How to choose a WordPress plugin, and try it without risking your site

Choosing a plugin comes down to two questions. Is someone still looking after it? And does it work on your site without breaking something that already works? The first you can answer from the plugin's listing before you install anything. The second you can only answer by trying it, and the place to try it is a copy of the site.

This page is a method and names no plugin to install. It covers what a WordPress.org listing tells you, how plugins sold elsewhere differ, how to try one safely, and how to take it out again.

Decide whether you need it

A plugin is a package of PHP code that extends WordPress, often with scripts and styles of its own. Each one you add has a cost, whatever it does:

• Code that runs on every page. WordPress loads every active plugin each time a page is requested, including pages the plugin has no part in. How much work it does there is up to its author.
• Another thing to update. WordPress's own Site Health screen says plugins have deep access to a site, and that this is why they must be kept up to date.
• Another possible conflict. Two plugins, or a plugin and the theme, can get in each other's way. See how to find and fix a plugin conflict.

There is no number of plugins that is too many. A few that each do a lot can weigh more than many that each do a little. Ask first whether the site already does the job: WordPress itself, your theme, or a plugin you already run may cover it.

Read the WordPress.org listing

Every plugin in the directory has a page at wordpress.org/plugins/. From the dashboard, go to Plugins, then Add New, and select "More Details" on a plugin to read about it there. Read the parts below together. No single one settles it.

The notice at the top, if there is one

WordPress.org puts one of two notices above a listing.

The first reads: "This plugin hasn't been tested with the latest 3 major releases of WordPress. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress."

The second reads: "This plugin has been closed and is no longer available for download." Newer notices give the date. A closed plugin cannot be downloaded from the site or installed from the dashboard. After 60 days the notice gives the reason in broad terms: an author request, a guideline violation, a licensing or trademark violation, a merge into WordPress itself, or a security issue. The details are not published.

Do not install a closed plugin from a copy found somewhere else. If a plugin you already run is closed for a security issue, plan its replacement now.

"Last updated"

This is how long ago the author last released a new version. A long gap can mean the plugin has been abandoned. It can also mean a small plugin is finished and has needed nothing since.

"Tested up to"

WordPress.org defines this as the version of WordPress the plugin has been tested against. The author writes it in the plugin's readme file, and can raise it without releasing a new version. Authors are emailed before every major WordPress release and asked to do so.

That makes it the author's statement, not a check by WordPress.org. It is still worth reading, because an author who keeps it current is paying attention. On the Add New screen each plugin carries the note "Compatible with your version of WordPress" or "Untested with your version of WordPress."

"WordPress version" and "PHP version"

These are minimums: the lowest WordPress version the plugin works on, and the lowest PHP version it needs. Compare them with your own. Go to Tools, then Site Health, then Info. The WordPress section gives your version, and the Server section covers PHP.

The changelog

The Development tab of a listing holds the changelog: what changed in each release. Look at how often releases come, and whether the author says plainly when a release closes a security hole or changes how something works.

The support forum

The Support tab opens the plugin's forum, and the listing shows how many issues were marked resolved in the last two months. Open the recent threads. Does the author answer? Does the same fault come up again and again without a reply?

The forums are run by volunteers, and their guidelines say nobody is obliged to give support there, authors of directory plugins included. A quiet forum breaks no rule, but it tells you what to expect when you need help.

The Advanced View

The "Advanced View" link on a listing shows which versions of the plugin are in use and offers earlier versions to download. That list is the plugin's release history at a glance. WordPress.org warns there that previous versions may not be secure or stable and are not recommended for a live site.

What the directory requires of a plugin

A plugin is examined before it is approved for the directory, and its author is expected to follow the directory's guidelines. Several of them protect you directly:

• A license compatible with the GPL, the license WordPress itself uses.
• Readable code. Hiding what the code does is not permitted. The guidelines call it a common way to hide malicious code.
• No trialware. Features in the directory version may not be locked until you pay, or switched off after a trial. Paid features may be sold as a service or as separate add-ons hosted elsewhere.
• No tracking without consent. A plugin may not contact outside servers without your explicit agreement. Plugins whose purpose is to connect the site to a service are the exception: setting one up counts as agreeing.
• Updates only from WordPress.org. A directory plugin may not install updates or other plugins from anyone else's servers.

When a security issue is found in a directory plugin, the guidelines say it is closed until the issue is resolved. In extreme cases WordPress's security team may release the update itself.

None of this is a guarantee. The guidelines say security is the responsibility of the plugin's developer, and that the directory enforces it as well as it can. WordPress's own documentation calls directory plugins safe to use and, in the same sentence, "of varying quality" and "often works in progress". Being in the directory is a floor. The listing tells you how far above it a plugin stands.

Paid plugins sold outside the directory

Commercial plugins are not sold on WordPress.org. A plugin sold only on its author's site has not been through the directory's examination and is not bound by its guidelines. That says nothing against it, but the checking is yours.

Three things work differently:

• Installing. You download a zip file from the seller and add it under Plugins, then Add New, with the "Upload Plugin" button.
• Updates. WordPress shows an update notice for such a plugin only if its author built in an updater of their own. WordPress's documentation says most paid plugins do.
• Support. It comes from the seller. WordPress.org's forum guidelines send questions about commercial plugins to the seller's own support channel.

Updates and support can depend on a current license. The WooCommerce.com Marketplace is one example: its documentation says a purchase gives a subscription with access to updates and support for the period the subscription covers.

Before you buy, find out from the seller's site:

• What the license covers, for how many sites and for how long.
• What happens when it runs out. If updates stop, security fixes stop with them.
• Whether the changelog and the documentation are open to read before you pay.
• Whether a version exists in the directory. If it does, try that one first.

Never install a "nulled" copy

A "nulled" plugin is a pirated copy of a paid plugin, handed out by a site that is not its seller. Someone you cannot identify had the code before you did.

Wordfence, a security company, published research in 2019 on a malware campaign named WP-VCD, which spread through nulled plugins and themes. The research describes infections that kept a lasting hold on a site, and attackers who earned from them by manipulating search results and by adding advertising code that sent visitors to redirects and pop-ups.

WordPress's hardening guide gives the rule in two sentences: "Do not get plugins/themes from untrusted sources. Restrict yourself to the WordPress.org repository or well known companies."

If a nulled plugin or theme has ever been active on your site, deleting it does not prove the site is clean. Follow how to remove malware from a hacked WordPress site.

Try it on a staging copy first

A listing cannot tell you how a plugin behaves beside your theme and your other plugins. A staging site can: it is a private copy of your site, where a fault reaches no visitor. How to set up a WordPress staging site shows how to make one, and how to stop the copy from emailing customers or taking payments.

With WP-CLI, one command installs a directory plugin by its folder name and activates it:

How to back out

• Deactivate it. On the Plugins screen, select "Deactivate" under the plugin, or run wp plugin deactivate plugin-folder-name. Its settings stay in the database.
• If the dashboard is gone. A plugin that stops PHP takes the dashboard down too. How to fix the white screen of death shows how to switch it off through the file manager.
• If the fault shows only beside another plugin. That is a conflict. The plugin conflict guide linked above shows how to find the pair.
• If switching it off does not undo the change. Restore the backup. Everything that reached the site after the backup was taken is lost. That is the reason to find this out on staging.

Remove a plugin properly

Deactivating and deleting are different things.

Deactivating switches the plugin off. Its files stay on the server and its settings stay in the database. WordPress's hardening guide is direct about a plugin you are not using: delete it.

Deleting removes the plugin's files. Only an inactive plugin can be deleted, so deactivate first, then select "Delete". What happens to its data depends on the author. WordPress lets a plugin run a clean-up routine of its own when it is deleted, to remove its settings and database tables. A plugin whose author wrote one may take its settings with it. A plugin with none leaves them in the database.

So before you delete:

• If it holds data you need, such as form entries, take a backup first and look in the plugin's settings for an export.
• Check the pages that used it. Whatever the plugin drew on a page, such as a form or a gallery, goes with it. Find those pages on staging first.

With WP-CLI, wp plugin uninstall runs the plugin's clean-up routine and then deletes its files. wp plugin delete only deletes the files.

Keep it updated once it is in

Choosing a plugin is also taking on its updates. WordPress can install them for you, one plugin at a time: on the Plugins screen, select "Enable auto-updates" in that plugin's row. It runs these updates twice a day and emails you when they succeed or fail. WordPress's documentation suggests making sure you can go back to an earlier state of the site before you switch this on. The update guide linked above helps you decide which plugins to trust with it.

If you would rather not do that upkeep yourself, our update service applies updates weekly on a care plan, looks at the site after each run, and undoes an update that went wrong.

What not to rely on

• Install counts and star ratings. They show that a plugin is widely used and liked. They do not show that it is maintained, or that it works with your theme and your other plugins. Read what recent reviews say instead of counting them.
• One field of a listing on its own. The author can raise "Tested up to" by editing a line of text, and an old "Last updated" may belong to a finished plugin.
• A list of recommended plugins. A list cannot know your site. Use one to find candidates, then check each as above. The comparisons of backup, caching, security and firewall plugins on this site give each product's facts and rank none.
• Activating it on the live site "just to look". An active plugin runs for your visitors too. Look on staging.