WordPress plugin security: how to keep your site safe

Your WordPress site may look fine. Nothing on the page has changed for months. That is exactly the problem. The parts you never look at, the plugins, are the easiest parts to forget.

<link rel="stylesheet" href="/wp-content/plugins/contact-form-pro/css/form.css" />
<script src="/wp-content/plugins/gallery-slider/js/slider.js"></script>
<link rel="stylesheet" href="/wp-content/themes/office-lite/style.css" />

Why are plugins the weak point of a WordPress site?

Plugins add features such as forms, galleries, shops and booking. Each one is written by a developer, often a different one from the people who wrote WordPress, and each one runs on your server. A flaw in one plugin can give an attacker a way in, even when WordPress itself is fully up to date.

Patchstack, a company that tracks WordPress security, published a report on 2025. It says 91% of the new vulnerabilities found in the WordPress ecosystem were in plugins. It also counted 11,334 new vulnerabilities in 2025, 42% more than in 2024.

For a business owner, the lesson is simple. Most of the risk sits in the add-ons, so the add-ons deserve the most attention.

How do attackers find an outdated plugin?

They don't need to know anything about your business. Automated tools read public pages, look for the folder names of plugins and themes in the code, and compare them with lists of known flaws.

An outdated plugin with a published flaw is a known door. Once a flaw is public, attackers know where to look. The update is the fix, so the door closes when you install it. Until then, the site is exposed no matter how good everything else is.

What does Ward see on my WordPress site?

Ward's website check reads your home page from outside. If it finds WordPress, it lists the plugins and themes it can see in the page code. It also shows your WordPress version when the page reveals it.

It does not match those plugins against lists of known flaws, so it cannot tell you that one of them is vulnerable. The WordPress check also doesn't look at server ports or server software. The rest of the work is yours, and the steps below cover it.

How do I keep my WordPress plugins up to date?

Keep a list, update on a schedule, and test after each change. Writing the list takes the longest. After that, the routine is short and repeats.

1. Make a list. Log in to the WordPress admin and open Plugins. Write down each plugin and theme, what it does and who makes it.
2. Remove what you don't use. WordPress's documentation says to deactivate a plugin first and then delete it. Deleting an unused plugin means you stop maintaining code you don't need.
3. Back up before updates. Use a full backup from your host or a backup plugin. Check that you can restore it, not only that it exists. A backup you have never restored is a guess.
4. Update plugins and themes on a schedule. Update one at a time when you can, so you know which change caused a problem. WordPress can also update some plugins automatically. The documentation explains how to turn that on or off for each plugin.
5. Test the main pages. After each update, open the home page, the contact form, any checkout or booking page, and the log-in page.
6. Keep WordPress itself current. The core software needs updates too. WordPress's guide explains the steps: Updating WordPress.

Use the WordPress documentation on managing plugins for the exact screens, since they change between versions.

Which plugins should I keep?

Keep plugins that are still maintained. Look for a developer who still publishes updates, a clear way to get support and a recent update. A plugin that works today but has not been updated in years is a risk, even if nothing has gone wrong yet.

Fewer plugins mean fewer doors. If two plugins do the same job, keep the one that is maintained better and remove the other. Before you add a new plugin, ask what problem it solves that your site can't solve already.

What if a plugin is no longer updated?

Replace it when you can. Look for a maintained alternative that does the same job, and move the settings over during a quiet period, not during a busy week.

If you can't replace it yet, ask your web provider to review it and to turn off the features you don't use. Write the date on the list, so the replacement doesn't slip away.

Do themes count too?

Yes. The Ward finding lists themes as well as plugins, and an old theme is as much of an open door as an old plugin. Keep one active theme, remove the others you don't use, and update the active one like any plugin. If a designer built your theme, ask them how they keep it updated and who will do it when they are busy.

Where should I get plugins from?

Install plugins from the official WordPress plugin directory or from a vendor you know. Code from an unknown site can do things you never meant it to do. Before you install one, check when it was last updated, how many sites use it, and whether its developer answers questions.

What mistakes should I avoid?

• Updating everything at once on a busy day. If something breaks, you won't know which change caused it.
• Keeping a plugin "just in case." An unused plugin still runs code that someone has to keep safe.
• Trusting a backup you have never restored. A backup only helps when you can use it.
• Assuming the site is current because it loads. A site can load perfectly with an old plugin inside it.

Who should own the updates?

Give one person the list and the schedule. That can be you, someone on your team or your web provider. Write down who does the updates, how often, and who checks the site afterwards.

If an agency or provider runs your site, ask for that plan in writing. A single page is enough. Ask three questions: which plugins and themes are installed, when each one was last updated, and who tests the site after an update. If the answer to any of them is "I don't know," that is the first item on the list. Renewals belong on the same page: the domain and the certificate need the same care. See what happens if your domain expires and expired SSL certificates.

Why is a small site a target at all?

Attackers don't pick a small site because it is small. They scan for weak doors, and an old plugin is an easy one to find. Read why small businesses are targeted by hackers for the bigger picture.

A WordPress site stays safe the way a shop stays safe: someone checks the locks on a schedule and replaces the old ones. Start with the list this week. The first pass is mostly writing down what you already have, and the routine after that is short.