Blog / security monday
How to tell if a WordPress plugin is safe
Plugins are a common way WordPress sites get broken into. How to vet one before you install it, and how to spot the ones going quietly stale.
When we clean up a hacked WordPress site, the way in is usually a plugin. Not a clever attack on the server, not a guessed password. Someone installed something years ago, it stopped being maintained, a vulnerability was published, and a bot found the site three days later.
The awkward part is that the plugin looked fine at install time. Vetting one takes about two minutes if you know where to look, so here is what we check.
Read the boring numbers on the plugin page
Every plugin in the WordPress.org directory has the same set of facts in the sidebar, and they tell you most of what you need.
Look at when it was last updated. A plugin untouched for a year or more is a plugin nobody is watching for security reports. Look at "Tested up to", which is the WordPress version the developer says they tested against. If it trails the current release by a couple of versions, that is the same signal in different clothing. Then open the support forum tab and see whether the developer answers, and how many threads sit unresolved. A quiet forum with an active developer is fine. A busy forum with no replies since spring is not.
Active install counts matter less than people think, but they matter at the edges. A plugin with a handful of installs has had very few eyes on the code. A plugin with a huge install base is a bigger target, and it also tends to get fixed fast.
A closed plugin needs action, not a note in your calendar
WordPress.org closes plugins for guideline violations, security problems, or at the developer's own request. When that happens, the directory stops generating downloads and nobody can install it, but if you already have it, it keeps running on your site exactly as before. Nothing warns you. The plugin simply stops receiving updates forever.
The directory publishes the broad reason for a closure after 60 days, in general terms such as "Security" or "Guideline Violation". That is worth knowing, because it means a plugin can be closed for a live security issue and you will not learn why for two months.
So the habit worth building is checking your installed plugins against the directory now and then. If a plugin page you rely on has gone dark, treat it as urgent, not as something to look at next quarter. Find a replacement or pay a developer to take over the code, and remember that updates are the whole game here.
Plugins change hands, and the new owner may not share your priorities
This one catches people. A plugin gets adopted or sold, and the code you trusted is now maintained by someone else with different plans for it. WordPress.org has a formal adoption process, including a 30 day window for the original developer to respond and a full security review of the submitted code, so a takeover through the directory is not a free-for-all. Ownership can also be transferred directly between accounts when both parties agree, which is quieter.
What you can do about it is watch the changelog. If a plugin you use suddenly gains features nobody asked for, starts phoning home, or adds affiliate links to your admin screens, the ownership probably changed. That is your cue to look for an alternative before the next surprise arrives.
Nulled premium plugins are the expensive kind of free
We still find these. Somebody wanted a premium plugin, found a "nulled" copy on a download site, and installed it. The plugin usually works, which is the trap. The modification that removed the licence check is rarely the only modification, and the backdoor sits there quietly until the site is used to send spam or serve malware.
If a plugin costs money and you found it for nothing, assume the code has been altered. Buy it from the developer, or use a free plugin that does less. A cleanup and the reputation damage that comes with a blocklisted domain will cost you far more than the licence would have, and our look at what a compromise actually does to a server covers where that goes.
Install fewer, delete what you do not use
Every plugin is code someone else wrote running on your site with full access to your database. The most reliable way to reduce plugin risk is to have fewer of them.
Go through the list and be honest about which ones earn their place. Deactivating is not enough, because the files stay on disk. Delete the ones you have finished with. Then turn on automatic updates for the plugins you keep, or set a recurring time to apply them by hand, and take a backup first so a bad update is an inconvenience rather than an outage. If you are running anything important, test updates on a copy of the site before they touch the live one. Our hosting plans run on cPanel, so the backup tools for that are already sitting in your control panel.
That is the Security Monday job for this week: open your plugins page, check the dates, and delete two things. If you find a plugin that has gone quiet and you are not sure whether it is still safe to run, ask our support team and we will take a look with you.