Security
Abandoned plugins: the risk almost nobody checks for
12 August 2026 · 5 min read
On this page
Everyone checks for updates. Almost nobody checks for the opposite problem — a plugin showing no updates because there will never be another one.
An abandoned plugin looks perfect in your dashboard. Green, current, nothing pending. It is also permanently vulnerable to anything discovered from now on, and nothing will tell you.
How to spot one
Last updated over 12 months ago. The wordpress.org page shows this. Twelve months is a warning, eighteen is a decision, two years means it is over.
"Untested with your version of WordPress." WordPress flags plugins whose author has not confirmed compatibility with recent releases. Sometimes laziness; often the sign of a developer who has moved on.
The plugin page is gone, or says it has been closed. This is the serious one. The WordPress directory removes plugins, and one common reason is an unpatched security issue. A closed plugin is never coming back, and sites running it stay vulnerable indefinitely.
Support threads with no replies. Scroll the support tab. Months of unanswered questions is a clear signal.
The developer's site has disappeared. Common with small premium plugins, and it means no updates and no licence renewals.
Why it matters more than an outdated plugin
An outdated plugin has a fix waiting. You update, and you are safe.
An abandoned plugin has no fix and never will. When a vulnerability is disclosed for it — and disclosures happen for old plugins regularly, because researchers scan them precisely because they are unmaintained — your only options are deactivate and delete, or accept the risk.
That is a much worse position to be in unexpectedly, at short notice, on a plugin your site depends on.
Checking your own site
By hand: open each plugin's wordpress.org page and look at "Last updated". Twenty plugins takes about fifteen minutes.
Automatically: our free plugin checks every installed plugin against the directory and flags anything not updated in 18 months or removed entirely. It is one of the checks that most often surprises people.
Either way, this is a quarterly job rather than a weekly one. Plugins do not become abandoned suddenly.
Replacing one safely
- Work out what it actually does. Often less than you think, and sometimes something WordPress now does natively — a contact form, a gallery, an SEO field.
- Find a maintained alternative, and check its last-updated date before committing.
- Test on staging. Data migration between plugins is where this goes wrong.
- Export any data first. Form entries, settings, custom fields. Some plugins take their data with them when deleted.
- Delete the old one, do not just deactivate. Inactive code is still code on the server.
- Check the site afterwards — the pages that used the plugin, and any forms.
If the plugin was closed from the directory for a security issue, deactivate it today and work out the replacement afterwards. Deactivating is not sufficient for every vulnerability, but it is better than the alternative while you decide.
The one that catches people out
Premium plugins bundled with a theme. You did not install them, you cannot update them independently, and when the theme author stops maintaining the theme, every bundled plugin becomes abandoned at once.
Check what your theme bundled. It is often a slider, a page builder and a form plugin, all several versions behind, all invisible in the normal update flow.
Keeping on top of it
Quarterly: open your plugin list and check last-updated dates. Delete anything you do not use. Replace anything unmaintained before it becomes urgent.
That is twenty minutes every three months, and it is on the maintenance checklist for a reason — it is the check that prevents the compromises the weekly update routine cannot.
Our care plans include it, and the free plugin will tell you today whether anything you run is already in this category.