Are your WordPress plugins a security risk?
Most WordPress sites that get hacked are broken into through a plugin or theme, not WordPress itself. Here is how to check yours, which plugins to worry about, and how to stay safe.
WordPress itself is well looked after. The risk is in the extras: plugins and themes written by thousands of different developers, some of whom stopped updating them years ago. When a security hole is found in a popular plugin, it's published openly, and automated attacks start trying it on every WordPress site they can find, often within days.
How to check your plugins
- Look for updates. In your WordPress dashboard, open Plugins and Themes. Anything marked "update available" may include a security fix.
- Remove what you don't use. A deactivated plugin can still be attacked if its files are on the server. If you don't need it, delete it.
- Watch for abandoned plugins. If a plugin hasn't been updated in a year or more, look for an alternative that's actively maintained.
- Check against known security holes. Public vulnerability databases, such as Wordfence Intelligence, list which versions of which plugins have known problems.
How to update safely
- Take a backup first, so a bad update can be rolled back in minutes.
- Update one plugin at a time on busy sites, and check the site after each one.
- Turn on automatic updates for small, routine releases. They're usually bug and security fixes.
Keep version numbers private
Many sites show the exact version of every plugin in their public code. That gives attackers a ready-made list of what to try. Hiding versions doesn't fix anything on its own, but combined with updates it makes your site a harder target.
Common questions
Should I turn on automatic updates?
For small, routine updates, yes. For big version changes, update with a backup in place and check the site afterwards.
Is a free plugin less safe than a paid one?
Not necessarily. What matters most is whether it is actively maintained and kept up to date.
How would I know if one of my plugins has a known security hole?
Vulnerability databases publish them every day. Riyo Site Monitor checks your plugin versions against them daily and emails you if one is affected.