Modules Insight helps WordPress developers and site managers audit installed plugins, assess the risk of upgrading PHP and WordPress, and export complete reports — all from a single on-demand scan.
What’s new in 4.0
- WordPress upgrade risk — a second risk column alongside PHP, rated against a target WordPress version you choose (up to 7.1).
- PHP 8.5 added to the target-PHP selector.
- Send to Google Sheet — push the report straight into a spreadsheet via a Google Apps Script Web App you deploy once (no Google API keys stored in WordPress).
- Ask AI — for plugins the metadata can’t settle (Medium / High / Not on WP.org), ask a question and get an answer from the WordPress core AI Client. Requires WordPress 7.0+ with an AI provider configured under Settings AI; the feature hides itself otherwise.
PHP Upgrade Risk Evaluator
Planning a server PHP upgrade? MI queries the WordPress.org API for each installed plugin and produces a colour-coded risk table showing how likely each plugin is to break on your target PHP version.
Each plugin is rated Low, Medium, High, or Not on WP.org based on two signals:
1. Last Updated — how recently the plugin received a release on WordPress.org.
2. Minimum PHP Declared — the Requires PHP field set by the plugin author.
Risk is assigned as follows:
- High — Not updated in over 3 years, or declares a minimum PHP below 7.0. These carry the greatest risk of breaking on PHP 8.x and should be investigated before upgrading.
- Medium — Falls between High and Low. Test on a staging environment before upgrading production.
- Low — Updated within the last 12–18 months and declares PHP 7.4 or higher as its minimum. Likely compatible, but a quick smoke test after upgrading is still recommended.
- Not on WP.org — Not found in the WordPress.org directory (premium plugins, custom code). Compatibility must be verified manually with the vendor.
Important: risk ratings are based on publicly available metadata, not code analysis. A Low-rated plugin could still have incompatibilities; a High-rated plugin might work perfectly. Use the table as a triage guide, not a guarantee. Always test on a staging environment before upgrading PHP on a live server.
Results from the WordPress.org API are cached per plugin for 24 hours to avoid unnecessary external requests.
Plugin List and Reports
MI lists all installed plugins (active, inactive, and network-active on multisite) with version numbers, author details, and descriptions. It also reports the active WordPress version and active theme.
Reports can be exported as .json, .csv, .xlsx (best for Excel Online / SharePoint), or sent to a Google Sheet. All include the PHP and WordPress compatibility data if a check has been run prior to export.
Tested and fully compatible with WordPress 7.1.
WordPress Upgrade Risk Evaluator
The same check now rates each plugin against a target WordPress version too (selectable, up to 7.1). The signal is the plugin’s “Tested up to” value on WordPress.org combined with how recently it was updated: a plugin tested at or beyond your target is Low, one release behind and freshly updated is Low, several releases behind or long-stale is High. As with the PHP rating, this is a metadata signal, not a code scan — always test on staging.
Key Features
- PHP and WordPress upgrade risk evaluation via the WordPress.org API
- Two colour-coded risk columns: Low / Medium / High / Not on WP.org
- Selectable targets: PHP 8.0–8.5, WordPress 6.7–7.1
- Lists all installed plugins with status, version, author, and URIs
- Reports WordPress version and active theme
- Export as JSON, CSV, Excel (.xlsx), or straight to a Google Sheet (includes compat data when available)
- Ask AI about a specific plugin using the WordPress core AI Client (WordPress 7.0+, optional)
- Dashboard widget and
[plugin_list]shortcode - Scan-on-demand — nothing runs automatically on page load
- Read-only against your site — the only writes are the report rows you send to your own Google Sheet
External services
Modules Insight makes outbound requests only when an administrator asks it to:
- WordPress.org plugin API (api.wordpress.org) — during a compatibility check, to read each plugin’s last-updated date, “tested up to” and “requires PHP” values. Cached per plugin for 24 hours.
- Your Google Apps Script Web App — only if you configure the Google Sheets export, and only when you press Send report to Google Sheet. The plugin POSTs the report rows plus your shared secret token to the URL you provide.
- Your site’s AI provider — only if you use Ask AI. The request goes through the WordPress core AI Client to whichever provider your site admin configured under Settings AI. The plugin name, version, description, its WordPress.org metadata, your risk ratings and (if present) the plugin’s own readme.txt are sent as context.
Use Cases
- Assessing risk before upgrading PHP or WordPress on a server
- Managing multiple WordPress sites and keeping plugins audited
- Client-facing reports on installed plugins, collected in a shared Google Sheet
- Pre-deployment or pre-update plugin audits
Credits
Made with ❤️ by Pedro Matias for WordPress developers and admins.
Screenshots
The Modules Insight dashboard widget showing active/inactive plugins.
Example of a page generated using the shortcode and the collapsed description view using <details>.
The "Download List as JSON" button available to administrators and structure of the exported JSON file.
Example of "print" page using shortcode and automatic expanded description view using <details>.