written into the file rather than the database, so tampering with a database row cannot extend it.<\/li>\n<\/ol><\/li>\n<li><strong>Visitors are not affected.<\/strong> The session is bound to one signed-in administrator through an HMAC-signed, HttpOnly, SameSite=Strict cookie. It is never bound to an IP address, so a mobile network, a VPN or a CDN edge change cannot silently drop you out of safe mode and give you a false \"this looks clean\" reading. Tracedown's own loopback checks run logged out and carry no WordPress login cookies; each one proves itself with a single random key that expires within a minute.<\/li>\n<li><strong>Write attempts are blocked and logged.<\/strong> While a session is live, Tracedown strips plugin-management capabilities from the session user and vetoes any attempt to write the active plugin list, from any source, at the last possible moment. If something tries, you are told what tried.<\/li>\n<li><strong>It refuses rather than half-installing.<\/strong> If the mu-plugins directory is not writable, file modifications are disabled, the site is multisite, a <code>.maintenance<\/code> file is present, another must-use plugin already filters the same list, or a test write does not read back from the database, Tracedown declines to start and tells you exactly which of those it was.<\/li>\n<li><strong>It removes itself when it should.<\/strong> If the Tracedown plugin folder disappears (deleted over SFTP mid-session, for instance), the safe-mode file deletes itself on the next request instead of stranding an orphan. It also deletes itself after two consecutive fatal errors attributable to its own code.<\/li>\n<\/ul>\n\n<h4>What it does not do<\/h4>\n\n<p>Tracedown states its limits rather than returning a confident wrong answer.<\/p>\n\n<ul>\n<li>It cannot test must-use plugins, drop-ins such as <code>object-cache.php<\/code> or <code>advanced-cache.php<\/code>, <code>wp-config.php<\/code>, your theme beyond a single default-theme comparison, WordPress core, or your host's configuration. Those are reported as untested scope.<\/li>\n<li>Plugins you pin cannot be identified as the culprit, and the report says so by name. Security, firewall, two-factor, login and SSL plugins are pinned by default.<\/li>\n<li>Multisite is refused outright in this version.<\/li>\n<\/ul>\n\n<h4>Prior art<\/h4>\n\n<p>Tracedown is an original, clean-room implementation, but it is not the first plugin to work this way and it does not pretend to be. <a href=\"https:\/\/wordpress.org\/plugins\/health-check\/\">Health Check &amp; Troubleshooting<\/a> established the mu-plugin-filters-<code>active_plugins<\/code> approach that every tool in this category, including this one, depends on. Plugin Detective popularised searching for the conflict rather than making the user toggle plugins by hand. Both are GPL, both are worth your respect, and Tracedown differs from them in architecture rather than in ambition: no write to <code>active_plugins<\/code>, expiry evaluated on read, and a deterministic minimal-set search.<\/p>\n\n<h3>What Tracedown writes to your site<\/h3>\n\n<p>Two files, both only while a session is running, both removed when it ends:<\/p>\n\n<ul>\n<li><code>wp-content\/mu-plugins\/tracedown-safe-mode.php<\/code> (default location): the must-use plugin that hides plugins from your own requests. It is a fixed file bundled with the plugin, copied byte for byte. Nothing you type ever reaches its contents. Deleting it ends the session immediately and returns the site to normal.<\/li>\n<li><code>wp-content\/uploads\/tracedown\/snapshot-&lt;site id&gt;-&lt;random&gt;.json<\/code> (default location): a plain JSON list of the plugins that were active when the session began. It exists so <code>wp tracedown restore<\/code> can read the original list even if the database record and the plugin itself are gone. It is data, never code. Its name carries a random part so it cannot be guessed, and the folder also carries an <code>.htaccess<\/code> deny rule and an empty <code>index.php<\/code>.<\/li>\n<\/ul>\n\n<p>A small number of <code>tracedown_*<\/code> rows are stored in the options table. Everything above is removed on uninstall.<\/p>\n\n<p>Tracedown never writes the <code>active_plugins<\/code> option.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install and activate Tracedown like any other plugin.<\/li>\n<li>Go to <strong>Tracedown<\/strong> in the admin menu.<\/li>\n<li>Read the preflight result. If anything is refused, fix that first. Tracedown will not start a partial session.<\/li>\n<li>Start a session. Tracedown writes one file to <code>wp-content\/mu-plugins\/<\/code> and verifies the site still responds before handing control back to you.<\/li>\n<li>Isolate the conflict, copy the report, then exit. Or close the tab: the session expires on its own.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"my%20site%20says%20%22there%20has%20been%20a%20critical%20error%20on%20this%20website%22.%20can%20tracedown%20find%20which%20plugin%20caused%20it%3F\"><h3>My site says \"There has been a critical error on this website\". Can Tracedown find which plugin caused it?<\/h3><\/dt>\n<dd><p>Yes, as long as you can still reach wp-admin. Start a session, choose \"Find it for me\", and Tracedown probes your front page with different subsets of plugins loaded until it has the smallest set that still reproduces the error. A PHP fatal error, a 500, a white screen and a blank page all count as broken. If the error is also on the admin side and you cannot log in, see the next question.<\/p><\/dd>\n<dt id=\"nothing%20loads%2C%20not%20even%20the%20login%20page.%20what%20now%3F\"><h3>Nothing loads, not even the login page. What now?<\/h3><\/dt>\n<dd><p>Tracedown needs wp-admin to run. If WordPress cannot start at all, rename the plugins folder over SFTP or your host's file manager to get back in, then let Tracedown name the culprit so you only have to remove one plugin instead of guessing.<\/p><\/dd>\n<dt id=\"my%20site%20broke%20right%20after%20a%20plugin%20or%20wordpress%20update.%20how%20do%20i%20find%20which%20plugin%20did%20it%3F\"><h3>My site broke right after a plugin or WordPress update. How do I find which plugin did it?<\/h3><\/dt>\n<dd><p>Run a session. Tracedown tests the plugins that are active right now and returns the minimal set that reproduces the fault, so a plugin that only breaks in combination with another one is still caught. The report lists the plugin name, file and version so you can roll it back or report the bug.<\/p><\/dd>\n<dt id=\"how%20is%20this%20different%20from%20deactivating%20plugins%20one%20by%20one%3F\"><h3>How is this different from deactivating plugins one by one?<\/h3><\/dt>\n<dd><p>Three ways. It is faster: a deterministic halving search needs a handful of probes instead of one per plugin. It is safer: nothing is ever written to the active plugin list, so there is no \"I deactivated everything and now I cannot remember what was on\" moment. And it is correct for pairs: two plugins that only break together are found, where a one-at-a-time check reports every single plugin as fine.<\/p><\/dd>\n<dt id=\"how%20is%20this%20different%20from%20the%20health%20check%20troubleshooting%20mode%3F\"><h3>How is this different from the Health Check troubleshooting mode?<\/h3><\/dt>\n<dd><p>Same family of idea, different architecture. Both use a must-use plugin to filter the plugin list for one administrator. Tracedown additionally never writes the <code>active_plugins<\/code> option on any code path, so there is no restore step that can fail and leave plugins deactivated. It also runs the search for you and names a minimal set instead of leaving the toggling to you.<\/p><\/dd>\n<dt id=\"will%20my%20visitors%20see%20the%20site%20with%20plugins%20disabled%3F\"><h3>Will my visitors see the site with plugins disabled?<\/h3><\/dt>\n<dd><p>No. The filter only applies to requests carrying your signed session cookie. Tracedown also marks its own responses as uncacheable so a page cache or CDN cannot store a safe-mode response and serve it to someone else. There is a button in the session bar that opens a logged-out preview so you can see this for yourself.<\/p><\/dd>\n<dt id=\"what%20happens%20if%20i%20close%20the%20tab%20and%20forget%20about%20it%3F\"><h3>What happens if I close the tab and forget about it?<\/h3><\/dt>\n<dd><p>The session ends by itself. Expiry is evaluated every time the safe-mode file loads, so it needs no cron job, no scheduled task, no traffic and no action from you. Nothing was written to the database, so when the session ends the site is exactly as it was.<\/p><\/dd>\n<dt id=\"what%20happens%20if%20my%20site%20was%20already%20down%20when%20i%20started%3F\"><h3>What happens if my site was already down when I started?<\/h3><\/dt>\n<dd><p>If WordPress cannot start at all, no plugin can help you, including this one. Add <code>define( 'TRACEDOWN_DISABLE', true );<\/code> to <code>wp-config.php<\/code> or delete <code>wp-content\/mu-plugins\/tracedown-safe-mode.php<\/code>, and you are back to the state you were in before Tracedown was involved.<\/p><\/dd>\n<dt id=\"does%20it%20deactivate%20my%20plugins%3F\"><h3>Does it deactivate my plugins?<\/h3><\/dt>\n<dd><p>No. It changes what WordPress loads for one request, for one person. The stored list of active plugins is never modified, which is also why Tracedown complies with the WordPress.org rule that a plugin may not change the activation status of other plugins.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20wp-cli%3F\"><h3>Does it work with WP-CLI?<\/h3><\/dt>\n<dd><p>Yes, and safe mode never applies to WP-CLI. <code>wp tracedown status<\/code>, <code>wp tracedown abort<\/code>, <code>wp tracedown restore<\/code> and <code>wp tracedown nuke<\/code> are registered from the safe-mode file so they keep working even while the plugin itself is filtered out of the active list.<\/p><\/dd>\n<dt id=\"multisite%3F\"><h3>Multisite?<\/h3><\/dt>\n<dd><p>Refused in this version, with a message explaining why. Network, site and subsite activation are three separate states and a partial implementation would be worse than none.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>First release.<\/li>\n<\/ul>","raw_excerpt":"Finds the plugin behind a critical error or white screen, without ever writing the active plugin list. You cannot get stuck, and you get a name.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/sw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/357220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/sw.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/sw.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=357220"}],"author":[{"embeddable":true,"href":"https:\/\/sw.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/kuber8821"}],"wp:attachment":[{"href":"https:\/\/sw.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=357220"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/sw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=357220"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/sw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=357220"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/sw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=357220"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/sw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=357220"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/sw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=357220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}