Are my website's plugins out of date?
Worth a look
Plugins are where most break-ins to small-business websites actually start — far more often than the platform itself. Every plugin is somebody else's code running on your site with full access to it, and each one is a maintenance commitment you made without especially noticing.
Why plugins, rather than the platform
WordPress core is maintained by a large, well-funded project that updates itself by default. A plugin might be maintained by one person who wrote it in 2016 for their own site and put it up for free.
That isn't a criticism of them — it's just the shape of the risk. When a weakness is found in a widely-used plugin, it becomes public, it gets a number, and every site still running the old version is findable automatically. If the author has moved on, nobody is coming to fix it, and there is no update to apply even if you're paying attention.
Number of plugins matters more than most owners expect, because each one is an independent bet on somebody else's continued interest. Twenty plugins is twenty of those.
Out of date, and abandoned
Out of date means a newer version exists and you haven't installed it. That's ordinary housekeeping, and usually one click.
Abandoned is the one worth acting on properly: the author hasn't published anything for years, so the version you're on is the newest there will ever be. Updating isn't an option — the decision is whether to keep relying on it, replace it with something maintained, or remove it if the site no longer needs what it does.
A plugin that has been withdrawn from the WordPress directory altogether deserves immediate attention. Plugins are frequently pulled precisely because a security problem was reported and not fixed, and a withdrawn plugin keeps running on your site with no indication anything has changed.
What a passive check can and can't see
Gus reads the plugin and theme names out of the file addresses your public pages load — the same thing any visitor's browser downloads. That finds the ones that put something on the page: a form, a slider, a cookie banner, a booking widget.
It won't find every plugin. Anything that only works behind the scenes — a backup tool, a security plugin, an SEO plugin that touches nothing visible — leaves no trace on the home page, so it isn't in the list. The list is a floor, not an inventory.
Versions are patchier still. Many sites strip the version out of their file addresses, and WordPress often stamps its own version onto a plugin's files rather than the plugin's, which looks convincing and is wrong. Where Gus can't be sure, he says he could see the plugin but couldn't check its version, rather than guessing either way.
How to check this yourself
- Log in to WordPress and go to Plugins. Anything with an “update now” notice under it is behind, and the screen tells you how far.
- For each plugin, open its page in the WordPress plugin directory (wordpress.org/plugins/its-name) and look at “Last updated”. Anything untouched for over a year deserves a decision; over two years, treat it as abandoned.
- If a plugin's directory page has vanished or shows a notice saying it's been closed, that's the urgent one — it means the directory has withdrawn it.
- Deactivate and delete anything you no longer use. A deactivated plugin is still installed, and installed is what matters.
What to ask your web person
Copy this. It's phrased so you don't have to know the jargon to ask for the right thing.
Could you send me a list of the plugins and themes on our site, with each one's current version, the latest available, and when its author last published an update? I'd particularly like to know about anything untouched for over a year, or that has been removed from the plugin directory, and who is responsible for keeping these current from now on.
Want to know if this applies to your site?
Gus checks this and everything else in the free check-up, then explains what he found in plain English. It's free, there's no account, and it takes about a minute.