Most WordPress sites don’t get hacked through some sophisticated attack. They get hacked because of a plugin someone installed three years ago, stopped using, and nobody’s touched since.
An abandoned plugin is one its developer no longer maintains: no updates, no bug fixes, and — critically — no patches for the vulnerabilities that keep getting discovered. It keeps running, it’s still on your site, and it gets a little more dangerous every month that goes by.
Why they’re the attack vector of choice
When a vulnerability is found in a plugin, it gets published in public databases. That’s a good thing — it’s how people know to update. But it also turns that list into a catalogue of targets.
Automated bots read those lists and scan the internet for sites still running the vulnerable version. They don’t pick you: they find you. And if the plugin is abandoned, there’s no update to install. The door just stays open, indefinitely.
How to spot them on your site
Sign 1: the last-updated date
This is the fastest check. Go to Dashboard → Plugins and click “View details” on each one. Look at “Last updated”.
Rough rule of thumb:
- Under 6 months: fine, it’s being actively maintained
- 6 to 12 months: keep an eye on it. Can be normal for a simple, stable plugin
- Over 12 months: not a good sign
- Over 2 years: treat it as abandoned
Sign 2: the compatibility warning
The WordPress.org repository shows a clear notice when a plugin hasn’t been tested with the last three major WordPress releases: “This plugin has not been tested with the latest 3 major releases of WordPress.”
That notice is the equivalent of an orange warning light on the dashboard.
Sign 3: gone from the repository
The worst sign of all. If you search for the plugin on WordPress.org and it’s nowhere to be found, it may have been pulled over a serious security issue.
What’s unsettling is that if you already have it installed, it keeps running and you get no warning whatsoever. Your site is still executing code that WordPress.org judged dangerous enough to remove.
Sign 4: support gone silent
Check the plugin’s support tab and look at the open threads. If there are questions from months back with not a single reply from the developer, there’s nobody on the other end anymore.
The other problem: plugins you don’t even use
Here’s the uncomfortable part. Open your plugin list and count them. Now answer honestly: how many of those do you actually use?
It’s common to find sites running twenty, thirty or more plugins, and for a good share of them to be leftovers: the one you trialled and didn’t like, the one a campaign needed two years ago, the one a previous agency installed that nobody can now explain.
Every installed plugin is code that’s either running or, at the very least, sitting there waiting. And here’s something a lot of people don’t realise: a deactivated plugin is still a risk. Its files are still sitting on the server, and some vulnerabilities can be exploited without the plugin even being active.
Deactivating isn’t enough. If you don’t use it, uninstall it.
How to clean up without breaking anything
Here’s the sensible order to do it in:
- Take a full backup. Before you touch anything. No exceptions
- Make a list of the plugins you want to remove and what each one was for
- Go one at a time. Deactivate, check the site (homepage, an inner page, a form, your shop if you have one), and if everything looks fine, uninstall
- Wait a few days before moving to the next one if the plugin mattered. Some issues only show up in specific situations
- Check for leftovers: some plugins leave database tables and options behind that keep loading on every single visit
Be especially careful with anything that touches your content: page builders, custom fields plugins, form plugins or SEO plugins. Uninstalling one of these without checking first can leave you with broken pages or missing data.
What if the abandoned plugin does something you actually need?
It happens a lot, and there isn’t always an obvious replacement. Your options, in order of preference:
- Find a maintained alternative. One almost always exists
- Check whether WordPress already does it natively. A lot of functionality that used to need a plugin is now built in
- Ask yourself if you actually still need it. Sometimes the feature no longer delivers what it once did
Sticking with an abandoned plugin “because it works” is a fair call — but only if it’s a conscious, temporary one, with an actual plan to replace it.
Keeping it from piling up again
Everything above is a one-off clean-up. To stop it happening again, checking every few months is enough: how many plugins there are, which ones haven’t been updated in a while, and which ones nobody’s using anymore.
It’s a twenty-minute job that almost nobody does, because it’s never urgent until the day it is. For our maintenance clients, it’s part of the routine review: if we spot an abandoned plugin or a known vulnerability, we flag it and suggest a replacement before it turns into a problem.
But whether you handle it yourself or hand it off, make the time for it. Few checks give you a better return for the effort than this one.
Would rather we took care of it? Get in touch with our team and tell us what your site needs — we’ll get back to you within 24 hours.
Want to apply this in your business? See how we do it in WordPress maintenance and security (WP Shield), or tell us about your case and we will reply within 24-48 working hours.