Every installed plugin checked against WordPress.org — flagging the abandoned, the stale, and the closed — before one of them becomes a security incident.
Every WordPress plugin you install is a dependency — and like every dependency, it can be abandoned. The Plugin Abandonment Radar queries the WordPress.org Plugin API for every installed plugin and returns a risk-sorted table: last-updated date, tested-up-to version, and — the most important flag — whether the plugin has been closed or removed from the repository. Closed plugins never receive security updates. The reason they were removed is often a critical unpatched vulnerability that the developer stopped maintaining.
Results are cached for 12 hours to avoid hammering the API. A manual re-check button is available for after you make changes. Premium and custom plugins not hosted on WordPress.org are identified as such rather than incorrectly flagged.
Identifies plugins that have been removed from the WordPress.org repository — flagged as Critical because they will never receive another security patch. Plugins are closed for various reasons, but unpatched vulnerabilities are among the most common. If you have a closed plugin installed, it represents an open attack surface.
Checks the last updated date for every plugin. Warns at 12 months of no updates, and flags as High risk (abandoned) at 24 months. A plugin that hasn't been updated in two years is increasingly likely to contain unpatched vulnerabilities that affect current WordPress and PHP versions.
Compares each plugin's tested up to WordPress version against your running version. A plugin flagged as not tested against 3 or more recent WordPress releases is Medium risk — the developer may have stopped paying attention to WordPress core compatibility.
Every plugin presented in a risk-sorted table: Critical (closed/removed), High (abandoned 2+ years), Medium (stale or drifted compatibility), Low (actively maintained). Premium plugins not hosted on WordPress.org are marked as unknown rather than incorrectly flagged as at-risk.
Results are cached for 12 hours in a WordPress transient — so the wp.org API is queried at most twice daily regardless of how many times the page is loaded. A "Re-check now" button is available for after plugin changes, with a timestamp showing when the cache was last populated.
Plugins are closed for several reasons: unresolved security vulnerabilities reported by security researchers, abandonment (developer stops responding to the Plugin Review Team), terms of service violations, or at the developer's own request. Security-related closures are the most dangerous — the plugin may have a known, public vulnerability with no patch available.
WordPress will stop offering automatic updates for the plugin — you may notice it disappear from the update queue. The plugin continues to function on your site but will never receive security patches again. WordPress.org also removes the download page, but installed copies remain active unless you deactivate and delete them.
When a plugin slug returns a 404 from the WordPress.org API, the module marks it as "Not hosted on WordPress.org (premium/custom)" with a Low risk rating and a note to verify vendor support manually. It does not flag these as at-risk, since not being on wp.org is entirely normal for paid plugins.
The module makes read-only API calls to the public WordPress.org Plugin API — the same API that WordPress core itself uses for its plugin update checks. Plugin slugs are sent as query parameters in the API URL; no other site data is transmitted. No writes are made to your database, files, or settings.
Results are automatically cached for 12 hours. The page will serve the cached data until the transient expires, then re-query on the next page load. You can also trigger a fresh check at any time using the "Re-check now" button — useful after installing or removing plugins.
Closed, abandoned, and drifting plugins are the most common silent security risk on WordPress sites. The Abandonment Radar surfaces them in seconds — for free.
Pro adds the weekly Health Digest — so when a plugin goes stale or gets closed after your last check, you find out in your inbox automatically.
Plugin Abandonment Radar is fully included in the free Lite version — alongside 12 other diagnostic modules, no account required.
