How to Check If a WordPress Plugin Is Safe
Five checks, in order of usefulness, before you install a WordPress plugin.
Star ratings and install counts tell you whether people like a plugin. They tell you almost nothing about whether it is safe. Here are the checks that do, roughly in order of how much they reveal per minute spent.
1. When did it last ship?
Open the WordPress.org listing and look at “Last updated”. Under three months is healthy. Six to twelve months is worth a second thought. Beyond two years, assume nobody is watching — and a plugin nobody is watching will not get a security fix quickly when it needs one.
2. Is the listing still open?
A plugin that has been closed or removed from the directory is the single strongest signal to walk away. Removals happen for guideline breaches and for unresolved security problems, and the directory rarely explains which. See what a removal actually means.
3. Does it have unresolved vulnerabilities?
A history of vulnerabilities is not automatically bad. It often means somebody is looking, and issues are being found and fixed. What matters is whether anything is still open — a published flaw with no patched version. The plugin checker shows both numbers separately for exactly this reason.
4. What does it want access to?
A plugin that adds a contact form and a plugin that manages file uploads carry different risk even when both are well written. Ask what the plugin needs to touch: file writes, user creation, remote requests, payment data. Then ask whether the feature is worth that exposure.
5. Does the developer answer support threads?
Read the support forum, not the reviews. Unanswered threads going back a year predict how a security report will be handled. A developer who replies to bug reports in public is a developer who will probably respond to a disclosure.
If a plugin fails checks 1 and 2, stop there. No feature is worth installing code that nobody maintains and the directory has already delisted.
What not to rely on
- Install count — popular plugins have had serious vulnerabilities, including ones on over a million sites.
- Star rating — measures satisfaction with features, not code quality.
- “Tested up to” — a compatibility claim the developer types in themselves.
Want this checked automatically across every plugin, theme and core file on your site? WPDeeply Risk Monitor is free.
