Kazuto Takeshita

The <code>wp_options</code> table accumulates leftovers from plugins and themes that have been deactivated or deleted but never cleaned up. Those rows bloat the autoload payload on every page load and there is no built-in way to decide which ones are safe to remove.
Orpharion observes which options are actually read at runtime, attributes each read to the plugin or theme that caused it, and surfaces the raw signals (accessor, autoload flag, size, last-read timestamp) so administrators can decide what to remove:
<ol>
<li>Observe — the tracker records when and by whom each option is read, using the live PHP backtrace to identify the real caller.</li>
<li>Quarantine — rename the option temporarily so WordPress and the accessing plugin can no longer see it; confirm nothing breaks.</li>
<li>Delete — the row is removed from both <code>wp_options</code> and the tracking table. Use the Export selected bulk action first if you want a restore copy; Orpharion never writes option_value content to the server filesystem on your behalf (option_value can contain API keys, SMTP credentials, and other secrets that should not leak into backups of <code>wp-content/</code>).</li>
</ol>
Core WordPress options are locked out of destructive operations, on both the deletion and the import side.
The full PHP source ships uncompiled with the plugin; the non-compiled source of the compiled admin bundle (<code>build/index.js</code>, <code>build/index.css</code>) is published at https://github.com/mt8/orpharion — see the Source code section below for the exact build steps.
<h3>Source code</h3>
The published plugin ships with the compiled admin bundle in <code>build/</code> (<code>build/index.js</code>, <code>build/index.css</code>, <code>build/index.asset.php</code>). The non-compiled source for that bundle lives in <code>src/</code> in the public GitHub repository:
<ul>
<li>Repository: https://github.com/mt8/orpharion</li>
<li>Build tool: <a href="https://www.npmjs.com/package/@wordpress/scripts" rel="nofollow ugc">@wordpress/scripts</a> (uses webpack + Babel under the hood).</li>
<li>
Reproduce the bundle:
<ol>
<li>Clone the repository.</li>
<li>Install dependencies: <code>npm install</code> (Node.js version compatible with <code>@wordpress/scripts</code> is required).</li>
<li>Build: <code>npm run build</code> — produces the same <code>build/</code> files that are shipped with the plugin.</li>
<li>Watch mode for development: <code>npm run start</code>.</li>
</ol>
</li>
</ul>
PHP code is shipped uncompiled and is the same in the published ZIP and in the repository.
<h3>Features</h3>
<ul>
<li>Per-option read tracking via dynamically registered <code>option_{$name}</code> filters, so every <code>get_option()</code> call is attributed to the real plugin or theme on the call stack.</li>
<li>Accessor inference (live tracker data → slug prefix → curated core list) with an active / inactive flag so you can filter down to options whose owner is no longer present.</li>
<li>Sortable options table with individual columns for accessor, autoload, size, and last-read timestamp — no opaque composite score.</li>
<li>Quarantine mode with automatic expiry (restore / delete / keep) and a manifest table that flags options that are still being accessed.</li>
<li>No server-side backup: JSON exports are browser downloads (or explicit CLI <code>--output</code>), never written to disk on the server — so option_value content does not leak into <code>wp-content/</code> snapshots.</li>
<li>REST API under <code>/wp-json/orpharion/v1/*</code> (requires <code>manage_options</code>).</li>
<li>WP-CLI commands for scripted pipelines, including <code>--accessor-type</code> / <code>--inactive-only</code> filters on <code>list</code>, <code>export</code>, and <code>clean</code> (<code>clean</code> requires an explicit <code>--i-have-a-backup</code> acknowledgment).</li>
</ul>
<h3>License</h3>
This plugin is licensed under the GPL, version 2 or later.

Orpharion

Track which plugin or theme accesses each wp_options row, then quarantine or clean orphans.

Tiago Hillebrandt

Optimize and Secure Your WordPress Site with Supervisor
Boost the performance and security of your WordPress site effortlessly with our powerful plugin. Supervisor provides vital insights into your site’s health directly through your WordPress Dashboard.
Key Features:
<ul>
<li>Performance Optimization: Improve your site’s speed by cleaning up transients and deactivating unnecessary autoload options.</li>
<li>Brute Force Protection: Shield your site from attacks with robust security measures designed to prevent unauthorized access.</li>
<li>Web Server Software Verification: Ensure your server software is up-to-date, keeping your site running smoothly and securely.</li>
<li>SSL Certificate Monitoring: Stay informed about your SSL certificate status with dashboard notifications for impending expirations or expired certificates.</li>
</ul>
Experience a faster and more secure WordPress site with Supervisor. Download it today and feel the difference!

Supervisor

Supervisor is a powerful plugin designed to enhance both the performance and security of your WordPress installation.

Orpharion vs Supervisor