How to tell whether a WordPress plugin is still maintained

A plugin's last-updated date is a starting point for a maintenance review. Read it alongside support responses, release notes, repository activity, compatibility testing and known security issues. No single signal proves that a plugin is safe or abandoned.

Correction, September 29, 2026: The earlier version included conflicting sample statistics and conclusions that could not be verified from the available source data. Those figures and the install-band chart have been removed pending verification. This version provides a qualitative review process.

Start with what the plugin can do

A small display utility and a plugin handling payments, file uploads or user permissions need different levels of scrutiny. List the features your site depends on and what could happen if each stops working. That gives the review a practical scope.

Popularity alone does not establish maintenance or security. Check the plugin against your actual WordPress, PHP and extension versions, using a staging environment and a tested recovery plan.

Read the support responses

Read recent threads for the substance and timing of maintainer responses. An unanswered report deserves investigation, but a quiet forum does not prove that users have no problems. Support may happen elsewhere, and users may stop reporting issues.

Look for reports that match your own configuration. A useful answer explains the problem, asks for relevant evidence or points to a fix you can verify. Use the forum as one part of the review, rather than turning a resolved-thread count into a safety rating.

Compare releases with repository activity

The WordPress Plugin Handbook describes the directory's Subversion release repository. Its history lets you compare release files and inspect what changed.

Check whether recent commits changed executable code, documentation or release metadata. A tested-up-to edit is evidence of activity, not proof of a substantive fix or completed compatibility testing.

A different committer is a reason to investigate. It does not by itself establish that ownership changed. Read the relevant announcement and release notes, and distinguish the person making a commit from the person or organization responsible for the product.

An old release needs context

A small utility may need few changes over time. An old release date alone does not establish abandonment. Check compatibility, vulnerability reports and maintainer activity before deciding whether to keep it.

If you retain the plugin, record the installed version and why it remains appropriate. Monitor relevant advisories and keep a tested update or replacement plan. Do not freeze updates simply because the current version appears to work.

Choose a next step you can verify

Keep and monitor. Document the reason, the person responsible and the next review date. Retention is a decision to revisit, not a safety certificate.

Update or replace. Test the affected features and failure paths before production. Check the replacement's maintenance signals too, and preserve the data you need to migrate or roll back.

Investigate a maintained fork. Check its source, maintainers, release history and compatibility. A new name does not remove the need for review.

Escalate a security concern. Follow the maintainer's disclosure process. Avoid publishing exploit details while a report is being handled.

Maintenance and package provenance answer different questions. A maintenance review does not establish who produced a particular downloaded artifact. Record the download source and any verification mechanism actually offered by that distributor, rather than assuming every plugin has the same protections.

Disclosure. MaxtDesign builds and sells WordPress plugins, and we have been looking at whether there is a business in package provenance and verification. So we have a stake in the argument above. We are not building a competing package manager. If we ever run a verification service, our own plugins are permanently out of scope for it, and that exclusion gets stated publicly rather than promised quietly.