Health Score

Why it exists

WordPress tells you when an update is available. It does not tell you that a plugin has not shipped a release in three years, that WordPress.org closed it for a security issue, or that someone else now owns it.

That last one matters more than it sounds. When a plugin is sold, the new owner can ship any code in the next update, and your site installs it like any other. In April 2026 WordPress.org closed 31 plugins, active on about 20,000 sites, after the buyer of the portfolio planted a backdoor in their updates (Anchor Hosting, TechCrunch).

What it does

• Longevity score. Every plugin and your active theme get a 0–100 score from public WordPress.org data: last release, “tested up to” compared with the latest WordPress, and how many support threads get resolved. Every deduction is shown as a plain reason.
• Closed plugin detection. See at once when WordPress.org has closed a plugin you use, and why.
• Ownership-change alert. Health Score remembers who owns each plugin on WordPress.org and emails you when that changes, so you can review the next update before you install it.
• Site Health tests for closed plugins, unreviewed ownership changes and plugins with no release in two years.
• Email alerts only when something changes, plus an optional weekly summary.
• Abilities for AI agents (WordPress 6.9+): plugevity/get-plugin-health and plugevity/list-risky-plugins, both read-only.

It is read-only. It never deactivates, updates or changes another plugin.

Privacy

Health Score sends no data to Plugevity. Once a day, in the background, it asks the public WordPress.org API about each installed plugin and the active theme, sending only their slugs. WordPress itself sends the same list to the same service when it checks for updates. Plugins whose Update URI points outside WordPress.org are never sent.

How the score works

It starts at 100. A release older than six months, one year or two years, a “tested up to” version two or more releases behind, a very low support resolution rate and an unreviewed ownership change each subtract points. A closed plugin scores 0. Premium plugins and plugins that update from elsewhere show as “Not checked”, because there is no public data to score them with.

Before release we calibrated the weights on 31 real WordPress.org plugins, from large plugins to stale ones. In the first version 13 of the 28 healthy plugins showed a warning that meant nothing. Now 28 of 31 score healthy and only one of them shows a reason. A plugin that is one WordPress release behind is not flagged, because that is normal for weeks after every release. Health Score starts warning at two releases behind; WordPress.org itself warns at three.

Questions

How do I know if a WordPress plugin is abandoned?

Look at three things on its WordPress.org page, the date of the last release, the "tested up to" WordPress version and whether the plugin is still listed. Health Score reads the same public data for every plugin on your site once a day and turns it into a 0 to 100 score with plain reasons, so you do not have to check each page by hand.

What happens when a WordPress plugin changes owner?

The new owner can ship any code in the next update, and your site installs it like any other update. In April 2026 WordPress.org closed 31 plugins after the buyer of a plugin portfolio planted a backdoor in their updates. Health Score records who owns each plugin on WordPress.org and emails you when that changes, so you can review the next update before installing it.

What does it mean when a plugin is closed on WordPress.org?

A closed plugin gets no more updates through WordPress.org, often because of an unfixed security issue or a guideline violation. WordPress does not warn you about it in the dashboard. Health Score shows closed plugins with a score of 0 and the closure reason, and adds a Site Health test for them.

Does Health Score slow down my site?

No. It talks to WordPress.org only from WP-Cron, in batches of 15 plugins, never while a page loads. The admin screen, Site Health and the abilities read cached results.

Does it check premium plugins?

No. Premium plugins and plugins whose Update URI points outside WordPress.org have no public data to score, so they are shown as "Not checked" and are never sent anywhere.

Is Health Score free?

Yes. It is free, licensed under the GPL, sends no data to Plugevity and has no upsells in the dashboard.

Built to last

Plugevity Health Score is covered by the continuity pledge: 90 days' notice before any change of ownership, and the code goes to the community if we ever stop.