How Long Is Too Long Without a Plugin Update?
What update gaps actually predict, and the thresholds WPDeeply uses.
There is no universal number, but there are useful thresholds. The reason to care is not tidiness: an update gap is a proxy for how quickly a security fix would arrive if one were needed.
The thresholds we use
- Under 3 months — actively maintained. Normal.
- 3–12 months — slow but plausible, especially for small, stable, single-purpose plugins.
- 12–24 months — treat as at risk. Start looking at alternatives before you need one.
- Over 24 months — WPDeeply classifies this as abandoned, regardless of whether the plugin still works.
Why a stable plugin still needs releases
WordPress core changes. PHP changes — a plugin written for PHP 7.2 can break or behave unpredictably on PHP 8.3. Browser behaviour changes. And the security guidance itself changes: patterns considered acceptable in 2019 are known-bad now. A plugin that has shipped nothing in three years has not just stopped adding features; it has stopped absorbing all of that.
When a long gap is genuinely fine
Small plugins that do one server-side thing with no user input, no forms, no uploads and no remote requests can sit unchanged for years without becoming dangerous. The risk scales with what the plugin touches. A 30-line snippet plugin that adds a body class is not the same bet as an unmaintained gallery plugin handling uploads.
Do not read an update gap in isolation. Combine it with directory status, open vulnerabilities and what the plugin has access to. That combination is what makes a rating meaningful.
Want this checked automatically across every plugin, theme and core file on your site? WPDeeply Risk Monitor is free.
