It's easy to treat WordPress plugins as free. You find one that solves a problem, click install, and move on. But nothing about a plugin is free. Every plugin you activate becomes part of your site's attack surface, adds to how much code has to load on every page, and quietly signs you up for a maintenance dependency that lasts as long as the plugin stays installed. Most sites we rescue after a hack are not running exotic malware. They're running one too many plugins, one of which stopped getting updates two years ago.
The safest plugin is the one you didn't install. The second safest is one you chose deliberately, from a source you actually vetted, and that you continue to keep an eye on. This is the discipline behind a hardened WordPress site, and it costs you almost nothing except the habit of saying "no" more often.
Why every plugin carries a cost
Think of each plugin as three separate liabilities stacked on top of each other.
- Attack surface. A plugin is third-party code running with access to your database, your files, and often your admin session. A vulnerability in any single plugin can compromise the whole site. Ten plugins mean ten independent chances that someone else's coding mistake becomes your breach.
- Performance cost. Plugins load scripts, styles, and database queries on every request. A handful of poorly-built ones can double your page load time and drag down Core Web Vitals — which affects both your visitors and your search rankings.
- Maintenance dependency. Once installed, a plugin has to be kept current forever. Each one is a moving part that can break during a WordPress core update, conflict with another plugin, or ship a bug of its own. More plugins means more things that can go wrong at 2 a.m.
None of this means plugins are bad. It means each one should earn its place. If a plugin isn't clearly worth all three costs, it doesn't belong on your site.
A plugin that hasn't been updated in over a year isn't just stale — it's a known target. Attackers actively scan for sites running unmaintained plugins with published vulnerabilities, because they know no patch is coming. An inactive-but-installed plugin is still exploitable code sitting on your server.
How to audit the plugins you already have
Before you vet anything new, take inventory of what's live. Set aside an hour and work through this list.
- List everything. Open Plugins → Installed Plugins and write down every plugin, active or not. Deactivated plugins still contain code and still need updates — they should be deleted, not just switched off.
- Ask "what breaks if I remove this?" for each one. If you can't immediately name the feature it provides, that's a strong signal you don't need it.
- Look for redundancy. Many sites run two caching plugins, three SEO tools, or a security plugin plus a firewall that do the same job. Consolidate to one per function.
- Check the "last updated" date. On the plugin's WordPress.org page, note when it was last updated and which WordPress versions it's tested up to. More than 12 months behind is a yellow flag; "untested with your version of WordPress" is a red one.
- Flag anything from an unknown source. Nulled premium plugins, one-off downloads from a forum, or plugins whose developer you can't identify are the first things to remove.
Aim to end the audit with fewer plugins than you started. Delete deactivated ones. Replace two overlapping tools with one. Every removal shrinks your attack surface and your maintenance load at the same time.
Spotting an abandoned plugin
You don't need to be a developer to recognize a plugin that's been left to rot. Watch for these signs together:
- No update in more than a year, especially two or more.
- Marked as not tested with recent WordPress versions.
- A support forum full of unanswered threads.
- Open security reports with no developer response.
- A developer or company website that has gone dark or disappeared.
When a plugin shows these signs, look for an actively-maintained alternative and migrate off it. Removing an abandoned plugin is one of the highest-value security moves you can make, and it's free.
Vetting a source before you install
The moment to be careful is before the plugin ever touches your site. A few minutes of checking prevents most plugin-related incidents. Run down this checklist for anything new:
- Active installations and update cadence. A large install base combined with frequent updates means real people rely on it and the developer is engaged.
- Recent "last updated" date. Look for updates within the last few months, and confirmation that it's tested with the current WordPress version.
- Responsive support. Skim the support forum. Are recent questions being answered? That tells you whether anyone is actually home.
- Reputable developer. Look up who makes it. A known company or an author with several well-maintained plugins is safer than an anonymous single upload.
- Reviews that mention real use, not just star counts. Read the one- and two-star reviews specifically — they reveal conflicts, bloat, and support problems.
- Official channels only. Install from the WordPress.org repository or the developer's own site. Never from a "free download" site offering paid plugins for nothing.
"Nulled" plugins — paid plugins cracked and offered free — are one of the most reliable ways to get hacked. They frequently ship with backdoors baked in, and by definition they receive no security updates. The few dollars saved routinely turn into a full malware cleanup.
Keep the discipline going
A lean plugin list isn't a one-time cleanup — it's an ongoing habit. Make plugin review part of your regular maintenance: apply updates promptly, re-check "last updated" dates every few months, and remove anything you've stopped using. The goal is a small, known, trusted set of plugins where you can name what each one does and confirm it's still actively supported. If you'd like a structured routine and monitoring around this, our WordPress maintenance packages and broader WordPress security work are built around exactly this kind of discipline.
Before removing or replacing a plugin on a live site, take a full backup and, where possible, test the change on a staging copy first. Deactivating a plugin can hide the feature it provided in ways that aren't obvious until a customer hits it.
- Every plugin is three costs at once: attack surface, performance, and a permanent maintenance dependency.
- Run the fewest plugins you can, and delete deactivated ones — inactive code is still exploitable code.
- Abandoned plugins (no updates in a year-plus, untested with current WordPress) are prime targets; migrate off them.
- Vet a source before installing: update cadence, install base, responsive support, reputable developer, official channels only.
- Never run nulled or pirated plugins — they routinely ship with backdoors and get no security patches.
At Wurdey, plugin hygiene is one of the first things we tackle when we take on a site. We audit what's installed, remove the dead weight and the risky sources, replace abandoned plugins with maintained alternatives, and then keep everything current so vulnerabilities get patched before they're exploited. If your plugin list has grown past what you can keep track of — or if a neglected plugin has already led to trouble — our malware removal and maintenance team can get your site back to a lean, defensible state and keep it there.
Next step
Find out what a scanner sees on your site.
Run a free, non-invasive scan in about a minute. You'll get a plain-English security grade and the fixes that matter, no signup required.