{"id":20428,"date":"2026-11-02T12:29:35","date_gmt":"2026-11-02T11:29:35","guid":{"rendered":"https:\/\/stage.surver.nl\/kennisbank\/verouderde-plugins-wordpress-opruimen\/"},"modified":"2026-11-03T14:54:13","modified_gmt":"2026-11-03T13:54:13","slug":"clean-up-outdated-wordpress-plugins","status":"publish","type":"kennisbank","link":"https:\/\/stage.surver.nl\/en\/kennisbank\/verouderde-plugins-wordpress-opruimen\/","title":{"rendered":"Outdated and Unused Plugins: Risks and How to Safely Remove Them"},"content":{"rendered":"
\"Outdated<\/figure>\n\n\n\n

Open your plugin list and you\u2019ll see another slider plugin from your previous website and a form plugin that hasn\u2019t done anything in years. A plugin is considered obsolete if it hasn\u2019t been updated in over a year, hasn\u2019t been tested with the current version of WordPress, or has been removed from the official repository. Deactivate and completely remove unused plugins, because simply deactivating them isn\u2019t enough. The broader context is explained in Choosing and Managing Plugins and Themes<\/a>.<\/p>\n\n\n\n

Outdated, abandoned, closed, or unused: what's the difference?<\/h2>\n\n\n\n

Outdated, abandoned, discontinued, and unused are four different situations, and each requires a different course of action. In practice, they\u2019re often confused with one another, which leads to advice like \u2018just update it\u2019 for a plugin that hasn\u2019t received updates in years. The table compares them side by side.<\/p>\n\n\n\n

Concept<\/th>What It Is<\/th>How can you tell?<\/th>Risk<\/th>Promotion<\/th><\/tr><\/thead>
Outdated plugin<\/td>Update available, not installed<\/td>Update notification in your plugin list<\/td>Known vulnerabilities remain unpatched<\/td>Backing Up and Updating<\/td><\/tr>
Abandoned plugin<\/td>The developer has stopped working on it<\/td>No updates for over a year, a quiet support forum<\/td>New leaks are no longer being patched<\/td>Replace<\/td><\/tr>
Closed plugin<\/td>Removed from the official repository<\/td>Post on wordpress.org<\/td>The reason may be a security issue<\/td>Find out why; usually, replace it<\/td><\/tr>
Unused (inactive) plugin<\/td>Disabled but still installed<\/td>Status: Inactive<\/td>The code is still on your server<\/td>Delete<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

So, you update an outdated plugin, replace an abandoned or discontinued plugin, and remove an unused plugin. An abandoned plugin that\u2019s still running on your site is also called a \u201czombie plugin.\u201d I compare it to a house whose landlord no longer comes by to make repairs. As long as nothing breaks, you won\u2019t notice anything, but a leaky roof will keep leaking.<\/p>\n\n\n\n

Why Outdated Plugins Are a Risk<\/h2>\n\n\n\n

Outdated plugins pose a risk because known bugs remain in the code, the most common of which are security vulnerabilities. To learn how these vulnerabilities fit into the rest of your security strategy, read the A Complete Guide to WordPress Security<\/a>. As soon as a vulnerability is disclosed, bots start searching for it specifically, which is why this is one of The 7 Causes of a WordPress Hack<\/a>. To learn how to keep an eye on leaks, read Monitoring vulnerabilities in plugins<\/a>. If a vulnerability has already been exploited, then you're talking about remediation rather than cleanup. For that, you can contact WordPress hacked<\/a>.<\/p>\n\n\n\n

There's something else to consider. After a WordPress or PHP update, an old plugin might suddenly cause a critical error<\/a>, because compatibility with that new version has never been tested. Performance also suffers as a result. With a plugin like Query Monitor, you can see which plugin is slowing down your site. And sometimes a plugin is sold to a party with ulterior motives, after which unwanted code is introduced through a regular update.<\/p>\n\n\n\n

If you\u2019re not using a plugin, delete it. Deactivating it may feel safe, but the code remains on your server\u2014like a window that\u2019s closed but not locked. With some vulnerabilities, an attacker can directly access the files of an inactive plugin, even if that plugin no longer does anything in WordPress. Every plugin thus increases your attack surface\u2014the total number of entry points someone can use to gain access. Not every vulnerability works that way, but I see no reason to leave the risk unaddressed.<\/p>\n\n\n\n

How to Spot an Outdated or Abandoned Plugin<\/h2>\n\n\n\n

You can identify an outdated plugin by a pending update, and an abandoned plugin by the combination of an inactive developer and an outdated test version. Start by Plugins > Installed plugins<\/strong>, where you can see for each plugin whether an update is available. Then open the plugin page on wordpress.org. There, you\u2019ll see when the plugin was last updated, which version of WordPress it has been tested with, and how many active installations it has. If there\u2019s a yellow warning stating that the plugin hasn\u2019t been tested with the last three major releases, or if the page indicates that the plugin has been discontinued, then you know what to do.<\/p>\n\n\n\n

The second thing I check is the support forum. If questions are still being answered there, the plugin is usually still active. Finally, search WPScan or Patchstack to see if there are any known vulnerabilities. Also Gereedschap > Sitediagnose<\/strong> provides a recommendation if there are inactive plugins on your site. If you're using WP-CLI, it displays List of WordPress Plugins<\/code> A single overview showing the status, the version, and whether an update is available. For premium plugins outside the repository, check the changelog and the license provided by the vendor. Our rule of thumb is one year without an update, but consider the combination of indicators. A small, simple plugin can remain stable for a long time without requiring any action.<\/p>\n\n\n\n

Safely Remove Unused Plugins<\/h2>\n\n\n\n

Remove unused plugins one by one so that, if a problem arises, you'll know exactly which plugin caused it. This is the order I follow.<\/p>\n\n\n\n

    \n
  1. Make a backup so you can revert to the previous state (see Restore a backup<\/a>).<\/li>\n\n
  2. Check where the plugin is being used\u2014in shortcodes, blocks, widgets, or forms.<\/li>\n\n
  3. If in doubt, test the removal first in a staging environment<\/a>.<\/li>\n\n
  4. Deactivate the plugin and check to see if your site is still working properly.<\/li>\n\n
  5. Remove the plugin via Plugins > Installed Plugins > Uninstall<\/strong>.<\/li>\n\n
  6. Clear the cache and test your most important pages and, if you have an online store, the checkout process.<\/li>\n<\/ol>\n\n\n\n

    Step 2 is the one most often skipped, and then, after deletion, you\u2019ll suddenly see isolated shortcodes in square brackets on your pages. If the dashboard isn\u2019t working, you can go to the plugin folder in wp-content\/plugins<\/code> You can also delete them using File Manager in cPanel. Clean up your unused themes right away, and keep no more than one default theme as a backup in addition to your active theme.<\/p>\n\n\n\n

    Many plugins leave settings and tables in the database after they are uninstalled. This is usually harmless and sometimes even intentional, so that your settings are restored when you reinstall the plugin. If you want to clean that up, read Cleaning Up the WordPress Database<\/a>. Be careful with options like \u2018delete all data upon uninstallation\u2019 in WooCommerce or form plugins, as they can delete orders or submissions.<\/p>\n\n\n\n

    Replacing a Deprecated Plugin<\/h2>\n\n\n\n

    Replace a deprecated plugin with an actively maintained alternative, and don\u2019t remove the old one until the new one is working. Test the replacement on the staging environment, transfer the settings, and verify that everything the old plugin did actually works. For payment or shipping plugins, always place a test order. For an online store, this work is part of WooCommerce Management<\/a>. Sometimes there isn't a good alternative. In that case, keep a close eye on the plugin, or have the feature custom-built through our webmaster service<\/a>.<\/p>\n\n\n\n

    Things you can do yourself at Surver on Managed WordPress Hosting<\/a>, is to create your own backup in Installatron before cleaning up and clone your installation there as a staging environment. At Surver Cloud, we set up the staging environment for you. With WP-CLI, which is included in all shared hosting plans, you can see which plugins are out of date with a single command. If you\u2019d rather not keep track of this yourself, we\u2019ll handle it for you within WordPress Management<\/a> We update the core, themes, and plugins monthly. At Enterprise, we first test updates on staging, and this also includes catching up on updates for a neglected site. If you\u2019re doing this yourself, schedule a plugin audit every quarter and read how to Install, manage, and update plugins<\/a>.<\/p>\n\n\n\n

    Frequently Asked Questions<\/h2>\n\n\n\n

    Can I set plugins to update automatically?<\/strong><\/p>\n\n\n\n

    Yes, you can enable that for each plugin via Plugins > Installed plugins<\/strong>. Do this only for reliable, simple plugins\u2014not for payment, shipping, or page builder plugins\u2014and make sure you always have a recent backup.<\/p>\n\n\n\n

    How often should I check my plugins?<\/strong><\/p>\n\n\n\n

    Check for updates weekly. Perform a full audit\u2014including reviewing which plugins you\u2019re still using and which ones are no longer in use\u2014every quarter.<\/p>\n\n\n\n

    Does Surver check my plugins?<\/strong><\/p>\n\n\n\n

    But when it comes to WordPress maintenance and management, yes. Surver updates your plugins monthly\u2014with a level of monitoring that varies by package\u2014and, starting with the Business plan, scans for vulnerabilities daily. You can safely clean up your site yourself using a backup and a staging clone in Installatron.<\/p>","protected":false},"excerpt":{"rendered":"

    Je opent je pluginlijst en ziet nog een sliderplugin van je vorige website en een formulierplugin die al jaren niets meer doet. Een plugin is verouderd als hij langer dan een jaar geen update kreeg, niet getest is met de huidige WordPress-versie of uit de offici\u00eble repository is verwijderd. Deactiveer en verwijder ongebruikte plugins volledig, […]<\/p>\n","protected":false},"author":2,"featured_media":20492,"template":"","kennisbank_categorieen":[57],"class_list":["post-20428","kennisbank","type-kennisbank","status-publish","has-post-thumbnail","hentry","kennisbank_categorieen-plugins"],"acf":[],"_links":{"self":[{"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/kennisbank\/20428","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/kennisbank"}],"about":[{"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/types\/kennisbank"}],"author":[{"embeddable":true,"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/users\/2"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/media\/20492"}],"wp:attachment":[{"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/media?parent=20428"}],"wp:term":[{"taxonomy":"kennisbank_categorieen","embeddable":true,"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/kennisbank_categorieen?post=20428"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}