WordPress does not tell you when an installed plugin has been closed in the directory. Check each plugin's directory page and last update, then replace closed or abandoned ones on a test copy first.

A plugin that quietly stops existing

Most WordPress sites run plugins from the official directory at WordPress.org, which is also where their updates come from.

Now and then a plugin is closed. Its page disappears, nobody new can download it, and no more updates are published.

On sites already running it, nothing visible happens. The plugin keeps working, the dashboard shows no warning, and the lack of update notices looks exactly like a plugin that is up to date.

That silence is the problem. A closed plugin can sit on a site for years.

Why plugins get closed

The first matters most. Closing a plugin with an unfixed hole stops new installs, but every site already running it keeps the hole, and the closure can attract people looking for holes to use.

Why the dashboard says nothing

WordPress checks the directory for newer versions of the plugins installed. A closed plugin has no newer version, so the check finds nothing to report.

There is no separate notice that a plugin has been withdrawn. On the updates screen, a closed plugin and a current one look the same.

Plugins bought from other marketplaces are not in the directory at all. Their updates depend on the seller and, often, a current licence key, so they need checking with the seller.

Plugins bundled inside a theme are the hardest case. They update only when the theme does, and many themes lag well behind.

Checking what you run

Open the Plugins screen and write down every installed plugin, active or not, with its version number.

Look each one up in the directory at wordpress.org/plugins. If its page is gone and a search no longer finds it, treat it as closed.

If the page is there, check when it was last updated, which WordPress version it is tested up to, and whether its support forum has unanswered reports.

The directory itself warns on plugins not updated in over two years.

A plugin updated six months ago is fine. One last updated two years ago and tested up to a version of WordPress from 2013 is abandoned, whether or not anybody closed it.

Closed is not always permanent

A plugin closed for a security problem is often reopened once the author publishes a fix. If yours reappears with a new version, update it promptly.

So when you find a closed plugin, find out why if you can. The plugin's own website, or the security sites that track WordPress problems, usually say.

If there is no fix and no explanation, assume the worst and plan the replacement.

A worked example

A small animation studio that makes explainer videos and title sequences keeps its portfolio on WordPress. Every project page uses a video gallery plugin that shows clips in a grid and plays them in a window over the page.

The site was built three years ago, and the developer had since moved on. Updates were clicked whenever the dashboard offered them, which felt like enough.

When a new developer reviewed the site, the gallery plugin was two years old and offered no update, and its directory page was gone.

A hole in it had been reported the previous year, and the plugin was closed when the author did not respond.

Replacing it took more than a swap. Each project page held the plugin's shortcode, a bracketed code like [video_gallery id=12] that the plugin turned into a grid. Without the plugin, visitors would have seen the bracketed code itself.

The developer made a copy of the site, installed a maintained gallery plugin, rebuilt each gallery and replaced the codes page by page.

Once every project page had been checked, the changes went live and the old plugin was deleted.

Replacing a plugin safely

Work on a copy of the site, never the live one. Many hosts can make a staging copy; otherwise your developer can build one.

List everything the old plugin did, including small things: a shortcode on a dozen pages, a setting in the footer, its own tables in the database.

Choose a replacement that is clearly maintained: updated in the last few months, tested with the current WordPress, and with a support forum where questions get answers.

Fewer plugins, fewer surprises

Every plugin is separate software from a separate author, with its own update schedule and its own chance of being abandoned. Forty plugins are forty of those chances.

Some do jobs WordPress now does itself. Since version 4.4, images inserted through the editor get responsive sizes automatically, so a plugin installed for that may no longer be needed.

When you review the list, ask of each plugin what would break without it. Sometimes the answer is nothing.

Make it someone's job

This check takes an hour or two on a typical small site, and it belongs on the calendar a few times a year, not only after something goes wrong.

If the site is maintained for you, ask whether this check is part of the work and how news of a closure would reach you. Developers who look after sites usually follow security alerts that cover closed plugins.

The counter-case

Not every old plugin is a danger. A tiny plugin that adds one line to the page header may have so little code that there is almost nothing to go wrong.

Not every closure is urgent either. A plugin withdrawn because its author retired has no future, but its replacement can usually wait for the next planned round of work.

The rule still holds: check every plugin against the directory, find out why any closed one was closed, and replace closed and abandoned plugins on a copy first.

The plugin check

  1. List every installed plugin with its version.
  2. Look each one up in the directory.
  3. Mark any plugin whose page has gone.
  4. Find out why it was closed.
  5. Flag plugins not updated in two years.
  6. Replace them on a copy before the live site.
  7. Delete the old plugin once replaced.

Step four sets the pace. A plugin closed for an unfixed security hole needs replacing this week; one closed because its author retired can wait for the next planned update.

The same end of updates, for a whole system rather than one plugin, is covered in Drupal 6 sites after the end of support.

Frequently asked questions

Does WordPress warn me about closed plugins?

No. The dashboard only looks for newer versions, and a closed plugin has none, so it looks exactly like a plugin that is up to date.

Why do plugins get closed in the directory?

Usually an unfixed security hole, an author who gave up, a broken directory rule, a licence or trademark problem, or code copied from another plugin.

How do I check whether a plugin is closed?

Look each installed plugin up in the directory. If its page is gone and a search no longer finds it, treat it as closed and find out why.

What counts as an abandoned plugin?

One with no update in two years or more, tested only with old WordPress versions, or with unanswered support reports, whether or not anyone formally closed it.

Can I just deactivate the old plugin?

Not safely on its own. Pages may hold its shortcodes, which then show as bracketed text, so rebuild on a copy first and delete the old plugin afterwards.

How often should plugins be checked?

A few times a year, as a scheduled job rather than after a problem. If someone maintains your site, ask whether it is part of what they do.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Plugins nobody has checked in years?

Copy the names from your Plugins screen into an email to us. We will mark which are closed, abandoned or fine.

Start a Conversation