Choosing WordPress Plugins Without Breaking Your Site

First: do you need a plugin?

Every plugin you add is more code to update, more settings to understand and one more thing that can conflict with a theme or another plugin. Before installing one, ask:

• Can WordPress already do this? The block editor, menus, widgets and Site Health cover a lot without extra plugins.
• Does a plugin you already run do it? Many form, SEO and e-commerce plugins overlap.
• Is it a small piece of layout or text that belongs in the theme instead?
• Will it still be needed in a year, or is it for a one-off campaign?

A short list of well-chosen plugins is easier to keep safe than a long one. If you are still deciding on a platform, our guide to choosing a CMS compares WordPress with the alternatives.

Reading a plugin's directory page

Most free plugins come from the WordPress.org plugin directory. Each plugin page has a sidebar with facts worth reading before you click install:

• Last updated. A plugin that has not changed in a long time may still work, but it is worth checking why.
• Active installations. A rough measure of how widely it is used.
• WordPress version, Tested up to and PHP version. The minimum versions it needs and the newest WordPress release its developer has tested. Compare them with your own site; your host's control panel or WordPress's Site Health screen shows your PHP version.
• Support. The page shows how many support forum issues were resolved in the last two months, shown as "X out of Y". Open the forum and see whether the developer replies and what people report.
• Ratings and reviews. Read the recent low ratings for patterns, such as updates that broke sites or features that moved behind a paywall, rather than relying on the average.

Out-of-date and closed warnings

WordPress.org's page on alerts and warnings explains the two notices that should make you stop:

• Out of date. Plugins that do not support the last three major releases of WordPress show a notice. WordPress.org notes that WordPress has two to three major releases a year, and that developers only need to update the "Tested up to" value in their readme to avoid it. So the notice usually means nobody is looking after the plugin closely.
• Closed. A closed plugin shows a notice to all visitors, with the date, and after 60 days the reason. The reasons listed are author request, a guideline violation, a licensing or trademark violation, being merged into WordPress core, or a security issue. WordPress.org says further details are not given to anyone outside its security team and the plugin's authors except in extreme circumstances.

If a plugin you already use is closed, find out why if you can, and plan to replace it. Do not count on further updates.

What the directory rules cover

Plugins in the directory must follow WordPress.org's detailed plugin guidelines. A few of them protect site owners directly:

• No trialware. Plugins may not contain features that are locked until you pay, or switch off after a trial period or quota. Paid add-ons and services are allowed, but the code in the directory version must be fully available.
• No tracking without consent. Plugins may not contact external servers without explicit and authorised consent, usually an opt-in, and should document in the readme what user data is collected and how it is used. That matters for your privacy policy and cookie consent.
• No hidden credits. Plugins may not add external links or credits to your public site without explicitly asking your permission.
• No hijacking the dashboard. The guidelines say plugins should not hijack the admin dashboard.

WordPress.org also reserves the right to remove a plugin, to hand it to a new developer, and to change a plugin's code without the developer's consent in the interest of public safety. The guidelines are a floor, not a guarantee of quality: they do not mean every plugin has been reviewed for security.

Premium plugins from elsewhere

Many commercial plugins are sold on their developers' own websites rather than through the directory. The WordPress hardening guide is blunt: do not get plugins or themes from untrusted sources, and restrict yourself to the WordPress.org repository or well-known companies. For a paid plugin, that means buying from the developer itself, keeping the licence active so updates keep arriving, and recording the renewal date. Our maintenance checklist includes a yearly review of those licences.

Checking known vulnerabilities

Like any software, plugins have security flaws that are found and fixed over time. Public databases let you check a plugin before installing it, and check the ones you already run.

• WPScan. The WPScan plugin vulnerability database has a page for each plugin listing its known vulnerabilities. Each entry gives the affected versions in its title, the version it was fixed in, a severity score (CVSS) and, where one exists, a CVE identifier.
• CVE. The CVE Program catalogues publicly disclosed cybersecurity vulnerabilities, with one CVE Record for each, so that people and tools can refer to the same issue.

What matters is not whether a plugin has ever had a vulnerability, because many well-maintained ones have, but whether fixes arrive quickly and whether your site runs a version at or above the one listed as "fixed in". A history of serious issues that stay unfixed is a reason to choose something else. Our website security guide covers the rest of the defences.

Updating safely

Updates fix those vulnerabilities, so delaying them is a risk too. WordPress's page on plugin and theme auto-updates says that to keep a site secure you should always update plugins and themes to the latest version. The safe routine is:

• Back up first. WordPress's backup documentation says to back up your database regularly, and always before an upgrade. Our guide to website backups explains how to check a backup actually restores.
• Test big updates on a copy. WordPress's page on running a development copy describes it as a good way to update and modify a site without interrupting the live version. Use a staging copy for major version jumps, plugins that handle payments or bookings, and anything that has broken before.
• Check the site afterwards. Load the home page, a form and, for a shop, the checkout.

Since WordPress 5.5, administrators can turn on automatic updates plugin by plugin. WordPress runs them twice a day by default and emails the site owner after each attempt, whether it succeeded or failed. The same page suggests making sure you can roll back to a previous version before enabling them. Auto-updates suit small, well-maintained plugins; keep manual, tested updates for the ones your business depends on.

Removing plugins you no longer use

A deactivated plugin's files are still on the server. WordPress's page on managing plugins describes the two steps: deactivate the plugin, then click its Delete link. The Site Health screen under Tools > Site Health > Info lists active and inactive plugins, which makes a quick audit easy. Take a backup first, and check the plugin's documentation for what it leaves behind in the database.

A checklist

• The feature is not already covered by WordPress, the theme or a plugin you run.
• The directory page shows recent updates, a "Tested up to" version close to the current release, compatible PHP and an active support forum.
• There is no out-of-date or closed notice.
• WPScan shows no unfixed vulnerabilities for the version you will run.
• Paid plugins come from the developer, with the licence and renewal date recorded.
• Updates follow a backup, and major ones are tested on a staging copy.
• Unused plugins are deleted, not just deactivated.

Frequently asked questions

How many plugins is too many?

There is no fixed number. What matters is that each plugin is needed, maintained and kept up to date. Fewer plugins means less code to update and fewer chances of conflicts, so remove any that no longer earn their place.

Is a plugin with no updates for a long time unsafe?

Not automatically, but it is a warning sign. WordPress.org shows an out-of-date notice on plugins that do not support the last three major WordPress releases. Check the support forum and WPScan before relying on one.

What does it mean when a plugin is closed on WordPress.org?

It has been removed from the directory. WordPress.org lists the possible reasons, including author request, a guideline violation and a security issue, and shows the reason 60 days after closure. Plan to replace a closed plugin.

Should I turn on automatic plugin updates?

For small, well-maintained plugins, often yes, as long as you have backups you can restore. WordPress runs auto-updates twice a day and emails you the result. Keep plugins that handle payments, bookings or core features on manual updates, tested on a staging copy.

Is it safe to download premium plugins from other sites?

Only from the plugin's own developer. WordPress's hardening guide says not to get plugins or themes from untrusted sources and to stick to the WordPress.org repository or well-known companies.

Want a WordPress site that runs on a small set of well-maintained plugins, each one earning its place? See our website development service and all our services, or email [email protected].