Attic — Safe Database Audit

Descripción

Uninstalled and misbehaving plugins leave behind lingering database bloat — autoloaded options, ghost cron events, stranded transients, orphaned tables. Traditional cleanup tools reach for aggressive drop/delete queries that risk breaking your site.

Attic audits your WordPress database for bloat, without any of that:

  • Autoloaded option bloat — oversized options that load on every page request, ranked by size against Site Health’s 800 KB line.
  • Ghost cron events — scheduled hooks with no registered callback, firing forever and doing nothing.
  • Orphaned tables — tables no installed plugin claims, with reclaimable megabytes up front.
  • Stranded transients — expired timeout pairs and orphaned rows.
  • Leftovers from deleted plugins — data whose owning plugin is absent from disk entirely.

Two rules outrank every feature:

  1. Quarantine, never delete. Options are stored before removal. Tables are renamed (wp_attic_quarantined_*), never dropped until a purge window passes.
  2. Nothing is called orphaned until your code has been searched for it. Attic streams wp-content — plugins, mu-plugins, themes, wp-config.php — looking for every candidate name before promoting anything to high confidence.

Every finding shows its full evidence inline: which rule fired, what it attributed to and whether that plugin exists on disk, how many code references were found, and the size. A finding you cannot audit is a finding you should not act on.

Filters

  • attic_protected_options — additional never-flag option names
  • attic_protected_cron_hooks / attic_protected_tables — same, for cron and tables
  • attic_finding_confidence — last word on any single finding’s confidence
  • attic_reference_scan_roots — unusual layouts, custom content dirs

Instalación

  1. Upload the attic folder to /wp-content/plugins/.
  2. Activate the plugin through the Plugins menu in WordPress.
  3. Navigate to Tools Attic to run your first audit.

FAQ

Is this safe?

The scan is read-only. Nothing changes until you take an explicit, confirmed action. Core options like siteurl, active_plugins and cron can never be flagged, and neither can anything on your own protected list or the attic_protected_options filter.

How do I undo something?

Tools Attic Quarantine. Every action creates a batch; restore a whole batch in one click. Batches auto-purge after 30 days (configurable).

Why does my finding say «review» instead of «high»?

High confidence requires: the owning plugin absent from disk (or size-flagged and unread), AND zero literal AND zero prefix references in your code. Dynamic option names never literal-match, so weak signals still demote findings. If your filesystem could not be read, everything is marked unverified rather than guessed at.

Does it work with external object caches?

Yes — when Redis/Memcached is active, transients never touch the options table, and Attic says so instead of showing a meaningless clean bill of health.

Multisite?

Single-site and subdirectory multisite installs work. Network-wide fleet scanning is planned.

Reseñas

No hay valoraciones para este plugin.

Colaboradores y desarrolladores

«Attic — Safe Database Audit» es un software de código abierto. Las siguientes personas han colaborado con este plugin.

Colaboradores

Traduce «Attic — Safe Database Audit» a tu idioma.

¿Interesado en el desarrollo?

Revisa el código , echa un vistazo al repositorio SVN o suscríbete al registro de desarrollo por RSS.

Registro de cambios

1.0.1

  • Fix: Quarantine action now correctly updates finding state (broken by SQL syntax error).
  • Fix: Orphan tables rule no longer flags Attic’s own tables on sites with nested table prefixes (e.g. wp_pc_attic_*).
  • Add: Stop scan button to abort long-running scans mid-flight.
  • Fix: Findings page defaults to latest completed scan instead of showing duplicates across all scans.
  • Fix: Scan complete state now hides progress bar and stop button cleanly.
  • Fix: Empty quarantine batches are cleaned up automatically.

1.0.0

  • Initial plugin release: read-only database audit with quarantine-based undo, five detection rules, budgeted scan engine, reference scanning, quarantine with batch restore, and attribution map.