If your WordPress website ever gets hacked, the most likely way in isn’t some sophisticated attack on WordPress itself — it’s an old, forgotten plugin nobody has looked at in two years. WordPress core is well-guarded; the plugins are the soft spot. The good news is that the single most effective thing you can do to protect your site takes about 20 minutes and requires no technical skill: a plugin audit.
Think of it like checking the locks and smoke detectors in your building once a year. You’re not renovating — you’re just walking through, making sure everything still works, and dealing with the one thing that’s quietly become a hazard. This post gives you a simple checklist to do exactly that.
Why a forgotten plugin is such a common way in
Every plugin on your site is code running with full access to it. When a plugin’s developer stops maintaining it, or a security hole is found and never patched, that plugin becomes an unlocked door. In 2026, the overwhelming majority of WordPress site compromises come through plugin vulnerabilities rather than WordPress core, and a meaningful share of disclosed vulnerabilities still don’t have a fix available weeks after they’re made public. An abandoned plugin you’ve forgotten about is the perfect target: nobody’s watching it, and nobody’s updating it.
The 20-minute payoff: You don’t need to understand the code. You just need to spot the plugins that are unused, out of date, or abandoned, and deal with them. Removing one forgotten plugin can close the exact door an attacker would have walked through.
The annual plugin audit checklist
Set a timer for 20 minutes, log in to your WordPress dashboard, and go to the Plugins screen. Work through these steps in order. If you’re nervous about changing anything, do steps 1 through 4 now and hand steps 5 and 6 to whoever maintains your site.
Step 1 — Count them
- Look at how many active plugins you have. There’s no magic maximum, but if you’re past 20, that alone is worth a closer look. Five well-maintained plugins are far safer than fifteen neglected ones.
Step 2 — Find the ones you don’t use
- Go down the list and ask, for each one, “do we actually use this?” Old contact-form plugins, a slider you stopped using, that SEO tool you replaced — deactivated or not, if it’s installed, it’s still a risk. Flag every plugin you can’t clearly justify.
Step 3 — Check the update status
- Note any plugin showing an available update — those are your priority. Updates frequently contain security patches, so an out-of-date plugin is often an unpatched one.
Step 4 — Spot the abandoned ones
- For plugins you rely on, click through to their page in the WordPress plugin directory and check the “last updated” date and whether they’re marked compatible with your WordPress version. A plugin untouched by its developer for a year or more is a red flag — it may be abandoned, which means future security holes won’t get fixed. Note these for replacement.
Step 5 — Back up, then remove
- Before deleting anything, make sure you have a current backup (or that your host or care plan does). Then deactivate the plugins you flagged as unused. Give the site a day to confirm nothing broke, then fully delete them — deactivated-but-installed still counts as attack surface.
Step 6 — Update what remains
- Update the plugins you’re keeping, one at a time, checking the site after each on anything important. Updating one at a time makes it easy to spot which change caused a problem if something does go wrong.
That’s the whole audit. Done once a year — ideally the same month every year so you remember — it dramatically shrinks the odds that a forgotten plugin becomes your security incident.
One important caution
Deactivating or deleting a plugin can occasionally break something on your site — a form might stop working, a layout might shift, a feature might disappear. That’s exactly why steps 5 and 6 insist on a backup first and changing one thing at a time. If a plugin’s purpose isn’t obvious to you, or if it’s tied to something important like your forms, checkout, or security, don’t guess — flag it and check with whoever maintains your site before removing it. The goal is a safer site, not a broken one.
The Connect4 approach
An annual DIY audit is genuinely valuable, but a year is a long time in security terms — new plugin vulnerabilities are disclosed every week. That’s why, for the sites we manage on care plans, we don’t wait for an annual checkup: we monitor plugins continuously, apply security updates promptly, watch for abandoned plugins before they become a problem, and keep tested backups so removing or updating anything is never a gamble. You get the peace of mind of an always-current audit instead of an annual one — and you never have to remember to set the timer yourself.
What you can do right now (no developer needed)
- Log in and count your active plugins. If it’s over 20, put a plugin audit on your calendar this week.
- Deactivate and delete any plugin you know for certain you’re not using — after confirming you have a backup.
- Apply any pending plugin updates, one at a time, checking your site after each.
- For the plugins you depend on, check their “last updated” date and flag anything untouched for a year or more.
- Pick a fixed month each year to repeat this, and add a recurring calendar reminder so it actually happens.
Where Connect4 can help
- Run a thorough plugin audit for you and deliver a plain-English report: what to keep, update, replace, or remove.
- Safely remove unused and abandoned plugins, with tested backups in place first so nothing breaks.
- Replace abandoned single-purpose plugins with better-maintained alternatives or lean custom code where appropriate.
- Monitor your plugins year-round and apply security updates promptly, so you’re never relying on memory or luck.
- Fold plugin health into a monthly care plan alongside security, performance, and content.
Frequently asked questions
How often should I audit my WordPress plugins?
At minimum once a year, ideally the same month each year so you remember. New plugin vulnerabilities are disclosed weekly, so sites that can’t monitor continuously benefit from more frequent checks or a care plan that watches plugins year-round.
Is it safe to just delete plugins I’m not using?
Generally yes, and unused plugins are pure risk with no benefit. But make sure you have a current backup first, deactivate before deleting, and give the site a day to confirm nothing broke. If a plugin’s purpose isn’t clear, check with whoever maintains your site.
How do I know if a plugin is abandoned?
Open its page in the WordPress plugin directory and check the “last updated” date and whether it’s marked compatible with your WordPress version. A plugin untouched for a year or more, or flagged as untested with recent WordPress versions, should be treated as a replacement candidate.
How many plugins is too many?
There’s no fixed number — five well-coded, actively maintained plugins are safer than three abandoned ones. If you’re running 20 or more, it’s worth auditing for single-purpose and unused plugins you can consolidate or remove.
What if updating a plugin breaks my site?
This is why you update one plugin at a time with a recent backup available. If an update causes a problem, you can identify the culprit immediately and roll back. For critical sites, testing updates on a staging copy first avoids any risk to the live site.
Twenty minutes now beats a hacked site later
A plugin audit is one of the highest-value, lowest-effort things a small business owner can do for their website. It costs you 20 minutes a year and closes the door most attackers actually use. If you’d rather have it handled continuously — so you’re never one forgotten plugin away from a problem — Connect4 can take it off your plate entirely. Reach Gabe at gabe@connect4consulting.com or 202-236-2968.
