Server-side sight for
Claude in Chrome.
Claude in Chrome sees the page. Understory Trace shows it everything underneath — slow queries, PHP notices, and which block broke a widget — then lets it audit the whole site: read the theme code, review plugin settings, catch script conflicts, and check for known vulnerabilities. All read-only, all as clean JSON built to be read by an AI.
TL;DR — the plain-English version
No jargon. Here's the whole idea.
Every website has two halves: the part you see in your browser, and the server behind it — the database, the code, the plugins doing the real work. When something breaks, the cause is usually hidden in that second half.
An AI in your browser (like Claude in Chrome) sees the first half but is blind to the second. Understory Trace is a flashlight for the hidden half. Tell it what's wrong in plain words — "why is this page slow?" — and it digs into the server and hands you a plain report: what's wrong, why, and how to fix it. No expertise required.
A plugin with a known hole
"One of your 40 plugins is several versions out of date and has a published vulnerability that attackers already know how to use."
Search that crawls
"Your site search takes 7 seconds — because a single database query is scanning every article you've ever published, the slow way."
An ad printing errors
"A misconfigured ad slot is literally printing a code error into the middle of your article, where readers can see it."
Double-counted traffic
"Your analytics tag is firing twice, so your visitor numbers are inflated — and you're making decisions on bad data."
A sluggish dashboard
"Your Posts screen runs 400 database queries because a background scheduler has quietly built up a huge backlog."
A free speed win, unused
"You already have a fast cache installed — it's just switched off. Flipping one setting would make every page quicker."
Headlines cut off in search
"Your article titles are too long, so Google chops them off in the results — quietly costing you clicks."
A page that jumps around
"Images load without reserved space, so the page shifts under readers' thumbs as it loads — which Google penalizes."
A missing security lock
"Your site is missing a standard security header, leaving a gap that attackers can probe."
A widget failing silently
"That newsletter box that never shows up? It's crashing on a hidden error partway through loading."
Links to nowhere
"Some of your links point to articles that no longer exist, sending readers — and Google — to dead 404 pages."
A plugin phoning home
"A plugin calls an outside server every time you open your dashboard, adding seconds before you can even start working."
From a single slow request to a full-site audit
Feature-detected, defensively collected, and redacted before anything leaves the server.
Query profile
Slowest queries, duplicates, and the exact function that issued them — plus autoloaded-options bloat, the classic admin slowdown.
PHP errors & flags
Warnings, notices, and deprecations captured during the request, each with file and line — plus a computed problem list so issues surface at a glance.
Element-to-source
Front-end block and widget output is wrapped in invisible markers, so a DOM region maps back to what produced it — and any PHP error behind it.
Timing, memory & more
Time-to-hook milestones, peak memory vs limit, outbound HTTP timing, cron backlog, object-cache and OPcache posture.
Theme-code review
Read the active theme's source — confined to the theme directory and scrubbed for hard-coded secrets — to evaluate it for security, correctness, and performance.
Plugin settings
A secret-safe view of any option: its shape (keys and types, no string values) by default, or actual values — still redacted — behind an explicit opt-in.
Script conflicts
The enqueued-asset dependency graph: missing dependencies that silently break a widget, duplicate libraries, and jQuery posture.
Vulnerability check
Cross-references active plugins against the public WPVulnerability.com database and lists any whose installed version has a known CVE. Opt-in.
Health & host
Debug / filesystem / HTTPS posture, pending plugin updates, and — on a managed host — deep-links to the real access, error, and cron logs.
Audit scope
Every exposure surface is a per-site toggle. Turn any of them off and its route returns 403 — least exposure, your call.
Read-only by design, on demand
Heavy work runs only when you ask for it — normal traffic and public visitors are untouched.
Arm profiling
Flip the admin-bar Understory toggle, or let Claude set the signed, hourly-rotating token. Only then do the heavy collectors run.
Reproduce it
Reload the slow admin page or the front-end page with the broken widget so the request runs profiled.
Read the capture
The in-page JSON bridge hands Claude a capture_id; one REST call returns the full diagnostics — flags first, then the offending query, hook, or block.
Trace to the source
Matching <!--utrace--> markers in the DOM connect the broken element to the block or widget — and any PHP error — behind it.
Point Claude at it
Nothing to reproduce — the audit surfaces need no profiling. Claude reads the self-describing schema and whatever audit scope you've allowed.
Read code & config
It reads the theme's source, reviews how each plugin is configured (secret-safe), and judges the server-health and script-conflict posture.
Check for known CVEs
With the vulnerability check enabled, it cross-references every plugin against the public database and flags the ones whose version is exploitable.
Get a prioritized report
It all comes back as clean JSON, so Claude hands you findings grouped Critical / Warnings / Opportunities — each with evidence, the owning plugin, and the fix.
Built to be trusted
Strictly read-only, admin-gated, redacted, and quiet — because it runs on production news sites.
Admin-gated
Every byte requires an administrator session plus a REST nonce — nothing is exposed to visitors.
Redaction-first
A redaction layer masks passwords, keys, tokens, and secrets — by name and by shape — before anything leaves the server.
Read-only
It reports; it never mutates your site. And every exposure surface is a toggle you control.
Quiet & lightweight
Zero steady-state overhead; captures live in a short-lived buffer in your own database. Nothing is sent anywhere by default — the only exception is the opt-in vulnerability check.
Changelog
Regenerated from the plugin's readme.txt on every build.
0.10.1
- The "Ask Claude" prompts now name the site's own URL on the site-level prompts (full audit, theme review, vulnerability check, best-practices audit), so they're unambiguous wherever they're pasted; added a "Website best-practices audit → PDF" prompt.
- Report generation: bundled `skill/make-report.py` renders a filled report to a paginated PDF (headless-Chrome print + a page-number footer on every page after the cover), and the playbook documents capturing screenshots as embedded `data:` URIs.
0.10.0
- Website best-practices audit + PDF report. The companion skill gains a full front-end & stack audit playbook — SEO & indexation, structured data, Core Web Vitals / performance, analytics & conversion tracking, security headers & CVEs, ad tech, links & crawl health, accessibility, and architecture — run from the browser with the plugin as the server-side corroborator, plus a branded, print-ready PDF report template (cover, executive summary, per-category sections with screenshots, Critical / Warnings / Opportunities). See `skill/best-practices-audit.md` and `skill/report-template.html`.
0.9.0
- "Ask Claude" panel on the Tools → Understory Trace page: ready-made, copy-to-clipboard prompts — a full site audit, a slow page, a broken widget, a theme-code review, and a vulnerability check — so you can drive the plugin from Claude in Chrome without knowing the protocol. Open Claude in Chrome on the tab, copy a prompt, paste it in.
0.8.0
- Cross-plugin vulnerability check (opt-in). `GET /vulnerabilities` cross-references the active plugins against the free, no-key WPVulnerability.com community database and reports any whose INSTALLED version has a known CVE — with CVE ids, CVSS score/severity, and the fixed-in version. This is the one feature that makes an outbound request, so it is off by default (audit-scope toggle `vuln_check`); it sends plugin slugs only (not versions — the version match runs locally), caches results for 12 hours, and identifies itself as only the plugin + version. Companion skill gains a vulnerability-check step in the code & config audit.
0.7.1
- Script-conflict analysis now walks only the transitive closure of the actually-enqueued assets (not every registered script), so `missing_deps` reports only dependencies that can really break the page — no more noise from the hundreds of registered-but-unused editor scripts. Duplicate-library detection is now a curated known-library scan (jQuery UI, Swiper, Slick, Bootstrap, React, …) keyed on source URLs, instead of grouping unrelated files by generic basenames like index.js/editor.js.
0.7.0
- Audit platform, phase B — "evaluate the settings". New read-only endpoints expose plugin/site options for a config review with a secret-safe model: `GET /options` lists option names + metadata (no values); `GET /option?name=X` shows one option's shape — keys and value types, with booleans/numbers shown but every string hidden — so a secret can never leak by default. `&reveal=1` returns actual values, but only when the "settings values" opt-in is on, and even then values are masked by sensitive-key name AND by a value-shape heuristic (`looks_secret`).
- Script-conflict analysis: captures now include an enqueued-asset conflict report — missing dependencies (a real "widget didn't load" cause), possible duplicate libraries, and jQuery posture.
- Audit-scope settings: a new panel (and `GET /status.scope`) with least-exposure toggles — theme code, plugin settings (shape), plugin settings values, server health, script conflicts. A disabled surface's route returns 403. Plugin-settings-value reveal is off by default.
- The settings secret model was verified by a multi-agent adversarial review; `looks_secret()` is pinned by tests/redact_harness.php.
0.6.2
- Redaction: slash-namespaced identifiers (WordPress block types like `core/paragraph`, and namespaced hooks like `vendor/system/thing`) are no longer over-masked in theme-source reads — a lone `/` inside a readable identifier is namespacing, not a base64 secret. Real base64 tokens and keys are still masked.
0.6.1
- Fixed: the new environment `health` block called `disk_free_space()`, which managed hosts (e.g. WordKeeper) commonly disable via `disable_functions` — and `@` does not suppress the resulting fatal, so the whole environment section came back as an error on those hosts. All such calls (`disk_free_space`, `php_uname`, `getmypid`) are now gated on `function_exists()`.
0.6.0
- Audit platform, phase A — "evaluate the code & config". New read-only endpoints expose the active theme's source for review: `GET /theme` lists each theme root's files and `GET /theme/file` returns one file's contents, confined to the theme directory (realpath-checked against traversal and symlink escape on both the request path and the resolved target, text/code files only, size-capped) and best-effort scrubbed for hard-coded secrets.
- Hardened the source-code secret scrubber (defense-in-depth, not a guarantee): masks quoted secrets by segment-matched name (SECRET_KEY, apiKey, pw…), known vendor token prefixes (Stripe/WooCommerce, AWS, GitHub, Google, SendGrid, GitLab, Slack), JWTs and Bearer tokens, URL-query secrets, PEM private keys, and heredoc/nowdoc bodies — while keeping ordinary identifiers legible. Verified by a multi-agent adversarial review and pinned by tests/redact_harness.php.
- Environment data gains a `health` block — debug-logging state, filesystem writability (a web-writable wp-config is flagged), free disk, HTTPS posture, and auto-update configuration — plus per-plugin update-available info and an `updates_pending` count.
- Companion skill: added Playbook D, a code & configuration audit protocol (read the theme source and health posture, evaluate for security/correctness/performance/hygiene, report alongside the runtime audit).
0.5.0
- Managed-host detection: on a WordKeeper host, the admin page and the environment data deep-link to the host's access/error/WP-Cron logs, so a diagnosis can be cross-checked against the real host logs (including uncaught fatals the plugin can't capture). Filterable via `utrace_host_manager`.
- Companion skill: added a full-site deep-dive audit playbook.
0.4.2
- Query Monitor ingestion now works with Query Monitor 4.x — reads collector data via QM's public get_data() API (QM 4.x moved data into protected QM_Data objects) after ensuring QM has processed.
0.4.1
- Admin page icon now uses the Understory Trace 🌿 logo, matching the branding.
0.4.0
- Captures now include a computed `flags` list (threshold warnings for PHP errors, slow requests, duplicate queries, autoload bloat, memory pressure, overdue cron, missing object cache, slow HTTP, and OPcache) so problems surface at a glance.
- Duplicate queries now report their total time and calling function.
- Pin a capture to keep it past the TTL, and download any capture as JSON, from the admin status page.
- Optional full-fidelity query capture: one-click install of a managed must-use drop-in that records the earliest bootstrap queries a normal plugin can't (with a manual fallback when mu-plugins isn't writable).
- Admin status page and GET /status now report auto-prune (WP-Cron) health and full-fidelity state.
- Admin status page restyled to the Orchard Grove Media house style (branded header, main + sidebar layout with an "At a glance" panel).
0.3.2
- Capture buffer now self-prunes on a scheduled WP-Cron event (every 10 minutes), so expired captures are removed even when profiling is never armed.
- Added a "Clear captures" button to the admin status page to empty the buffer on demand.
0.3.1
- Verified end-to-end on a live production-scale site. Corrected the plugin homepage URL to understorytrace.com.
0.3.0
- Phase 2: admin status page (Orchard Grove Media design system) with connection details, endpoint reference, and the recent-capture buffer; companion Claude skill with slow-page and broken-widget playbooks; Query Monitor ingestion (bonus corroborating data when QM is active); documentation.
0.2.0
- Phase 1b: front-end element-to-source mapping. While profiling, block and widget output is wrapped in invisible HTML-comment markers and a render map is captured (type, name, byte size, newly-emitted PHP errors) so a DOM region can be traced back to the block/widget/shortcode that produced it.
0.1.0
- Initial build (Phase 1): capture pipeline, signed on-demand profiling trigger, admin-bar toggle, in-page JSON bridge, REST API (schema/status/env/captures/capture), redaction layer, and core collectors (environment, request runtime, database + autoload, HTTP, cron, hooks).
Give Claude server-side sight.
Free, open source, and read-only. Install it, open Claude in Chrome, and ask.
Download v0.10.1 (.zip)/wp-content/plugins/ · activate · open Tools → Understory Trace and copy an Ask Claude prompt.Version 0.10.1 · GPL-2.0-or-later · Advanced:
GET /wp-json/understory-trace/v1/schema