Choosing, evaluating and cleaning up WordPress plugins
A plugin runs with the same permissions as WordPress itself: it can read and change your database, create files and send email. Installing a plugin means placing your trust in its developer. Outdated and poorly maintained plugins are a common way in for attackers. Here's how to assess a plugin before you install it, and how to clean up what you no longer need.
First: do you actually need a plugin for this?
- Can WordPress do it on its own? Columns, buttons, tables, a simple sitemap and lazy loading of images are already built in.
- Can your theme do it? With a block theme, you can handle a lot in the Site Editor.
- Do you already have a plugin that does this? Two plugins for the same job, such as two caching plugins, two SEO plugins or two security plugins, get in each other's way and cause errors.
There's no fixed maximum. But every plugin needs to be kept up to date, can clash with the others and can contain a vulnerability. A site with a few well-chosen plugins is easier to keep healthy.
Where do you get plugins?
- From the wordpress.org plugin directory, which you can also reach via Plugins > Add New Plugin in your dashboard.
- From the website of a well-known developer, for paid plugins and add-ons.
- Never from sites that offer paid plugins for free. These nulled plugins often contain a backdoor or spam links, and they don't get updates.
Red flags on the plugin page
| Feature | Red flag |
|---|---|
| Last updated | More than a year ago. It may no longer work properly with new versions of WordPress and PHP. |
| Tested up to (WordPress version) | A much older version than the current one. On wordpress.org, the page will then show a warning. |
| PHP version required | Not a red flag in itself, but check whether it matches the PHP version of your package. |
| Active installations | Very few: then there are few people to spot bugs. Not always bad, but take a closer look. |
| Ratings and support | Lots of recent bad ratings, or questions in the forum that the developer doesn't respond to. |
| Closed plugin | The page says the plugin has been closed, sometimes with the reason, such as a security issue. Replace it. |
Also check a public database of known vulnerabilities in WordPress plugins, such as the ones from Patchstack, Wordfence or WPScan. A vulnerability that was fixed quickly isn't a problem. A developer who does nothing for months is. Also pay attention to what the plugin does with your visitors' data: if it sends that data to a service run by the developer, this belongs in your privacy statement.
Deactivate or delete?
| Deactivate | Delete | |
|---|---|---|
| What happens? | WordPress no longer loads the plugin. The files stay in wp-content/plugins. | The files are removed. Some plugins also clean up their settings and tables in the database, others leave them in place. |
| Risk | A vulnerability in a separate file of the plugin remains reachable. Attackers look for known vulnerable files, not for active plugins. | Gone is gone. You may lose your settings. |
| When? | Only temporarily, for example when you're troubleshooting. | When you no longer use the plugin. |
The same goes for themes you don't use. Delete a plugin under Plugins: first Deactivate, then Delete.
Cleaning up: a regular check
Go through your plugins every quarter, for example, and ask four questions for each plugin:
- What is it for? If you no longer know, find out.
- Is it still being used? A slider plugin when there's no slider anywhere can go.
- Can you do without it, because WordPress, the theme or another plugin already does the job?
- Is it still maintained? Check the red flags above.
Make a backup first or work on a copy, see Creating a WordPress staging environment. Delete one plugin at a time and then check whether your site still works. Watch out for shortcodes: if you delete a plugin that provided something like [formulier id="2"], that text will then appear literally on your page.
Disabling a plugin when the dashboard doesn't work
If a plugin causes a critical error or a white page, you can disable it by renaming its folder in wp-content/plugins. When this kind of error occurs, WordPress often also sends an email with a link to recovery mode. You can read how this works step by step in Error 500 or "critical error" on your website (also after a WordPress update). If a security plugin is locking you out, see I can't log in to WordPress: what now?
Further reading
- Managing Plugins on wordpress.org
- Help! My site has been hacked. How do I fix it and how do I prevent it?
Want to learn more? Take the free WordPress course, lesson 5.3 Choosing and assessing plugins or lesson 5.4 Less is more: cleaning up and resolving conflicts.