The invisible enemy on your server
Many people assume WordPress security comes down to the “big things”: a strong firewall or a complex password. In reality, most attacks don’t come through the front door but through the back windows – plugins we have long forgotten about. These are “zombie plugins”: abandoned, outdated or unnecessarily installed pieces of code, simply waiting for the right moment to let an attacker in.
Shocking statistics: why are plugins the weakest link?
Before we get to the solution, let’s look at the numbers that show how serious the problem is:
- Where vulnerabilities come from: according to Patchstack’s annual report, roughly 90–95% of security flaws identified in the WordPress ecosystem relate to plugins, not to WordPress itself.
- Critically outdated: WPScan data shows that in a significant share of successful hacks, attackers exploit known vulnerabilities for which a fix had been available for months – the owner simply hadn’t updated.
- Supply chain attacks: it is increasingly common for popular but abandoned plugins to be bought by developers of dubious background, who then push malicious code (malware) to tens of thousands of websites with a single update.
The 5-point “zombie hunter” checklist
How do you decide whether a plugin stays or goes? Work through this list:
1. The “Last updated” date
If a plugin hasn’t been updated for more than a year, that’s suspicious. More than two years, and it’s dangerous. WordPress core keeps evolving and PHP versions move on – if the plugin developer doesn’t keep up, the code becomes unstable and vulnerable.
2. Check for known vulnerabilities
Don’t guess! Use databases such as WPScan or Patchstack. Search for your plugin’s name and see whether it has an “open” (unpatched) flaw. If it does, remove it straight away.
3. Genuine functional need
Ask yourself: “Do I really need this plugin for one small button?” Every plugin adds attack surface. If a feature can be handled with five lines of code in functions.php, choose the code over the plugin.
4. The developer’s reputation and support
Look at the plugin’s support forum on WordPress.org. If you see dozens of unanswered threads titled “Error” or “Not working” from the last six months, the developer has probably abandoned the project.
5. Inactive vs. deleted
This is the most important point: a deactivated plugin is not safe! Its files are still on your server, and attackers can call them directly. If you don’t use it, don’t just deactivate it – delete it completely.
The clean-up process: how to do it safely
Before you start deleting things, follow two rules:
1. Always have a fresh backup! Removing a plugin you thought was unnecessary can unexpectedly break your site’s design.
2. Use a staging environment: if you’re removing several plugins at once, test the site on a copy first to make sure every feature (contact forms, checkout and so on) still works.
5-point zombie checklist
- The “Last updated” date – 1+ year is suspicious, 2+ years is downright dangerous.
- Check for known vulnerabilities – WPScan or Patchstack database.
- Genuine functional need – many plugins can be replaced with a few lines of code.
- The developer’s reputation and support – unanswered support threads are a bad sign.
- Inactive vs. deleted – a deactivated plugin’s files stay on the server.
1+ year without updates = suspicious
2+ years = dangerous
~90–95% of vulnerabilities relate to plugins (Patchstack)
All points checked – your installation is clean
Run through the 5-point list again every quarter, and think twice before every new installation.
Found a zombie? How to delete it safely
1. Fresh backup 2. Staging test (forms, checkout) 3. Don’t just deactivate – delete it completely
When did you last check what Google sees on your website?
Don’t wait until you drop from the top of the search results into the spam folder – request a security review today.
