I think the best way to analyze ir is to set a local dev environment with xdebug and do some step debugging to see what happens, just for security I place rsfirewall system plugin to be the first plugin to run, by putting it on top of all other system plugins