0 Day Analytics – Requests Module Developer Documentation

The Requests Module provides comprehensive monitoring and logging of all HTTP API requests (outgoing wp_remote_* calls) and incoming REST API requests on a WordPress site. It stores every captured request in a dedicated database table and presents them via a WP_List_Table-based admin interface with analytics dashboard, filtering, searching, and export capabilities.

Key Capabilities

• Intercept and log all outgoing HTTP API requests via pre_http_request and http_api_debug hooks
• Intercept and log all incoming REST API requests via rest_pre_dispatch and rest_request_after_callbacks hooks
• Automatic identification of the originating plugin/theme via PHP stack trace analysis
• Full request/response capture with automatic sensitive data redaction
• Analytics dashboard with totals, error rates, top domains, and performance trends
• Advanced filtering by status, type, plugin, domain, date range, and runtime range
• CSV export with filter context preservation
• Toggle HTTP/REST monitoring independently via REST API
• Automatic cleanup via configurable cron schedule
• Table management (truncate/drop) via REST API

Technology Stack

• PHP 7.4+ (strict types)
• WordPress WP_List_Table API
• WordPress wp-api-fetch for REST interactions
• Custom database table with optimised indexes
• jQuery for modal interactions, vanilla JS for table management

advanced-analytics/
├── classes/
│   └── vendor/
│       ├── controllers/
│       │   ├── class-requests-log.php        — Request capture (HTTP + REST hooks)
│       │   └── api/
│       │       └── class-endpoints.php       — REST API registration
│       ├── lists/
│       │   ├── class-requests-list.php       — WP_List_Table for requests display
│       │   └── views/
│       │       └── class-requests-view.php   — Page rendering, modal, analytics
│       ├── helpers/
│       │   ├── class-ajax-helper.php         — AJAX endpoints (CSV export)
│       │   └── class-plugin-theme-helper.php — Plugin identification from file paths
│       ├── entities/
│       │   └── class-requests-log-entity.php — DB entity, schema, migrations
│       ├── settings/
│       │   └── settings-options/
│       │       └── request-list.php          — Settings form fields
│       └── checks/
│           └── speed/
│               └── class-external-requests-check.php — Performance audit
└── assets/
    ├── css/                                  — Stylesheets
    └── js/                                   — JavaScript files

UI Components

• Status notices — Warnings when logging or HTTP/REST monitoring is disabled
• Analytics dashboard — Summary cards, status/type breakdowns, top domains, trend table
• Filter controls — Plugin, status, type, date range, domain, runtime range dropdowns and inputs
• Search box — Full-text search across all columns (input name: s)
• Sortable columns — Date, Type, Plugin, Status, URL, Page, Domain, User, Runtime
• Pagination — Configurable via screen options
• Row actions — Delete | Details (per row)
• Bulk actions — Delete Records (for selected rows)
• CSV Export — Export current filtered view to CSV
• Table management — Truncate / Drop table controls (via help panel)

┌──────────────────────────────────────────────────────────────┐
│  Requests                                                    │
│──────────────────────────────────────────────────────────────│
│  ⚠ Status notices (if logging/monitoring disabled)           │
│──────────────────────────────────────────────────────────────│
│  ┌─────────┐ ┌──────────┐ ┌──────────┐ ┌────────┐ ┌──────┐   │
│  │  Total  │ │ Last 24h │ │ Last 7d  │ │Avg Time│ │Errors│   │
│  └─────────┘ └──────────┘ └──────────┘ └────────┘ └──────┘   │
│  By Status | By Type | Top 10 Domains | 30-Day Trends        │
│──────────────────────────────────────────────────────────────│
│  [Plugin ▼][Status ▼][Type ▼][From][To][Domain][Min][Max]    │
│  [Filter] [Clear Filters]              [CSV Export] [🔍]     │
│──────────────────────────────────────────────────────────────│
│  ☐ Date ↕ | Type ↕ | Plugin ↕ | Status ↕ | URL ↕ | ...       │
│  ☐ 2026.. | admin  | woo..    | success  | https..| ...      │
│     Delete | Details                                         │
│──────────────────────────────────────────────────────────────│
│  Bulk Actions [▼] [Apply]               ‹ 1 of 5 ›           │
└──────────────────────────────────────────────────────────────┘

Modal Sections

• Header — Request type, status badge, runtime, domain
• URLs — Page URL (origin) and Request URL (target)
• Request panel — JSON-formatted request arguments with copy/share buttons
• Response panel — JSON-formatted response summary with copy/share buttons
• Stack trace — Full PHP call stack that triggered the request

Available Settings

Core request capture controller. Hooks into WordPress HTTP API and REST API lifecycle to intercept and log every request. Uses the Controller_Init_Trait for conditional initialisation based on settings.

Initialisation Flow

<?php
// 1. Check master toggle
if ( Settings::get_option( 'requests_module_enabled' ) ) {
    // 2. Check logging toggle via conditional_init()
    static::conditional_init( 'advana_requests_enable', function() {
        // 3. Register HTTP hooks (if not disabled)
        if ( ! Settings::get_option( 'advana_http_requests_disable' ) ) {
            add_filter( 'pre_http_request', [ __CLASS__, 'pre_http_request' ], 0, 3 );
            add_action( 'http_api_debug', [ __CLASS__, 'capture_request' ], 10, 5 );
        }
        // 4. Register REST hooks (if not disabled)
        if ( ! Settings::get_option( 'advana_rest_requests_disable' ) ) {
            add_filter( 'rest_pre_dispatch', [ __CLASS__, 'pre_http_request' ], 0, 3 );
            add_filter( 'rest_request_after_callbacks', [ __CLASS__, 'capture_rest_request' ], 10, 3 );
        }
    });
}

Properties

Extends Abstract_List (which extends WP_List_Table). Handles the requests admin list table rendering, column management, sorting, searching, filtering, bulk operations, CSV export, and the monitoring toggle REST endpoint.

Constants

<?php
const PAGE_SLUG             = ADVAN_INNER_SLUG . '_page_advan_requests';
const SCREEN_OPTIONS_SLUG   = 'advanced_analytics_requests_list';
const SEARCH_INPUT          = 's';
const REQUESTS_MENU_SLUG    = 'advan_requests';
const PLUGIN_FILTER_ACTION  = self::PAGE_SLUG . '_filter_plugin';

Key Methods

Handles page rendering for the requests list screen, the details modal, analytics dashboard, and form processing.

Key Methods

Database entity class for the requests log table. Extends Abstract_Entity and defines the table schema, column types, default values, creation SQL, and migration methods.

Table Name

<?php
protected static $table = ADVAN_PREFIX . 'requests_log';
// Resolves to: {wp_prefix}advan_requests_log

Fields Definition

Database Indexes

Migration Methods

Each logged request is stored as a row in the {prefix}advan_requests_log table. The log entry is built inside the capture methods:

<?php
$log_entry = array(
    'url'            => 'https://api.wordpress.org/plugins/...',  // Target URL
    'page_url'       => 'https://example.com/wp-admin/...',       // Origin page
    'type'           => 'admin',                                   // Request context
    'domain'         => 'api.wordpress.org',                       // Extracted domain
    'user_id'        => 1,                                         // WP user ID (0 = anonymous)
    'runtime'        => 0.245,                                     // Seconds elapsed
    'request_status' => 'success',                                 // success | error | timeout
    'request_group'  => '',                                        // Optional grouping
    'request_source' => '',                                        // Optional source identifier
    'request_args'   => '{"method":"GET","timeout":10,...}',       // JSON (sanitised)
    'response'       => '{"response_code":200,"body_preview":"..."}', // JSON (sanitised)
    'date_added'     => 1711360000,                                // Unix timestamp
    'requests'       => 3,                                         // Nth request in this page load
    'trace'          => '[{"file":"...","line":42,...},...]',       // JSON stack trace
    'plugin'         => 'woocommerce',                             // Identified originating plugin
);

Create Table SQL

CREATE TABLE `{prefix}advan_requests_log` (
    id BIGINT unsigned NOT NULL AUTO_INCREMENT,
    type VARCHAR(20) NOT NULL DEFAULT "",
    plugin VARCHAR(200) NOT NULL DEFAULT "",
    url TEXT(2048),
    page_url TEXT(2048),
    user_id BIGINT unsigned NOT NULL DEFAULT 0,
    domain VARCHAR(255),
    runtime DECIMAL(10,3),
    request_status VARCHAR(20),
    request_group VARCHAR(20),
    request_source VARCHAR(255),
    request_args MEDIUMTEXT,
    response MEDIUMTEXT,
    date_added DOUBLE NOT NULL DEFAULT 0,
    requests SMALLINT unsigned NOT NULL DEFAULT 0,
    trace MEDIUMTEXT,
    PRIMARY KEY (id),
    KEY `runtime` (`runtime`),
    KEY `idx_date_status` (`date_added`, `request_status`(10)),
    KEY `idx_plugin_type` (`plugin`(50), `type`),
    KEY `idx_domain` (`domain`(50)),
    KEY `idx_user_id` (`user_id`),
    KEY `idx_runtime_status` (`runtime`, `request_status`(10))
);

HTTP API Request Flow

1. WordPress core calls wp_remote_get(), wp_remote_post(), or similar
2. pre_http_request filter fires (priority 0) → Requests_Log::pre_http_request() records the start time
3. WordPress HTTP transport executes the request
4. http_api_debug action fires (priority 10) → Requests_Log::capture_request() captures URL, args, response, runtime, trace
5. The log entry is sanitised (sensitive data redacted, values truncated) and inserted into the database via Requests_Log_Entity::insert()

REST API Request Flow

1. An incoming REST API request is dispatched by rest_api_loaded()
2. rest_pre_dispatch filter fires (priority 0) → Requests_Log::pre_http_request() records the start time
3. WordPress dispatches the request to the matching route callback
4. rest_request_after_callbacks filter fires (priority 10) → Requests_Log::capture_rest_request() captures route, attributes, response, runtime, trace
5. The log entry is sanitised and inserted into the database

Plugin Identification

The originating plugin is identified by analysing the PHP stack trace. The 8th frame in the trace is inspected for a file path, which is then matched against known plugin directories using Plugin_Theme_Helper::get_plugin_from_file_path().

Toggle HTTP/REST Monitoring GET

Example: Disable HTTP monitoring

wp.apiFetch({
    path: '/0-day/v1/requests/http/disable/',
}).then(function(response) {
    console.log('HTTP monitoring disabled');
}).catch(function(err) {
    console.error('Failed:', err.message);
});

Example: Enable REST monitoring

wp.apiFetch({
    path: '/0-day/v1/requests/rest/enable/',
}).then(function(response) {
    console.log('REST monitoring enabled');
}).catch(function(err) {
    console.error('Failed:', err.message);
});

Truncate Table DELETE

Success Response

{
    "success": true
}

Drop Table DELETE

Get Single Record GET

The requests module uses generic AJAX handlers shared across the plugin.

CSV Export AJAX

The export respects the current filter context and operates in chunks to handle large datasets. A cleanup action (aadvana_export_large_csv_cleanup) removes temporary files after download.

JavaScript Example

var formData = new FormData();
formData.append('action', 'aadvana_export_large_csv');
formData.append('typeExport', 'requests');
formData.append('_wpnonce', wpNonce);
formData.append('status_filter', 'error');  // Optional filter

fetch(ajaxurl, {
    method: 'POST',
    body: formData,
})
.then(function(r) { return r.json(); })
.then(function(data) {
    if (data.success) {
        console.log('Export file:', data.data.file);
    }
});

WordPress Hooks Used for Capture FILTER ACTION

Plugin-Specific Hooks HOOK

Example: Register a Custom Cron Schedule for Cleanup

<?php
// Add a custom cleanup interval (every 6 hours)
add_filter( 'cron_schedules', function( $schedules ) {
    $schedules['every_six_hours'] = array(
        'interval' => 21600,
        'display'  => __( 'Every 6 Hours' ),
    );
    return $schedules;
});

// This new schedule will appear in the "Clear requests table every" dropdown
// on the Settings page (Request Options tab).

Settings are rendered using the plugin’s Settings::build_option() builder. The request settings are on the Request Options tab within the main settings page.

<?php
// Check if requests module is enabled
$enabled = Settings::get_option( 'requests_module_enabled' );

// Check if logging is active
$logging = Settings::get_option( 'advana_requests_enable' );

// Check individual monitoring toggles
$http_disabled = Settings::get_option( 'advana_http_requests_disable' );
$rest_disabled = Settings::get_option( 'advana_rest_requests_disable' );

// Get cleanup schedule
$schedule = Settings::get_option( 'advana_rest_requests_clear' );

Settings Builder Usage

<?php
// How settings are defined in request-list.php
Settings::build_option(
    array(
        'title' => esc_html__( 'Request Options', '0-day-analytics' ),
        'id'    => 'options-settings-tab',
        'type'  => 'tab-title',
    )
);

Settings::build_option(
    array(
        'name'    => esc_html__( 'Enable requests module', '0-day-analytics' ),
        'id'      => 'requests_module_enabled',
        'type'    => 'checkbox',
        'hint'    => esc_html__( 'Controls the entire requests module.', '0-day-analytics' ),
        'toggle'  => '#advana_requests_settings-item',
        'default' => Settings::get_option( 'requests_module_enabled' ),
    )
);

// The toggle attribute creates a show/hide dependency on the target element.
// When the checkbox is unchecked, #advana_requests_settings-item is hidden.

Settings Dependency Chain

requests_module_enabled (master toggle)
  └── advana_requests_enable (logging toggle)
        ├── advana_http_requests_disable (HTTP sub-toggle)
        └── advana_rest_requests_disable (REST sub-toggle)
advana_rest_requests_clear (cleanup schedule — independent)

Columns

Filter Parameters (GET)

Row Actions (per request entry)

Bulk Actions

Processing Flow

1. Bulk actions are detected in handle_table_actions()
2. Called from process_actions_load() on the load-{page_slug} hook (before output)
3. Nonce verification: auto-generated bulk-{plural} nonce by WP_List_Table
4. Capability check: manage_options required
5. After processing, a safe redirect is performed to clean up the URL

The analytics dashboard is rendered by Requests_View::render_analytics_dashboard() using data from Requests_View::get_analytics_data().

Data Queries

Dashboard Components

• Summary cards — Total, Last 24h, Last 7d, Avg Runtime, Error Rate
• Status breakdown — Clickable counts per status (filters the list on click)
• Type breakdown — Clickable counts per context type (filters the list on click)
• Top 10 Domains — Most contacted domains (clickable to filter)
• Performance Trends — Daily table with request count and average runtime for the last 30 days

Sensitive Data Redaction

The sanitize_request_args() method automatically redacts values for the following keys (case-insensitive):

<?php
$redact_keys = array(
    'authorization', 'proxy-authorization',
    'cookie', 'set-cookie',
    'x-api-key', 'x-auth-token',
    'api_key', 'apikey',
    'password', 'pass', 'secret', 'client-secret',
    'token', 'access_token', 'refresh_token',
    'signature', '_wpnonce', 'nonce', 'code',
);

Data Size Limits

URL Sanitization

Page URLs are sanitised via sanitize_url() before storage. Sensitive query parameters (tokens, keys, passwords) are stripped from the URL string.

Database Security

• All queries use $wpdb->prepare() with parameterised placeholders
• All filter inputs are validated against whitelists (status, type) or sanitised with sanitize_text_field()
• Date range values are validated with regex: /^\d{4}-\d{2}-\d{2}$/
• Runtime values are validated as numeric before inclusion in queries
• Table names are validated with preg_match( '/^[a-zA-Z0-9_]+$/' ) in create_table()

Access Control

• Admin pages require manage_options capability
• REST API endpoints require manage_options capability
• Bulk actions verify nonces and capabilities before processing
• Plugin filter form submissions verify nonces via check_admin_referer()

Example 1: Check if Request Logging is Active

<?php
use ADVAN\Helpers\Settings;

$module_on  = Settings::get_option( 'requests_module_enabled' );
$logging_on = Settings::get_option( 'advana_requests_enable' );
$http_off   = Settings::get_option( 'advana_http_requests_disable' );
$rest_off   = Settings::get_option( 'advana_rest_requests_disable' );

if ( $module_on && $logging_on ) {
    if ( ! $http_off ) {
        // HTTP request logging is active
    }
    if ( ! $rest_off ) {
        // REST request logging is active
    }
}

Example 2: Toggle Monitoring via REST API (JavaScript)

// Disable HTTP monitoring
wp.apiFetch({
    path: '/0-day/v1/requests/http/disable/',
}).then(function() {
    console.log('HTTP monitoring disabled');
});

// Enable REST monitoring
wp.apiFetch({
    path: '/0-day/v1/requests/rest/enable/',
}).then(function() {
    console.log('REST monitoring enabled');
});

Example 3: Query Requests from the Database

<?php
use ADVAN\Entities\Requests_Log_Entity;

// Get the table name
$table = Requests_Log_Entity::get_table_name();

// Count error requests in the last 24 hours
global $wpdb;
$error_count = $wpdb->get_var(
    $wpdb->prepare(
        "SELECT COUNT(*) FROM {$table} WHERE request_status = %s AND date_added >= %d",
        'error',
        strtotime( '-24 hours' )
    )
);

// Get top 5 slowest requests
$slowest = $wpdb->get_results(
    "SELECT url, runtime, plugin, request_status 
     FROM {$table} 
     ORDER BY runtime DESC 
     LIMIT 5",
    ARRAY_A
);

Example 4: Truncate the Requests Table Programmatically

<?php
use ADVAN\Entities\Requests_Log_Entity;
use ADVAN\Entities_Global\Common_Table;

Common_Table::truncate_table( null, Requests_Log_Entity::get_table_name() );

Example 5: Add a Custom Cleanup Schedule

<?php
// Register a custom schedule
add_filter( 'cron_schedules', function( $schedules ) {
    $schedules['every_six_hours'] = array(
        'interval' => 21600,
        'display'  => __( 'Every 6 Hours' ),
    );
    return $schedules;
});

// The new schedule will automatically appear in the
// "Clear requests table every" dropdown on the settings page.

Example 6: Truncate Table via REST API (JavaScript)

wp.apiFetch({
    path: '/0-day/v1/truncate_table/wp_advan_requests_log/',
    method: 'DELETE',
    cache: 'no-cache',
}).then(function(response) {
    if (response.success) {
        console.log('Requests table truncated');
        location.reload();
    }
}).catch(function(err) {
    console.error('Truncate failed:', err.message);
});

Example 7: Get Request Details via REST API

// Fetch a single request record by ID
wp.apiFetch({
    path: '/0-day/v1/get_table_record/wp_advan_requests_log/42/',
}).then(function(record) {
    console.log('Request URL:', record.url);
    console.log('Runtime:', record.runtime, 'seconds');
    console.log('Status:', record.request_status);
});