What to do when a WordPress plugin is closed or abandoned

Sometimes you'll visit a plugin's page on WordPress.org and find a notice saying "This plugin has been closed" and "is not available for download". Or you'll notice that a plugin you rely on hasn't been updated in years, and its support forum is full of unanswered questions. Either way, the plugin is still running on your site, but nobody may be looking after it any more.

That doesn't mean your site is in immediate danger. But a plugin with no one maintaining it won't get security fixes or compatibility updates, and the longer you keep it, the more likely it is to cause problems. This guide covers how to work out how urgent it is and how to replace it without breaking anything.

How you'll find out

WordPress doesn't always warn you when a plugin is closed. The dashboard may simply stop offering updates for it, which is easy to mistake for "up to date". You're more likely to find out from:

• The plugin's page on WordPress.org, which shows a closure notice at the top
• A security plugin. Wordfence's scan, for example, flags plugins that have been removed from WordPress.org, and plugins that haven't been updated in at least two years.¹
• Security news, including our weekly This week in WordPress roundup, which lists notable closures
• A yellow warning on the plugin's WordPress.org page saying it "hasn't been tested with the latest 3 major releases of WordPress", which is often the first sign of abandonment²

Premium plugins don't have closure notices, but the signs are similar: no updates for a long time, a support desk that doesn't reply, a developer website that's disappeared or a licence server that no longer works.

Find out why it was closed

The closure notice on WordPress.org says whether the closure is temporary (often "pending a full review") or permanent. WordPress.org publishes the reason for a closure once 60 days have passed, so a recently closed plugin may not show one yet.² The published reasons are:²

Security Issue. The plugin has a vulnerability that hasn't been fixed. This is the most urgent reason. Check security news for details of the problem, and treat it as described in our guide to handling a plugin security vulnerability. Replace or remove the plugin as soon as you can.

Author Request. The developer has decided to stop maintaining it, or has moved it elsewhere, perhaps to a paid version or a new name. Check the developer's website for an announcement. The plugin won't get any more updates on WordPress.org, so plan a replacement.

Guideline Violation or Licensing/Trademark Violation. The closure is about the rules of the plugin directory rather than necessarily a technical problem. The plugin may be safe right now, but it won't get updates through WordPress.org while it's closed.

Merged Into Core. WordPress now does what the plugin did. Check whether you still need it at all.

No reason shown yet. The plugin was closed recently, and WordPress.org doesn't give details to the public. A temporary closure can be for anything from a minor guideline issue to a serious security problem that hasn't been disclosed yet. Many plugins are reopened once the developer fixes the issue, but don't assume it will be. Treat it with caution, keep an eye on security news and start looking at alternatives.

Judge the risk to your site

Beyond the closure reason, think about what the plugin actually does.

A plugin that handles anything visitors can send to your site (forms, file uploads, logins, registrations, comments, payments or search) carries more risk, because those are the places attackers probe. A plugin that only adds a small tweak in the admin area, such as a column in a list or a dashboard widget, is lower risk.

Also consider how much of your site depends on it. A plugin you could delete this afternoon is easy. A page builder that every page was built with, or a plugin that stores your product data, needs a proper plan.

A note on plugins that change hands

Sometimes an abandoned plugin gets taken over by a new owner, reopened and updated. That's often welcome, but it's also how some supply-chain attacks happen. A plugin with a large, trusting user base changes hands, and a later update adds spam links, tracking or worse.

If a plugin that had been quiet for years suddenly has a new author and a flurry of updates, read the changelog and recent reviews before updating, and take a backup first. Changes that have nothing to do with what the plugin does are a warning sign.

Choose a replacement

Start by writing down exactly what the plugin does on your site. It's easy to forget features you set up years ago, like a shortcode on one page, a redirect rule, a scheduled task or an extra field on your checkout.

Then look for alternatives. When comparing plugins on WordPress.org, check:

• Last updated: within the last few months is a good sign.
• Tested up to: should be the current or previous major version of WordPress.
• Active installations: more isn't always better, but a large user base means problems get noticed and fixed quickly.
• Support forum: are questions getting answered, and are recent problems marked as resolved?
• Scope: a plugin that does what you need and little else is usually better than a sprawling one with dozens of features you'll never use.

For small jobs, you might not need a plugin at all. A few lines of code in your theme, or a small custom plugin, can often replace a plugin that did one simple thing. That's code nobody else can abandon.

Switch over safely

1. Take a full backup, and check you know how to restore it. If your host offers snapshots, take one immediately before you start.
2. Test on a staging site if you can. Many hosts offer one-click staging. If not, do the switch at a quiet time.
3. Install and configure the replacement before removing the old plugin, so there's as little gap as possible.
4. Move any data across. Some replacements can import settings or content from popular plugins they replace. Otherwise, you may need to recreate forms, redirects or settings by hand. Export or screenshot the old plugin's settings before you remove it, since you won't be able to see them afterwards.
5. Look for leftover shortcodes. When a plugin that provided shortcodes is removed, pages show the raw shortcode text instead, like [old_plugin_form id="3"]. Search your pages and posts for the shortcode name and replace each one.
6. Deactivate and delete the old plugin. Deleting it (not just deactivating it) removes its files from the server, which is what removes the risk. Many plugins also delete their own data when they're deleted, which is another reason for that backup.
7. Check the site properly. Test the pages and features the old plugin was involved in, submit any forms and, on a shop, place a test order.

If removing the plugin causes a critical error, something else on the site (often the theme or custom code) was relying on it. Put it back from your backup and find the dependency before trying again.

Some plugins leave database tables, settings and scheduled actions behind after they're deleted. These are usually harmless, but if the plugin stored a lot of data, a clean-up can help keep the database tidy. Don't delete unfamiliar tables unless you're sure what they belong to, and take a database backup before you do.

Stopgaps while you replace it

If you can't replace a plugin straight away, reduce the risk in the meantime. Disable any features you don't need. Make sure a firewall is in place, since some offer virtual patches for known vulnerabilities in closed plugins. And set a date for the replacement, so "temporary" doesn't quietly become permanent.

Need help?

Replacing a plugin that a lot of your site relies on, like a page builder, a membership system or a WooCommerce extension, can be a bigger job than it first looks. My WordPress development service covers plugin replacements, migrations and custom plugins to replace abandoned ones. If a closed plugin has already caused problems, emergency WordPress support can help get things back on track, and my maintenance plans include keeping an eye on the plugins you rely on.