Plugin Risk Auditor

What this checks

Paste a list of WordPress plugin slugs. The tool queries the wordpress.org plugin API for each one and grades it against the signals that matter:

• Last updated. A plugin that hasn't been touched in over two years is a red flag. WordPress core moves, PHP moves, and dormant plugins accumulate compatibility and security gaps.
• Tested up to. If the plugin's Tested up to header lags the current WordPress version by more than a couple of releases, the author isn't keeping up.
• Active installs. Very low install counts don't automatically mean risk, but a plugin with under a thousand active installs has a smaller pool of eyes on it, and less incentive for the author to keep going.
• Author footprint. A one-plugin author who hasn't shipped anything else, or an author who's suddenly acquired a plugin with millions of installs, is worth double-checking. Recent ownership changes are how the 2024 supply-chain attacks landed.

Where to get the slugs

• From wp-admin. The plugin's directory name is its slug. On a WordPress site, wp-content/plugins/akismet/ gives you the slug akismet.
• From WP-CLI. Run wp plugin list --field=name and paste the output.
• From wordpress.org. In the plugin's URL, https://wordpress.org/plugins/wordfence/ gives you wordfence.

Paste one per line. The tool checks up to 40 at once.

What it doesn't check

This is a public-signal audit. It uses only the data wordpress.org exposes: last updated, tested-up-to, install count, author. It doesn't scan the plugin's code, doesn't look at CVE databases, and doesn't know about premium plugins that live outside the wordpress.org repository.

For premium plugins, you have to do the work manually. Chapter 8 of Protect My WP covers the full plugin vetting process.