Should You Delete Inactive WordPress Plugins?
Deactivated is not the same as gone. What an inactive plugin can and cannot do.
Yes — with one caveat. The reasoning is worth understanding, because “deactivated is safe” is one of the most common misconceptions in WordPress administration.
What deactivating actually does
It stops WordPress loading the plugin’s code on normal page requests. It does not remove the files. They stay in wp-content/plugins, reachable by the web server, and they stop receiving your attention entirely.
Why that matters
- Some plugin files are reachable directly by URL. A vulnerability in a file that does not check whether WordPress loaded it can be exploitable while the plugin is switched off.
- Nobody updates a plugin they are not using, so it drifts further behind with every release.
- If an attacker gains any file-write access, an old plugin directory is a convenient place to hide a backdoor — nobody looks there.
- It clutters the update screen enough that a genuinely urgent update is easier to miss.
The caveat: some plugins store their settings in the database and clean them up on delete. If you might reinstall soon and you care about the configuration, export it or take a database backup first.
A five-minute routine
- List every inactive plugin.
- For each one, ask whether you have used it in the last six months.
- If no: delete it. If unsure: delete it — a plugin you cannot remember using is not load-bearing.
- If yes, seasonally (an importer, a migration tool): delete it anyway and reinstall when you need it.
- Take a backup before the batch, not after.
The WordPress Importer is the textbook case. Almost every site has it, almost nobody has migrated anything since launch, and it is a tool whose entire job is creating content from a file — see our disclosure on it.
Want this checked automatically across every plugin, theme and core file on your site? WPDeeply Risk Monitor is free.
