Unfortunately this is the only plugin that does what I need, so it’s not like I can go anywhere else unless I want to invest in building it out myself…and he knows it.

If it is doing that, it sounds like you’re not willing to open up the restrictions you have on that traffic anyway, so knowing if it’s external wouldn’t help much. You’re probably better off finding another plugin or paying someone to build something similar.

I offered him a clean, separate install with just Woo & his plugin installed so he can see what it’s doing (I absolutely can’t give him access to our network) and he said to me “We are not going to answer any questions anymore, even if you extend support and give us the needed login credentials.”

You should consider hiring someone so that you can give them direct access to the site for a far more efficient fix than we can provide here.

Please try https://jobs.wordpress.net/ or https://jetpack.pro/ and do not accept any hire offers posted to these forums.

All I came here for is to see if anyone knew of a trick or plugin or script that could be run to determine whether or not a plugin is using an external source.

Since there are numerous ways for a plugin/theme to accessw external content, it’s unlikely the simple solution you desire exists. I suppose you could use grep to search for things like curl_init, stream_context_create, and <iframe, but even things as trivial as loading external CSS and javascript would be affected by your blocking.

As a plugin author, I routinely ask for access to sites if there is no other way to debug a customer issue with a paid plugin. If a customer refuses, I politely tell them that since I cannot debug the issue, there is nothing more I can do to assist. And depending on the plugin, I might offer a refund.

However, if my plugin accessed external content and a customer inquires about it, I would always tell the customer that the plugin requires access to external content. I would also be willing to provide a list of IP addresses that should be whitelisted in the customer’s network firewall.

The submit button to save the settings is being stripped out because it doesn’t have a value assigned to it. You add any value to the button using developer tools, it saves perfectly fine.