What does Cron Forensics do?

WordPress runs background tasks on a schedule, such as checking for updates, sending emails, clearing old data or syncing with other services. These are called cron events. Most sites have dozens, added by WordPress itself and by your plugins.

Cron Forensics shows you every one of them: which plugin added it, how long it takes to run, what impact it has on performance, whether it’s working, and whether it’s slowing your site down.

Most cron plugins are unhelpful, simply giving you a list of events and leave you to work out what it all means. Cron Forensics does the investigative work for you. It flags problems, ranks them by how much they affect your site, and tells you what to do about each one.

Who is it for?

Fixing problems

• Anyone whose scheduled tasks don’t seem to be happening, like backups that didn’t run, emails that never sent or posts that missed their publish time.
• Anyone who’s seen a “missed schedule” error and wants to know why.
• Site owners whose host has warned them about high CPU usage and want to find the cause.
• Anyone troubleshooting a site that slows down at certain times of day.

Looking after sites

• Anyone who has inherited a site and wants to know what’s running behind the scenes.
• Freelancers who need a quick health check before taking on a new client site.
• Hosting and support teams who need clear evidence when a plugin is causing trouble.
• Anyone who wants a plain-English report to send to their developer or host.

Keeping sites tidy

• Site owners who like to keep their site lean and clutter-free.
• Anyone who has tried a lot of plugins over the years and never cleaned up after them.
• Anyone who has moved or copied a site and wants to clear out tasks that don’t belong.

Staying informed

• Anyone who wants an early warning when something starts going wrong, rather than finding out from a customer.
• Store owners and membership sites that rely on scheduled tasks for orders, renewals or emails.
• Site owners on a server cron setup who want confirmation it’s actually working.

Technical users

• Plugin and theme developers who want to see how their own scheduled tasks behave on a real site.
• Developers who want to measure a task’s real cost in time, CPU, memory, database queries and outside requests, not guess.

Where should I start?

Open Tools → Cron Forensics and check the Overview tab. It tells you at a glance whether WordPress’s scheduled tasks are running properly. If the WP-CRON card says anything other than “Running”, then you have a problem and should read this.

Go to Findings and start with anything marked Critical or High, and follow the recommendation for each.

Cron Forensics gets more useful as it records how your events actually run, so give it a day or more to learn.

If you’d like to hear about problems as they happen, turn on email alerts in the Alerts tab.

What kind of problems can it find?

• WordPress’s scheduled tasks have stopped running. Backups, emails and updates may be silently failing.
• A plugin is using a lot of CPU in the background, slowing the site for visitors.
• An event is waiting on a slow external service, holding up every task queued behind it.
• Leftovers from plugins you removed long ago, still sitting in your database.
• The same task scheduled twice, so it runs twice as often as it should.
• An event that keeps crashing, along with the error message.
• A plugin quietly adding a new background task you didn’t know about.

What do the WP-Cron statuses on the Overview tab mean?

Running
Everything’s working. WordPress is running its scheduled tasks, and the card shows how long ago the last run happened.

Tip: on quiet sites, “Last run” might say several hours ago. That’s normal, because WordPress only runs scheduled tasks when someone visits. If you need tasks to run on time regardless of traffic, ask your host to set up a server cron job (they can often enable this if it isn’t already).

Waiting
Cron Forensics hasn’t seen a scheduled task run since it was installed. This is normal for the first few minutes after activation, or a bit longer on a quiet site. Visit a page or two on your site and check again shortly.

If it still says Waiting after an hour or so, treat it as Stalled.

Stalled
WordPress’s scheduled tasks have stopped running. Backups, emails, updates and anything else on a schedule may be silently failing. The Findings tab will show a Critical finding explaining which of these two causes applies.

Cause 1: “WP-Cron isn’t running”. No scheduled tasks have run for over an hour and events are piling up as overdue. Common causes and fixes:

• Your site can’t reach itself.
  Go to System and click Run loopback test. If it fails, something is blocking your site’s requests to itself. Common culprits are password protection on the whole site (basic auth), a firewall, a security plugin or Cloudflare rules. Ask your host to allow requests to wp-cron.php from your own server.
• Your server cron job has stopped.
  If the card says Stalled and also shows DISABLE_WP_CRON is on, using server cron instead”, WordPress has been set to leave scheduled tasks to your server. Because nothing has run for over an hour, the server cron job has most likely stopped, been removed or started failing. Ask your host to check it. Alternatively, remove the DISABLE_WP_CRON line from wp-config.php so WordPress runs tasks itself again.
• The site is in maintenance mode or behind a coming-soon page that blocks all requests.
  Turn it off, or allow wp-cron.php through.

Cause 2: “WP-Cron lock is stuck”. WordPress uses a temporary lock to stop tasks running twice at once. If a task crashes at the wrong moment, the lock can get left behind and block everything after it. To fix it:

• Clear your site’s cache.
  If your host or a caching plugin uses an object cache (such as Redis or Memcached), flush it. That usually clears the lock.
• Check the History tab for an event marked “Crashed”.
  That’s probably what left the lock behind. Update the plugin responsible, or quarantine the event while you investigate.

What does “DISABLE_WP_CRON is on, using server cron instead” mean?

It’s information, not a warning. Your site has been set up so your server runs scheduled tasks on a timer, rather than WordPress running them when people visit. Many hosts do this by default, and it’s usually always the more reliable option. If the card says “Running”, everything is working as intended.

Overview

This is a quick health check.

It shows whether WordPress’s scheduled tasks are running, how many events your site has, which event uses the most CPU, which is the slowest, and your most important findings.

A timeline shows how many events are due in each hour over the next 24 hours, so you can spot busy periods.

Events

Every scheduled event on your site, with the plugin responsible, when it next runs, how often it repeats, and how it went last time.

Each event has a safety rating that tells you whether it’s safe to remove. From here you can run an event straight away, quarantine it or delete it.

Findings

The heart of the plugin. Everything suspicious is listed here, ranked from Critical to Low, with a short explanation and a recommendation for each. If this page is empty, your scheduled events are in good shape.

History

A record of every time an event has run: how long it took, how much CPU and memory it used, and whether it succeeded.

The table at the top is sorted by CPU usage, so the event working your server hardest is always easiest to spot.

Change Log

A timeline of every event that has been added, removed, deleted, quarantined or restored, and which plugin or person was responsible. It’s useful for answering “What changed?” when something stops working.

Quarantine

Quarantine is a safer alternative to deleting. A quarantined event stops running but is kept here, so you can restore it with one click if anything breaks.

A good approach is to quarantine a suspicious event and leave it for long enough to be confident it isn’t needed. There’s no set rule. A day may be long enough to determine on a busy site, while a quieter site might need a week or more for any problems to show up.

If your site is still working normally after that, you can safely delete the event.

Note: some plugins automatically re-create their events, so a quarantined or deleted event can reappear soon afterwards. When this happens, Cron Forensics marks it as Re-created and flags it on the Findings tab. There’s nothing you can do about the event itself; it belongs to that plugin. If you want it gone for good, your only option is to deactivate the plugin responsible.

Alerts

Choose whether to receive email alerts, who receives them, and exactly what triggers an alert.

Get notified only about serious problems or stay informed about everything. You can also receive alerts whenever a plugin adds a new background task. Choose to receive alerts immediately, in hourly batches, or as a daily digest.

System

Fine-tune how Cron Forensics works:

• Set what counts as slow or CPU-heavy.
• Choose how many days of history to keep.
• See how much database space the plugin is using.
• Download a plain-text report for your developer or host.
• Run a loopback test to check that your site can trigger its own scheduled tasks.
• Reset settings, history, quarantine or the change log.

Glossary of Terms

General terms

Cron event (or event)
A task WordPress has been asked to run in the background on a schedule, such as checking for updates, sending emails or cleaning up old data.

WP-Cron
WordPress’s built-in system for running scheduled events. It’s triggered when someone visits your site.

Server cron
A timer on your hosting server that runs scheduled events at set intervals, instead of relying on visitors to your website to trigger the WP-Cron.

Callback
The piece of code that does the actual work when an event runs. An event without a callback does nothing.

Arguments (Args)
Extra details passed to an event, such as an order number or a post ID. The same event can be scheduled many times with different arguments.

Registered by
The plugin, theme or part of WordPress responsible for an event.

Loopback
Your site sending a request to itself. WP-Cron needs this to work.

Execution results (History and Events tabs)

Completed
The event ran and finished without any problems.

Completed with warnings
The event finished, but PHP reported warnings along the way. Usually harmless, but worth keeping an eye on.

Error
The event ran into a problem it couldn’t recover from. The error message is shown underneath.

Crashed
The event stopped partway through, usually because of a fatal error, a timeout or running out of memory. A crash can often stop other events that are queued after it.

Nothing listening
The event ran, but no code responded to it, so nothing happened. This usually means the plugin that created it has been deactivated or removed.

Safety ratings (Events tab)

Safe
You can delete this event without any impact. It’s either a duplicate, or it belongs to a plugin that’s inactive or no longer installed.

Probably safe
Nothing responds to this event, so deleting it is very unlikely to cause problems.

Caution
Something still responds to this event, but Cron Forensics couldn’t confirm which plugin it belongs to. Quarantine it rather than deleting it.

Risky
This event belongs to an active plugin. Deleting it may stop part of that plugin from working, and the plugin will probably re-create it anyway.

Core
This is an important WordPress core event. Deleting it is futile, and WordPress will re-create it anyway.

Required
Cron Forensics uses this event for its own scans and clean-up. It can’t be deleted.

Labels on events

No callback
Nothing is responding to this event on the current page. Some plugins only respond when the event actually runs, so this alone isn’t proof of a problem.

Duplicate
This event is scheduled more than once with exactly the same details, so it runs more often than intended.

Re-created
This event was quarantined or deleted, but its plugin has since scheduled (re-created) it again.

(inactive)
The plugin responsible is installed but switched off.

(not installed)
The plugin responsible has been removed from your site.

? (next to a plugin name)
Cron Forensics made an educated guess about the owner based on the event’s name.

Overdue
The event was due to run but hasn’t yet (on quiet sites this is normal).

Due now
The event is due to run within the next minute.

Severity levels (Findings tab)

Critical
Something is broken and needs attention now. Scheduled tasks may not be running at all.

High
A problem that’s likely to slow your site down or cause failures.

Medium
Worth fixing, but not urgent.

Low
Minor housekeeping, such as leftovers from old plugins.

Info
For your information only, such as a new event being added. No action needed.

Findings

WP-Cron isn’t running
No scheduled events have run for over an hour, and events are piling up. Backups, emails, updates and other critical functions may be failing.

WP-Cron lock is stuck
A temporary lock that stops tasks running twice at once has been left behind and is blocking every task.

Event crashed
This event stopped partway through at least once in the last 24 hours.

Failing callback
This event reported an error when it ran.

CPU-heavy event
This event uses a lot of your server’s processing power each time it runs.

Long-running event
This event takes longer than your slow-event threshold to finish. You can change the threshold in the System tab.

Occasionally very slow
This event is usually quick, but at least one run this week took much longer than normal. Often a sign of a slow outside service.

Throws PHP warnings
This event finished but reported warnings. Usually harmless, but warnings can lead to failures.

Runs too frequently
This event is scheduled to run more often than your threshold allows. On most sites that means extra work on almost every page view.

Duplicate event
The same event is scheduled more than once, so it runs more often than intended.

Event scheduled hundreds of times
A single event has been scheduled many times with different details, which bloats your database.

The cron option is bloated
The list of scheduled events stored in your database has grown very large. WordPress loads it on every page view, so it slows down your whole site.

Uses a schedule that no longer exists
The event’s repeat schedule was removed, usually along with a plugin. After its next run it will quietly stop.

Orphaned event
The event belongs to a plugin that’s inactive or removed, and nothing responds to it. It’s probably safe to delete.

Event has no callback
Confirmed during an actual run, nothing responds to this event. It’s probably safe to delete.

Overdue event
The event was due more than an hour ago and still hasn’t run.

Hasn’t been seen running
The event is meant to repeat, but Cron Forensics hasn’t recorded it running for a while.

Deleting this event is pointless
You deleted this event and its plugin brought it straight back. If you need to get rid of it, deactivate the plugin responsible.

New event
A plugin added this event in the last week. No action needed unless you weren’t expecting it.

Change Log actions

Added
A new event appeared on your site for the first time.

Removed
A repeating event disappeared, usually because its plugin was deactivated.

Returned
A repeating event that had disappeared was scheduled again.

Re-spawned
An event you deleted came back within a day, because its plugin re-created it.

Deleted
Someone deleted the event using Cron Forensics.

Quarantined
Someone moved the event into quarantine.

Restored
Someone restored the event from quarantine.

Automatic (in the By column)
The change was detected by Cron Forensics, not made by a person.

Overview statuses

Running
WordPress is running scheduled events normally.

Waiting
No scheduled event has run since Cron Forensics was installed. This is normal for the first few minutes.

Stalled
Scheduled events have stopped running. Check the Findings tab for the cause.

Where do I enter my license key?

Go to Tools → Cron Forensics and enter your license key.

Is the plugin price a one-time payment or an annual subscription?

The choice is yours.

Your purchase includes 12 months of updates and support, giving you access to new features, improvements, compatibility updates, security fixes, and expert assistance when you need it.

If your license expires, the plugin will continue working, but you won’t receive future updates or support until you renew.

We recommend keeping your license active to ensure ongoing compatibility, security and access to the latest features.