An abandoned WordPress plugin is one its developer has stopped updating. It keeps working, until someone finds a security flaw that will never be fixed. To find them, check each plugin’s WordPress.org page for “not tested” and “closed” notices and when it was last updated, then replace the risky ones with maintained alternatives.
Key takeaways
- Abandoned plugins aren’t flagged in your WordPress dashboard, even after WordPress.org removes them.
- Patchstack reports 1,614 plugins and themes were removed from WordPress.org in 2024 for unpatched security issues.
- A yellow “hasn’t been tested” notice or a red “closed” notice on the plugin’s page are your clearest warnings.
- Replace on a staging copy, with a backup, and delete plugins you don’t use.
Why are abandoned plugins so dangerous?
Because a security flaw in one stays open forever. Patchstack found 46% of WordPress vulnerabilities disclosed in 2025 had no fix from the developer in time for public disclosure (Patchstack). For a maintained plugin, a fix usually follows. For an abandoned one, it never does.
The numbers are large. In 2024, “a total of 1,614 plugins and themes were removed from the WordPress repository for unpatched security issues” (Patchstack). Patchstack notes most of them still had active installations.
Won’t WordPress warn me about an abandoned plugin?
No. Patchstack puts it bluntly: “Abandoned plugins are not flagged for users even when they are removed from the WordPress.org repository.” Your Plugins screen looks the same whether a plugin is thriving or was pulled for a security problem last month.
The warnings exist, but only on the plugin’s public page at WordPress.org. You have to go and look.
How do I find abandoned plugins on my site?
Set aside half an hour and work through every plugin, including deactivated ones.
- List everything. In your dashboard, go to Plugins and note each plugin’s name and version. Include the inactive ones.
- Check the details. Click “View details” under a plugin to see when it was last updated and which WordPress version it’s tested up to.
- Visit its WordPress.org page. Look for the yellow notice: “This plugin hasn’t been tested with the latest 3 major releases of WordPress.” WordPress.org adds that it “may no longer be maintained or supported” (WordPress.org).
- Look for a red notice. A closed plugin’s page says it “has been closed and is no longer available for download”. After 60 days, the reason is shown, such as a security issue.
- Check premium plugins separately. Paid plugins don’t live on WordPress.org. Check the seller’s changelog and whether your licence is still active.
- Read the support forum. Months of unanswered questions suggest the developer has moved on.
What do the warning signs mean?
| Sign | What it usually means | What to do |
|---|---|---|
| Red “closed” notice | Pulled from WordPress.org, possibly for security | Replace it now |
| Yellow “not tested” notice | Developer hasn’t kept up | Plan a replacement |
| No update for a year or more | Possibly abandoned | Watch it, find an alternative |
| Premium licence expired | No updates reaching your site | Renew, or replace |
| Installed but inactive | Unused code on your server | Delete it |
Fewer plugins means fewer things to watch. Our guide to how many plugins is too many in WordPress helps you trim the list.
How do I replace an abandoned plugin safely?
- Back up the whole site. Files and database, stored off the server.
- Find a maintained alternative. Look for recent updates, a current “tested up to” version, plenty of active installs and answered support questions.
- Test on a staging copy. Install the new plugin, move its settings and content across, and check every page that used the old one.
- Remove the old plugin completely. Deactivate it, then delete it. Some plugins leave tables or settings behind, so check the plugin’s notes.
- Repeat on the live site and test forms, checkout and anything else customers use.
Themes go stale too. If yours was edited directly rather than through a child theme, see WordPress theme update lost changes before you update it.
What if there’s no replacement?
Sometimes a small plugin does one niche job and nothing else does it. You have three options. A developer can rebuild the feature as a small piece of custom code. You can decide the feature isn’t worth the risk and remove it. Or, as a short-term measure only, a firewall can block known attacks while you plan a proper fix.
Don’t keep a closed plugin running because “it still works”. That’s exactly how it becomes a way in.
Who should be checking this?
Someone should, every few months, as part of routine care. Our WordPress maintenance checklist includes a plugin review. If you’d rather hand it over, our WordPress maintenance services cover updates, scanning and plugin checks, and our website maintenance plans start at $40 a month + GST.
The server matters too. WordPress hosting in Australia that runs current PHP versions gives maintained plugins the platform they expect.
Frequently asked questions
How long without an update before a plugin counts as abandoned?
There’s no official cut-off. WordPress.org shows a warning when a plugin hasn’t been tested with the last three major WordPress releases. As a rule of thumb, a year without updates is worth investigating. Some simple plugins are stable and need few updates, so check the support forum too.
Is a deactivated plugin still a risk?
It can be. Deactivating a plugin stops WordPress running it, but its files stay on your server. If you don’t need it, delete it. Keeping unused plugins also means more updates to manage and more clutter when something goes wrong.
Why was my plugin closed on WordPress.org?
Reasons include a security issue, a guideline or licensing problem, the author’s request, or the feature being merged into WordPress itself. The closed notice shows the reason after 60 days. If it says security issue, replace the plugin promptly.
Will plugin auto-updates protect me from abandoned plugins?
No. Auto-updates install new versions when a developer releases them. An abandoned plugin has no new versions, so auto-updates do nothing for it. They’re useful for maintained plugins, ideally with testing afterwards, but you still need to check whether each plugin is being looked after at all.
Sources
- State of WordPress Security in 2026, Patchstack, accessed 13 November 2026
- State of WordPress Security in 2025, Patchstack, accessed 13 November 2026
- Alerts and warnings, WordPress.org Plugin Handbook, accessed 13 November 2026