The Plugin That Was Abandoned

Abandonment is silent

A plugin that stops being maintained behaves exactly like one that is.

It continues working, shows no warning, and reports no update available, which is technically true and misleading.

Nothing in the site's own interface distinguishes a plugin updated last week from one last touched in 2019.

Which means the risk accumulates invisibly and is only noticed when somebody goes looking, usually after something has gone wrong.

Why an unmaintained plugin is a risk

Not because old code becomes dangerous on its own, which it does not.

The risk is that weaknesses continue to be discovered in it, by researchers and by others, and nobody is issuing fixes.

When such a weakness is published, every site running that plugin is identifiable and vulnerable, permanently, since no update is coming.

An unmaintained plugin also stops being tested against new versions of the platform, so it breaks eventually as well.

And popular abandoned plugins are attractive targets precisely because they are widespread and unfixed.

How to check

• Last updated date in the plugin directory.
• Whether it is marked as untested with your version.
• The support forum, and whether anybody replies.
• Whether it has been removed from the directory.
• Recent reviews mentioning it being dead.

The fourth is the serious signal. A plugin withdrawn from the directory is frequently withdrawn because of an unresolved security problem, and you will not be told.

The thresholds

Rough, and useful enough to act on.

Updated within six months: fine, no action.

Six to twelve months: watch it, particularly if the platform has had a major release since.

Over a year: treat as a candidate for replacement, and prioritise by what it touches.

Over two years, or removed from the directory: replace or remove now, regardless of whether it works.

A small simple plugin that adds a display element is less urgent than one handling forms, logins, payments, or file uploads, which is where the risk concentrates.

A worked example

A business had fourteen plugins installed, all showing as up to date.

Checking each in the directory took about twenty minutes and found four untouched for over two years and one that had been removed entirely eight months earlier.

The removed one was a form handler, which is the category where this matters most.

They replaced it with a maintained alternative, which took an afternoon including rebuilding two forms, and removed three of the four abandoned ones as unnecessary.

The fourth was replaced over the following month, since it needed a like-for-like alternative and some testing.

Nothing had gone wrong, which is the point of doing this before it does.

Replacing one

The practical sequence, since a swap can break things.

Find a maintained alternative and check its own last-updated date before committing to it.

Take a backup, then do the swap on a copy of the site rather than the live one where you can.

Export whatever data the old plugin holds first, since removing it may take the data with it, and form submissions and settings are frequently stored inside the plugin.

Install the new one, configure it, confirm it works, then remove the old one rather than deactivating it.

Check the pages that used it afterwards, on a phone as well, since a swapped display element frequently looks different.

The best outcome is removal

Worth considering before looking for a replacement.

A proportion of abandoned plugins turn out to be doing something the business no longer needs, or something the platform now does natively.

Ask what would actually break if this were removed, and where the answer is nothing anybody would notice, remove it.

Platforms have absorbed a great deal of functionality over the years, so a plugin installed in 2017 to add something may be duplicating a built-in feature.

Fewer plugins is better for speed, maintenance, and risk simultaneously, which is an unusual alignment.

Themes are worse than plugins

Worth separating, since the same problem applies and gets far less attention.

A theme is loaded on every page, has broad access to the site, and is frequently a premium one bought once with a year of updates that lapsed.

Nobody replaces a theme casually, because it defines how the site looks, so an abandoned theme tends to stay for years after a plugin would have been swapped.

Check its last-updated date the same way, and check whether the licence that entitles you to updates is still active, since an expired licence stops the updates without saying so.

Also remove any theme you are not using, since inactive themes sit on the server exactly as inactive plugins do.

Make it a routine check

Since this only stays fixed if it is repeated.

Twice a year, go through everything installed and check the last-updated date on each.

Note the date you checked and what you found, so the next check is a comparison rather than starting again.

Add it to whatever other periodic checks you do, since it is the same twenty minutes and the same mindset.

Where somebody else maintains the site, ask them for this specifically, since a maintenance arrangement covering updates does not necessarily cover abandonment.

The counter-case

An old plugin is not automatically a problem.

Some small, simple plugins are genuinely finished, do one thing correctly, and have needed no changes, and replacing them achieves nothing.

Replacing a working component also carries its own risk, and a business that breaks its forms chasing a theoretical exposure has made things worse.

The judgement is about what the plugin touches: anything handling input, authentication, or files deserves urgency, and a display element does not.

Check the dates twice a year, act on anything touching input or logins, and remove rather than replace where you can.

The check

1. List everything installed, including themes.
2. Check the last-updated date for each.
3. Note anything removed from the directory.
4. Prioritise by what it touches.
5. Ask what would break if it were removed.
6. Export the data before replacing.
7. Repeat twice a year.

Step three is the one that finds the urgent cases, since a plugin withdrawn from the directory is frequently withdrawn for a reason nobody will tell you about.

The related problem of updates you are avoiding is covered in the plugin you are scared to update.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.