You can judge the security of a WordPress plugin before installing it from five things: the date of its last update, the number of active installations, the changelog, how responsive the developer is, and vulnerability databases. This matters because choosing plugins is now the most important security decision you make on your site: in 2025, 11,334 new vulnerabilities were found in the WordPress ecosystem, and 91% of them were in plugins (Patchstack). On top of that, developers fail to fix a significant share of flaws in time — so you can’t rely on “they’ll sort it out”. You need to be selective, and here is a simple set of criteria to help.
Why is every plugin installation a security decision?
WordPress core itself holds up surprisingly well: in 2025 only 6 low-risk flaws were reported in it. The risk comes from plugins — of the 11,334 new vulnerabilities, 91% were in plugins and 9% in themes (Patchstack). Every plugin you install is a new door into your site, and it isn’t you who decides how good the lock is, but its developer.
The trouble is that some developers don’t maintain that lock: according to a summary based on Patchstack data, 52% of plugin developers had not released a fix for a reported flaw even by the time it was made public.
According to Patchstack’s 2026 report, 46% of reported vulnerabilities had no fix ready by the time they were publicly disclosed — nearly one flaw in two became public with no update available. (Source: Patchstack)
How do I know if a plugin is safe? The 5-point quick test
Before you click Install, give it five minutes. You’ll find everything on the plugin’s wordpress.org page and in two free vulnerability databases.
| Check | What to look at | What’s the red flag? |
|---|---|---|
| Last update | The “Last updated” date on the plugin page | Last updated more than a year ago, not tested with your WordPress version |
| Active installations | Number of installations and reviews | A few hundred installations, few or old reviews |
| Changelog | Release notes, version history | Rare, irregular releases; security fixes never mentioned |
| Developer response time | Support forum: do they reply, and how quickly? | A string of questions left unanswered for weeks |
| Vulnerability history | patchstack.com/database, wpscan.com | Many flaws with slow or missing fixes |
One important nuance: a high installation count builds trust, but it doesn’t give immunity. According to The Hacker News, Gravity SMTP was running on more than 100,000 sites when its password-leaking flaw came to light. The difference is that large, actively maintained plugins get fixes quickly — so when looking at vulnerability history, don’t count the flaws; look at how fast they were fixed.
What does it mean if a plugin is abandoned?
A plugin is abandoned when its developer no longer updates it: it doesn’t keep up with new WordPress versions and — this is the key point — it doesn’t fix reported security flaws either. A plugin like that isn’t “left in peace”; it’s a ticking risk.
Attackers don’t only go after new flaws. According to Patchstack, of the ten most-attacked vulnerabilities in 2025, only four were from 2025 — the rest were old flaws known for years, which are worth trying at scale because so many sites still run forgotten, outdated plugins.
When auditing one of our online shop clients, for example, we found three plugins that hadn’t been updated for years — and two of them weren’t even used by the site any more; they had simply been left installed. We deleted them, which immediately meant fewer doors to guard. This is the cheapest win of any plugin audit: what isn’t installed can’t be hacked.
Is a paid plugin automatically more secure?
No — and that surprises many people. Security researchers find it harder to access the code of premium plugins, so flaws are discovered later and stay exploitable for longer.
According to Patchstack, 76% of the vulnerabilities found in premium components were exploitable in real attacks, and three times as many known exploited vulnerabilities (KEV) were found in premium plugins as in free ones. (Source: Patchstack)
In 2025, more serious, high-risk vulnerabilities were found in the WordPress ecosystem than in the previous two years combined — the number of flaws that can be exploited at scale rose by 113% in a single year. (Source: Patchstack)
That doesn’t mean you should be afraid of paid plugins — a well-maintained premium plugin is an excellent choice, and a paid licence often means faster support too. Just forget the “I pay for it, so it’s secure” logic, and run the same 5-point quick test on it as you would on any free plugin.
How many plugins should a WordPress site have?
There’s no magic number — the right question is whether you need every one of them. A typical WordPress site runs 20–30 plugins, and each is a risk in its own right. Deactivated plugins too: their files stay on the server, flaws and all.
Our rule of thumb is simple. Every quarter, go through the list and ask of each one: do I use it? If not, delete it — don’t just deactivate it. If you do, check it is still maintained. That way the number settles at a healthy level on its own.
How quickly and how widely attackers exploit plugin flaws is the subject of the final part of this series: in 2026 they’re no longer guessing your password. And if you want to know how to tell when a bad plugin has already caused trouble, read our article on the 8 tell-tale signs of a hacked website.
Not sure how your plugin list would score? We’ll review it
A plugin audit is a standard part of the WPShield maintenance package: we regularly go through our clients’ plugins using the criteria above and flag what should be replaced or removed — before it turns into a problem.
If you’re curious about what’s on your site right now, ask for our free quick security check: in 15 minutes we’ll run through your plugin list and tell you honestly which plugins belong in the bin.
—
Frequently asked questions
How do I know if a plugin is safe?
Before installing, check five things: when it was last updated, how many active installations it has, whether the developer keeps a regular changelog, whether they reply on the support forum, and what vulnerability databases (Patchstack, WPScan) show about it. If it scores poorly on several points, look for a maintained alternative instead.
What does it mean if a plugin is abandoned?
It means the developer no longer updates it and doesn’t fix reported security flaws either. A plugin like that is guaranteed to become vulnerable over time, and attackers specifically hunt for old, unpatched flaws — most of the most-attacked vulnerabilities in 2025 were flaws known for years.
How many plugins should a WordPress site have?
As many as you actually use. The main risk isn’t the number but the lack of maintenance: 25 up-to-date plugins are safer than 10 of which 3 are abandoned. Don’t just deactivate plugins you don’t use — delete them, because a deactivated plugin’s files stay on the server too.
Is a paid plugin more secure than a free one?
Not in itself. According to Patchstack, 76% of flaws found in premium components were exploitable in real attacks, and three times as many known exploited vulnerabilities were found in them as in free ones. What matters isn’t the price but whether the developer actively maintains the plugin.
