Are WordPress Plugins Safe? How to Choose Plugins You Can Trust

On Thursday 16 October, from 4:02 in the morning until 3:12 in the afternoon Malaysia time, some WordPress sites that updated one popular SEO plugin received malware with the update. The site owners did what everyone tells them to do: they kept their plugins up to date. Rank Math, the plugin’s maker, says “The affected plugin files contained malware that could compromise your website if the plugin was activated.”^[4] Two days later, a different trusted tool, a backup plugin’s remote-management service, was used to plant backdoors.^[5] So are WordPress plugins safe? Mostly, yes. But each one is someone else’s code running with full power on your website, and this guide is about choosing that someone carefully.

The short answer: plugins are where most WordPress security problems start, so fewer, better-maintained plugins from makers you can trust, plus a backup stored away from the site, matter more than any single security setting.

Why plugins are where the risk is

WordPress itself is maintained by a large team and patched quickly. The plugins around it are written by thousands of different companies and individuals. Patchstack, a WordPress security company that coordinates many vulnerability reports, counted the 2025 numbers in its yearly report: “11,334 new vulnerabilities were found in the WordPress ecosystem in 2025 – that’s a 42% increase compared to 2024.” And: “91% of new vulnerabilities were found in plugins, and 9% were found in themes.”^[1]

The same report found that “46% of vulnerabilities did not receive a patch by the time of disclosure”.^[1] In other words, nearly half the time a weakness becomes public knowledge before there is an update to fix it.

WordPress’s own security guide puts the responsibility in the same place. Hosts look after the server, but hacks are “Rarely” down to the infrastructure and “most often attributed to the application itself (i.e., the environment you are responsible for).”^[2]

Three ways a plugin can hurt you, all seen in one week

October 2026 gave us a full set of examples in a single week.

• A flaw in the code. The ordinary case. A plugin has a weakness, the maker fixes it, and sites that update are safe. On 17 October we applied a critical fix of this kind (rated 9.1 out of 10) to one site we look after: full backup first, update, pages checked.
• A poisoned update. The update itself carries the malware, as with some Rank Math PRO 3.0.123 downloads. Updating again does not undo it; Rank Math says “Deactivating the plugin alone is not sufficient.”^[4]
• An abused connection. A plugin links your site to a company’s cloud dashboard, and someone steals the keys. Patchstack wrote that the UpdraftCentral case “is not a vulnerability in UpdraftPlus”; the commands came signed with genuine keys.^[5]

Only the first is solved by “keep everything updated”. The other two are solved by choosing fewer makers, knowing what can reach your site, and having a backup from before the bad day.

What we found when we counted our own plugins

Advice is easy, so we checked ourselves. On 19 October 2026 we listed every plugin on the 11 WordPress sites we can log in to, including our own.

What we counted	Result (19 October 2026)
Plugins installed, all 11 sites	292
Plugins per site	18 to 50 (median 24)
Installed but switched off	35, spread across 9 of the 11 sites
Remote-management connections	Every site has the connection we use to look after it. Two also have a second management connector, and our own site has one more that we use for our own tools
Sites affected by the Rank Math PRO or UpdraftCentral incidents	None (checked 18 and 19 October)

The number that stands out is 35. A switched-off plugin does nothing for the site, but its files are still on the server. WordPress’s guidance is blunt: “if you are not using a specific plugin, delete it from the system.”^[2] This is advice we are applying to ourselves: the next step is to go through those 35 with each site owner and remove what is not needed.

How to choose a plugin you can trust

Before you click Install, run through these questions. They take five minutes and rule out most bad choices.

1. Where does it come from? WordPress’s advice: “Restrict yourself to the WordPress.org repository or well known companies.”^[2] Never install a “free” copy of a paid plugin from a download site.
2. Does it follow the directory rules? Plugins listed on WordPress.org must keep code readable and may not phone home without consent. One rule matters most here: “Plugins may not send executable code via third-party systems.”^[3] Paid plugins sold elsewhere are not reviewed against these rules, so you are trusting the company instead.
3. Is it maintained? Look at when it was last updated and whether it is tested with the current WordPress version. A plugin nobody has touched in a year will not get a quick fix when a flaw is found.
4. What can it reach? A contact form needs far less power than a plugin that connects your site to a cloud dashboard that can install other plugins. The more a plugin can do, the more you need to trust its maker.
5. Do you already have something that does this? Many sites run two plugins for one job. Each extra maker is another company whose bad day becomes yours.

Our view: fewer makers, known connections, backups off the site

We do not think the answer is to avoid plugins. WordPress without plugins is rarely useful to a business, and a good plugin from a careful maker is safer than custom code nobody maintains. Our rules are simpler than that.

• One plugin per job, from a maker with a record of fixing problems quickly.
• Delete what is switched off. Our own count shows how easily these pile up.
• Know every connection that can install code on a site, and be able to cut it in minutes. We use remote management ourselves; the point is to keep the list short and known.
• Backups kept away from the site. On the sites we spot-checked on our servers, backups are taken by the hosting platform every 12 hours and stored on a separate backup server, so a bad plugin cannot reach them.
• Watch the advisories. We read the WordPress security advisories every day and check the sites we look after when one matters, as we did twice this week.

For the routine side of updates, see our WordPress maintenance guide, and for what an attacker does once inside, read about the hack that hides its own admin account.

What not to do

• Don’t install “nulled” plugins, the pirated free copies of paid plugins. You cannot know what was added to them.
• Don’t install a plugin for one small job that a few lines of settings, or a plugin you already have, could do.
• Don’t leave plugins switched off “just in case”. Delete them; you can reinstall later.
• Don’t connect your site to a cloud dashboard and forget about it. If you stop using a service, remove its connection key from the site as well.
• Don’t update without a backup you know how to restore. Rank Math’s recommended fix for its poisoned update was a backup from before it arrived.^[4]

Check it yourself

1. Count your plugins. In WordPress, go to Plugins. Note the totals next to “All” and “Inactive”.
2. Clear out the inactive ones. For each inactive plugin, ask whether you will use it in the next month. If not, delete it.
3. Check each plugin’s record. Click “View details”, or open its page on WordPress.org, and look at “Last updated” and “Tested up to”.
4. List your connections. Look for plugins that link your site to an outside dashboard (backup, management, security or SEO services) and check that each one is still in use.
5. Ask your host one question in writing: “If a plugin infected my site today, which backup from before today could you restore, and where is it stored?”

Frequently asked questions

Are WordPress plugins safe to use?

Mostly, yes, but plugins are where most WordPress security problems start. Patchstack found that 91% of new WordPress vulnerabilities in 2025 were in plugins. Use fewer plugins, from WordPress.org or well-known companies, keep them updated, and keep a backup stored away from the site.

Are paid plugins safer than free ones?

Not automatically. Paid plugins can have flaws too, and the malware incident in October 2026 involved a paid plugin, Rank Math PRO. Judge a plugin by its maker, how quickly it fixes problems and how much access it needs, not by its price.

How many plugins is too many?

There is no safe number. On the 11 WordPress sites we looked at on 19 October 2026, the count ranged from 18 to 50. What matters is that every plugin is needed, maintained and from a maker you trust, and that unused ones are deleted.

Should I delete plugins I have switched off?

Yes. A switched-off plugin does nothing for your site, but its files are still on the server. WordPress advises that if you are not using a plugin, you should delete it. You can always reinstall it later.

A note on what we do

This guide is general advice. We are a web design and SEO studio, not a cybersecurity firm, and we don’t offer security investigations or malware clean-up as a service. If you think a plugin has compromised your site, contact your hosting provider and the plugin’s maker first, and use a specialist security service for any clean-up.

What we write here is what we check on the websites we build and host for our own clients. If you are planning a new website, or want a second opinion on your current site’s design and SEO, request a free written review.

References

1. Patchstack, “State of WordPress Security in 2026”. Accessed 19 October 2026.
2. WordPress.org, “Hardening WordPress”, Advanced Administration Handbook, last updated 14 October 2026. Accessed 19 October 2026.
3. WordPress.org, “Detailed Plugin Guidelines”, Plugin Handbook. Accessed 19 October 2026.
4. Rank Math, “Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website”, 16 October 2026. Accessed 19 October 2026.
5. Patchstack (Dave Jong), “Stolen UpdraftCentral Keys Are Backdooring WordPress Sites”, 19 October 2026. Accessed 19 October 2026.
6. Total Web Solutions records: plugin inventory of the 11 WordPress sites we can log in to, 19 October 2026; Rank Math PRO and UpdraftCentral indicator checks, 18 and 19 October 2026.