Orpharion for WordPress Plugin Directory

The wp_options table accumulates leftovers from plugins and themes that have been deactivated or deleted but never cleaned up. Those rows bloat the autoload payload on every page load and there is no built-in way to decide which ones are safe to remove.

Orpharion observes which options are actually read at runtime, attributes each read to the plugin or theme that caused it, and surfaces the raw signals (accessor, autoload flag, size, last-read timestamp) so administrators can decide what to remove:

Observe — the tracker records when and by whom each option is read, using the live PHP backtrace to identify the real caller.

Quarantine — rename the option temporarily so WordPress and the accessing plugin can no longer see it; confirm nothing breaks.

Delete — the row is removed from both wp_options and the tracking table. Use the Export selected bulk action first if you want a restore copy; Orpharion never writes option_value content to the server filesystem on your behalf (option_value can contain API keys, SMTP credentials, and other secrets that should not leak into backups of wp-content/).

Core WordPress options are locked out of destructive operations, on both the deletion and the import side.

The full PHP source ships uncompiled with the plugin; the non-compiled source of the compiled admin bundle (build/index.js, build/index.css) is published at https://github.com/mt8/orpharion — see the Source code section below for the exact build steps.

Source code The published plugin ships with the compiled admin bundle in build/ (build/index.js, build/index.css, build/index.asset.php). The non-compiled source for that bundle lives in src/ in the public GitHub repository:

Repository: https://github.com/mt8/orpharion

Build tool: @wordpress/scripts (uses webpack + Babel under the hood).

Reproduce the bundle:

Clone the repository.

Install dependencies: npm install (Node.js version compatible with @wordpress/scripts is required).

Build: npm run build — produces the same build/ files that are shipped with the plugin.

Watch mode for development: npm run start.

PHP code is shipped uncompiled and is the same in the published ZIP and in the repository.

Features

Per-option read tracking via dynamically registered option_{$name} filters, so every get_option() call is attributed to the real plugin or theme on the call stack.

Accessor inference (live tracker data → slug prefix → curated core list) with an active / inactive flag so you can filter down to options whose owner is no longer present.

Sortable options table with individual columns for accessor, autoload, size, and last-read timestamp — no opaque composite score.

Quarantine mode with automatic expiry (restore / delete / keep) and a manifest table that flags options that are still being accessed.

No server-side backup: JSON exports are browser downloads (or explicit CLI --output), never written to disk on the server — so option_value content does not leak into wp-content/ snapshots.

REST API under /wp-json/orpharion/v1/* (requires manage_options).

WP-CLI commands for scripted pipelines, including --accessor-type / --inactive-only filters on list, export, and clean (clean requires an explicit --i-have-a-backup acknowledgment).

License This plugin is licensed under the GPL, version 2 or later.