Is This WordPress Plugin Safe? A 5-Minute Check

Before installing a plugin or keeping an old one, spend five minutes checking who maintains it, when it was last updated, its SVN commits, and its support threads.

A flat vector illustration showing a inspection checklist next to a plugin repository page.

Check the developer profile and ownership history

When evaluating a plugin on WordPress.org, start by looking at who currently owns and maintains the project. Ownership of popular plugins can change hands quietly when original developers sell their work to commercial entities or third-party maintainers.

To inspect the plugin maintainer on WordPress.org, follow these steps:

  1. Go to the plugin page on WordPress.org.
  2. Look at the sidebar under the Author field, or directly below the main title.
  3. Click the maintainer's username to view their WordPress.org public profile.
  4. Check how long the account has existed and what other plugins or contributions are attached to it.

A sudden shift in authorship—such as a plugin transferring from a long-time open-source contributor to a newly registered account or an aggressive marketing agency—warrants further examination. If you want to dive deeper into tracking maintainers, see our detailed guide on how to check who owns a WordPress plugin.

Look for warning flags on WordPress.org

WordPress.org displays specific indicators directly on a plugin's main page when potential issues arise or when maintenance stalls. Before downloading any zip file or clicking install, review these key metadata points on the right-hand sidebar:

  • Last Updated: Check when the maintainer last pushed an update. If a plugin has not received an update in over two years, WordPress.org displays a prominent notice warning that it has not been tested with recent major WordPress releases.
  • Closure Banners: If WordPress.org closes a plugin, a red or yellow banner appears at the top of the page stating that the plugin is no longer available for download.
  • Tested up to: Compare the maximum tested WordPress version listed on the page against your current core version.

A closed plugin does not immediately break your site, but it means no future updates or security patches will be published through the official directory. If you discover an installed plugin has been removed, read our overview on what to do when a WordPress plugin is closed.

Inspect the public SVN commit history

Every plugin hosted on WordPress.org stores its code in a public Subversion (SVN) repository. You can view every code change, commit message, and committer account directly through your browser without downloading the plugin.

To review the public commit log:

  1. Navigate to the plugin page on WordPress.org.
  2. Click the Development tab in the navigation menu below the plugin title.
  3. Click the link for Development Log or browse the SVN repository directly.
  4. Review the recent commit entries for unexpected changes, such as new accounts pushing massive code updates after months or years of inactivity.

Pay attention to sudden modifications in obfuscated external API calls, unexpected remote file requests, or structural rewrites pushed by unfamiliar username handles. For step-by-step instructions on reading repository logs, see our guide on reading a WordPress plugin SVN commit history.

Review the support forum and user reports

The official support forum on WordPress.org provides real-time signal regarding whether a plugin functions predictably or introduces unwanted changes. User reports often highlight problems weeks before official notices are posted elsewhere.

Click on the Support tab on the plugin page and check these key areas:

  • Resolved Threads: Look at the ratio of resolved to unresolved topics over the past two months.
  • Specific Error Complaints: Look for threads reporting unexpected external redirects, unwanted promotional popups, unknown admin accounts, or unexplained performance drops.
  • Developer Responses: Check whether the plugin team responds professionally to bug reports, or if support threads are ignored entirely.

If multiple users report that a recent update altered plugin behavior without documentation, hold off on updating or installing until the maintainers address the issue publicly.

Audit installed plugins inside wp-admin

Checking plugins is not just a task for new installations; existing plugins on your site must be checked regularly. Inactive or unmaintained plugins remain on your server's disk and can pose unnecessary risks if neglected.

Perform a quick monthly check inside your dashboard by doing the following:

  1. Log in to your site and go to Plugins > Installed Plugins.
  2. Filter by Inactive plugins. Deactivate and fully delete any plugin you no longer use. Leaving unused code on your server increases your attack surface.
  3. Click View details on remaining active plugins to check their current version, author links, and compatibility notes directly from wp-admin.
  4. Verify that the plugin author link points to the expected domain and developer.

If a plugin changes author, or its updates have ceased altogether, decide whether to keep the plugin or find an actively maintained alternative.

Automate plugin safety checks with OwnerTrail

OwnerTrail is a free WordPress plugin available on WordPress.org that checks your site and its plugins for you, every day.

It does the checks above on its own, every day:

  • It checks WordPress core, plugin, and theme files against the official releases published on WordPress.org.
  • It looks inside files that are not part of any official release, such as PHP in your uploads folder, for the telltale shapes of malware.
  • It opens your pages the way Google does, to catch spam that hackers show only to search engines, such as the Japanese keyword hack.
  • It notices when a plugin gets a new owner or a new developer, when an abandoned plugin suddenly updates, and when WordPress.org closes a plugin.
  • It gives every plugin a trust score from 0 to 100, and can email you when something needs your attention.
  • When a plugin changes hands, it holds that plugin's next update until you have looked (free, from version 1.3.6).
  • Its Code lock means code on your site can only be changed over FTP, unless you loosen it.

In a historical replay against 31 backdoored plugins from 2025–2026, OwnerTrail generated warnings on all 31 plugins between 41 and 321 days before the backdoors activated, with a median lead time of 139 days. OwnerTrail detects irregularities and warns the site owner. It is not a firewall: pair it with one, and with backups.

Related: How to check who owns a WordPress plugin and A WordPress plugin was closed: what it means and what to do.