If you run a WordPress site, you have probably heard the warning that plugins are a security risk because so many are abandoned. That warning is true and misleading at the same time. We wanted to know how true, so on 28 August 2026 we retrieved every plugin listed in the official directory and checked when each one last had a release.
The headline number is uncomfortable
On that day the directory listed 70,909 plugins. Of those, 41,395, or 58.4 percent, had gone more than a year without a single release. More than half, 50.2 percent, had been silent for over two years. And 19,013 plugins, about one in four, were last touched in the same year they were added and then never again.
There is a second, quieter number behind that. Over the years, 123,970 plugin slugs have been issued. Of those, 53,061, or 42.8 percent, are no longer listed at all. So the directory you see today is already what is left after a large clean-up, and it still is more than half dormant.
If you stopped reading here, you would conclude that installing any plugin is a gamble.
Why that conclusion is wrong
The plugins nobody maintains are, overwhelmingly, plugins nobody uses. When we weighted the same numbers by active installs, the picture changed completely: plugins without a release in over a year account for only 3.7 to 7.8 percent of installs. The range exists because the directory reports installs in rounded steps, so we give the lower and the upper bound instead of a falsely precise figure.
The concentration at the top is extreme. Just 67 plugins carry between 41.5 and 60.9 percent of all installs in the directory. Those are the big, well-known names, and almost all of them are actively developed.
So two statements are true together. The directory is full of abandoned code. And the plugins that actually run on websites are mostly alive.
Where the real risk sits
The risk is not spread evenly. It sits in the long tail: the small plugin someone installed years ago for one feature, from a single developer who has since moved on. It works, nobody touches it, and it is often still active on sites whose owners have forgotten it exists. When a security hole is found in that kind of plugin, there is nobody left to patch it.
That is also why "how many plugins is too many" is the wrong question. Ten maintained plugins are safer than three abandoned ones. What matters is the state of each one, not the count.
A practical check that takes ten minutes
Open the plugin list of your site and look at each entry on its directory page. Three things tell you most of what you need to know: the date of the last update, the number of active installs, and whether support questions get answers. A plugin with a hundred thousand installs and an update last month is a reasonable bet. One with a few hundred installs and no release in two years deserves a replacement or a very good reason to stay.
While you are there, deactivate and delete what you do not use. An inactive plugin is not running, but its files are still on the server, and that is enough for some attacks.
If you want the full method and every number, we published the complete Plugin Directory Census with the data behind it.
Full disclosure: we build WordPress plugins ourselves, which is part of why we wanted to know how the directory really looks.
Top comments (0)