Open your plugin list and you’ll see another slider plugin from your previous website and a form plugin that hasn’t done anything in years. A plugin is considered obsolete if it hasn’t been updated in over a year, hasn’t been tested with the current version of WordPress, or has been removed from the official repository. Deactivate and completely remove unused plugins, because simply deactivating them isn’t enough. The broader context is explained in Choosing and Managing Plugins and Themes.
Outdated, abandoned, closed, or unused: what's the difference?
Outdated, abandoned, discontinued, and unused are four different situations, and each requires a different course of action. In practice, they’re often confused with one another, which leads to advice like ‘just update it’ for a plugin that hasn’t received updates in years. The table compares them side by side.
| Concept | What It Is | How can you tell? | Risk | Promotion |
|---|---|---|---|---|
| Outdated plugin | Update available, not installed | Update notification in your plugin list | Known vulnerabilities remain unpatched | Backing Up and Updating |
| Abandoned plugin | The developer has stopped working on it | No updates for over a year, a quiet support forum | New leaks are no longer being patched | Replace |
| Closed plugin | Removed from the official repository | Post on wordpress.org | The reason may be a security issue | Find out why; usually, replace it |
| Unused (inactive) plugin | Disabled but still installed | Status: Inactive | The code is still on your server | Delete |
So, you update an outdated plugin, replace an abandoned or discontinued plugin, and remove an unused plugin. An abandoned plugin that’s still running on your site is also called a “zombie plugin.” I compare it to a house whose landlord no longer comes by to make repairs. As long as nothing breaks, you won’t notice anything, but a leaky roof will keep leaking.
Why Outdated Plugins Are a Risk
Outdated plugins pose a risk because known bugs remain in the code, the most common of which are security vulnerabilities. To learn how these vulnerabilities fit into the rest of your security strategy, read the A Complete Guide to WordPress Security. As soon as a vulnerability is disclosed, bots start searching for it specifically, which is why this is one of The 7 Causes of a WordPress Hack. To learn how to keep an eye on leaks, read Monitoring vulnerabilities in plugins. If a vulnerability has already been exploited, then you're talking about remediation rather than cleanup. For that, you can contact WordPress hacked.
There's something else to consider. After a WordPress or PHP update, an old plugin might suddenly cause a critical error, because compatibility with that new version has never been tested. Performance also suffers as a result. With a plugin like Query Monitor, you can see which plugin is slowing down your site. And sometimes a plugin is sold to a party with ulterior motives, after which unwanted code is introduced through a regular update.
If you’re not using a plugin, delete it. Deactivating it may feel safe, but the code remains on your server—like a window that’s closed but not locked. With some vulnerabilities, an attacker can directly access the files of an inactive plugin, even if that plugin no longer does anything in WordPress. Every plugin thus increases your attack surface—the total number of entry points someone can use to gain access. Not every vulnerability works that way, but I see no reason to leave the risk unaddressed.
How to Spot an Outdated or Abandoned Plugin
You can identify an outdated plugin by a pending update, and an abandoned plugin by the combination of an inactive developer and an outdated test version. Start by Plugins > Installed plugins, where you can see for each plugin whether an update is available. Then open the plugin page on wordpress.org. There, you’ll see when the plugin was last updated, which version of WordPress it has been tested with, and how many active installations it has. If there’s a yellow warning stating that the plugin hasn’t been tested with the last three major releases, or if the page indicates that the plugin has been discontinued, then you know what to do.
The second thing I check is the support forum. If questions are still being answered there, the plugin is usually still active. Finally, search WPScan or Patchstack to see if there are any known vulnerabilities. Also Extras > Site Diagnosis provides a recommendation if there are inactive plugins on your site. If you're using WP-CLI, it displays List of WordPress Plugins A single overview showing the status, the version, and whether an update is available. For premium plugins outside the repository, check the changelog and the license provided by the vendor. Our rule of thumb is one year without an update, but consider the combination of indicators. A small, simple plugin can remain stable for a long time without requiring any action.
Safely Remove Unused Plugins
Remove unused plugins one by one so that, if a problem arises, you'll know exactly which plugin caused it. This is the order I follow.
- Make a backup so you can revert to the previous state (see Restore a backup).
- Check where the plugin is being used—in shortcodes, blocks, widgets, or forms.
- If in doubt, test the removal first in a staging environment.
- Deactivate the plugin and check to see if your site is still working properly.
- Remove the plugin via Plugins > Installed Plugins > Uninstall.
- Clear the cache and test your most important pages and, if you have an online store, the checkout process.
Step 2 is the one most often skipped, and then, after deletion, you’ll suddenly see isolated shortcodes in square brackets on your pages. If the dashboard isn’t working, you can go to the plugin folder in wp-content/plugins You can also delete them using File Manager in cPanel. Clean up your unused themes right away, and keep no more than one default theme as a backup in addition to your active theme.
Many plugins leave settings and tables in the database after they are uninstalled. This is usually harmless and sometimes even intentional, so that your settings are restored when you reinstall the plugin. If you want to clean that up, read Cleaning Up the WordPress Database. Be careful with options like ‘delete all data upon uninstallation’ in WooCommerce or form plugins, as they can delete orders or submissions.
Replacing a Deprecated Plugin
Replace a deprecated plugin with an actively maintained alternative, and don’t remove the old one until the new one is working. Test the replacement on the staging environment, transfer the settings, and verify that everything the old plugin did actually works. For payment or shipping plugins, always place a test order. For an online store, this work is part of WooCommerce Management. Sometimes there isn't a good alternative. In that case, keep a close eye on the plugin, or have the feature custom-built through our webmaster service.
Things you can do yourself at Surver on Managed WordPress Hosting, is to create your own backup in Installatron before cleaning up and clone your installation there as a staging environment. At Surver Cloud, we set up the staging environment for you. With WP-CLI, which is included in all shared hosting plans, you can see which plugins are out of date with a single command. If you’d rather not keep track of this yourself, we’ll handle it for you within WordPress Management We update the core, themes, and plugins monthly. At Enterprise, we first test updates on staging, and this also includes catching up on updates for a neglected site. If you’re doing this yourself, schedule a plugin audit every quarter and read how to Install, manage, and update plugins.
Frequently Asked Questions
Can I set plugins to update automatically?
Yes, you can enable that for each plugin via Plugins > Installed plugins. Do this only for reliable, simple plugins—not for payment, shipping, or page builder plugins—and make sure you always have a recent backup.
How often should I check my plugins?
Check for updates weekly. Perform a full audit—including reviewing which plugins you’re still using and which ones are no longer in use—every quarter.
Does Surver check my plugins?
But when it comes to WordPress maintenance and management, yes. Surver updates your plugins monthly—with a level of monitoring that varies by package—and, starting with the Business plan, scans for vulnerabilities daily. You can safely clean up your site yourself using a backup and a staging clone in Installatron.
