How to deal with abandoned and closed WordPress plugins
A plugin without updates for two years, or one closed on wordpress.org, will not receive security fixes. Replace it before it becomes the way in.
Step by step, with screenshots: WordPress vulnerabilities: find and replace risky plugins →
Check your own site
Runs these 2 checks and the other 191, free, in about 45 seconds.
Or run only this check with the free WordPress theme & plugin detector, the free Tech stack & CMS detector or the free Hacked site & SEO spam checker.
What it is
An abandoned WordPress plugin is one that has not had an update for two years or more, and a closed plugin is one that wordpress.org has removed from its directory, often for an unfixed security issue or a guideline violation. Both keep running on your site but will not receive fixes.
Outdated and unmaintained plugins are the most common way WordPress sites get hacked, because a known vulnerability in them stays open for good. They also tend to break after WordPress or PHP updates. The plugin page on wordpress.org shows the last update date and, for closed plugins, a closure notice.
OK looks like this: every active plugin has had an update in the last two years and none is closed. getReport checks each plugin it can see on the page against wordpress.org and lists the ones that are abandoned or closed.
What a passing site looks like
- No detected plugin has been closed on wordpress.orgfail · −6 ptseffort M
- Every detected plugin has a recent updatewarning · −1.5 ptseffort M
1. Plugins closed on wordpress.org
Why it matters. wordpress.org closes plugins for unfixed security issues or guideline violations. A closed plugin gets no updates and often has a known vulnerability.
- Replace the plugin now; the reason shown by wordpress.org tells you how urgent it is.
- Until then, keep the site behind a firewall plugin and check the vulnerability databases for the plugin name.
2. Abandoned plugins
Why it matters. A plugin nobody maintains will not get security fixes and eventually breaks with a WordPress update. Two years without a release is the usual sign that it is abandoned.
- Look for a maintained alternative with the same feature and replace the plugin; test on staging first.
- If it is essential and small, consider paying a developer to take it over.
Questions people ask
How do you know if a WordPress plugin is abandoned?
Open its page on wordpress.org: a last update more than two years ago, a warning that it has not been tested with the latest three major WordPress releases, and unanswered support threads are the signs. In wp-admin, Plugins → Installed shows the version but not the age, so check the directory page.
What does it mean when a WordPress plugin is closed?
It means wordpress.org has removed the plugin from its directory, so no one can download it and it will receive no updates through WordPress. Reasons include a security issue, a guideline violation or the author's request. Treat a closure for a security issue as urgent and replace the plugin.
Are outdated plugins a security risk?
Yes, the biggest one for most WordPress sites. Once a vulnerability in a plugin is published, automated scanners look for sites running it within days. A maintained plugin gets a fix you can install; an abandoned one does not, so the hole stays open until you replace it.
What should you do with an abandoned plugin?
Find a maintained alternative that does the same job, test it on a staging copy, then switch and delete the old plugin completely rather than just deactivating it. If the feature is small, a few lines of code in your theme or a site plugin may replace it.