# How to tell if a WordPress plugin is abandoned (and what to do about it) By [Plugevity](https://plugevity.com/about/) · Published November 11, 2026 **Short answer.** Six public signs tell you a plugin is abandoned or changing hands: it was closed on WordPress.org, it has not shipped a release in over a year, it was not tested with recent WordPress versions, its support threads go unanswered, it has a new owner, or its contributors changed. You can check all six on the plugin’s WordPress.org page. None of them means “uninstall today” on its own. What to do depends on which sign you see. **Figure: Six signs a WordPress plugin is abandoned or changing hands** 1. Closed on WordPress.org: The plugin page says it is closed and no longer available. It gets no more updates. 2. No release in over a year: "Last updated" on the plugin page. Over two years is a strong sign. 3. Not tested with recent WordPress: "Tested up to" is two or more major versions behind the current one. 4. Support threads left unresolved: The support tab shows few of the last two months' threads resolved. 5. A new owner: The owner account on WordPress.org changed. The next update can contain anything. 6. New contributors: The Contributors line in the readme lost its old names or gained new ones. Source: [the signals Health Score reads](https://plugevity.com/plugins/health-score/) ## Where to look Open the plugin’s page on WordPress.org (Plugins → Installed Plugins → “View details” gets you close; the full page is at `wordpress.org/plugins//`). - **Closed.** A closed plugin’s page says so in a [notice at the top](https://developer.wordpress.org/plugins/wordpress-org/alerts-and-warnings/#closed), with the date, and after 60 days with the reason. WordPress does not warn you about it in your dashboard: the request to add that alert has been open since 2014 ([Trac ticket 30465](https://core.trac.wordpress.org/ticket/30465)). - **Last updated.** In the sidebar. This is the date of the last release, not the last time someone answered in the forum. - **Tested up to.** In the sidebar. Compare it with the current WordPress version. One version behind is normal for a few weeks after every release; two or more is a sign. WordPress.org itself shows an [out-of-date warning](https://developer.wordpress.org/plugins/wordpress-org/alerts-and-warnings/#out-of-date) on plugins that were not tested with the last 3 major releases. - **Support.** The support tab says how many of the threads opened in the last two months were resolved. Users mark threads resolved, so a low number only means something when there are many threads. - **Owner and contributors.** The page lists the plugin’s contributors, and the readme has a Contributors line. A change there is easy to miss unless you wrote down the old names. ## What to do about each sign You see What it usually means What to do Closed on WordPress.org No more updates from WordPress.org, often for an unfixed security issue or a guideline problem Replace it. Read the closure reason if it is shown No release in 1–2 years, tested up to is behind Nobody is working on it, or it is finished Keep it while it works. Pick a replacement now and test it on a copy of the site No release in 2+ years Very likely unmaintained Plan the replacement this quarter, before a WordPress or PHP update forces it Support threads unresolved The author may be gone, or just busy Read a few threads. If people report the same bug for months, treat it as unmaintained New owner or new contributors The plugin was sold or handed over Hold the next update and read its changelog first. Most handovers are fine, but the new owner can ship any code The last row is the one people miss. In 2017 the Display Widgets plugin was sold and shipped a backdoor a month later, on about 200,000 sites ([SecurityWeek](https://www.securityweek.com/backdoored-plugin-impacts-200000-wordpress-sites)). In 2025 a buyer took over 31 Essential Plugin plugins and shipped a backdoor in an ordinary-looking update about 12 weeks later; WordPress.org closed all 31 in April 2026 ([TechCrunch](https://techcrunch.com/2026/04/14/someone-planted-backdoors-in-dozens-of-wordpress-plugins-used-in-thousands-of-websites/)). In both cases the change of hands was public before the bad update: see our replays of [Display Widgets](https://plugevity.com/cases/display-widgets-2017/) and [Essential Plugin](https://plugevity.com/cases/essential-plugin-backdoor/). ## Checking it for every plugin at once Checking six signs by hand works for one plugin. For twenty, it is the kind of chore that gets skipped. [Health Score](https://plugevity.com/plugins/health-score/) is our free plugin that reads the same public WordPress.org data for every installed plugin and your active theme once a day, turns it into a 0–100 score with plain reasons, and emails you when a plugin is closed or changes owner. **Figure: Points each sign takes off Health Score's 0–100 score** 1. Closed on WordPress.org: score 0 2. No release for 2+ years (1–2 years: 25; 6–12 months: 10): −45 3. New owner on WordPress.org: −30 4. Tested up to 3+ versions behind (2 behind: 10): −25 5. Under 20% of 10+ support threads resolved: −10 6. Contributors changed: −10 Grades: 80 and above Healthy, 50–79 Watch, below 50 At risk. Rules of Health Score 0.1.0. Source: [Health Score](https://plugevity.com/plugins/health-score/) What it does **not** do: it does not read plugin code, so it cannot tell a harmless update from a malicious one, and it cannot score premium plugins or plugins that do not come from WordPress.org, which show as “Not checked”. It tells you which plugins deserve a closer look; the look is still yours. ## Questions ### How long without an update before a WordPress plugin counts as abandoned? There is no official rule. A small, finished plugin can be fine after a year without a release. Over two years without a release, together with a "tested up to" version several releases behind, is a strong sign that nobody is maintaining it. ### Is it safe to keep using an abandoned plugin? It keeps working until something changes around it, such as a new WordPress or PHP version, or a security issue that nobody will fix. If the plugin is closed on WordPress.org, plan to replace it. If it is only old, keep it while it works and pick a replacement before you need one. ### How do I know if a WordPress plugin was sold? WordPress does not tell you. Two public signals change when a plugin changes hands, the owner account on its WordPress.org page and the Contributors line in its readme. Check both before a big update, or let Health Score watch them and email you. ## The plugins in this post [Health Score](https://plugevity.com/plugins/health-score/): Know which of your plugins are built to last. Drafted with AI assistance; tested and edited by a person before publishing. Questions or corrections? [Reply by email](mailto:hello@plugevity.com?subject=Re%3A%20How%20to%20tell%20if%20a%20WordPress%20plugin%20is%20abandoned%20(and%20what%20to%20do%20about%20it)). [All posts](https://plugevity.com/blog/) · [RSS](https://plugevity.com/blog/feed.xml) --- Source: https://plugevity.com/blog/how-to-tell-if-a-wordpress-plugin-is-abandoned/