Data collected October 21, 2026 from the public wordpress.org plugin directory. Figures will change as plugins are updated.

Of the 1,000 most-installed plugins in the wordpress.org directory, 72 have not received an update in more than a year, and 41 of those have gone more than two years. Together, the 72 report about 6.4 million active installs. Most popular plugins are well maintained: 80% were updated in the last three months. The risk sits in a smaller group that is still widely installed but no longer moving.

What we measured

We took the 1,000 plugins the wordpress.org directory ranks as most popular and recorded, for each one, the date of its last update, the latest WordPress version it says it was tested with, its active install count, and the date it was added to the directory. WordPress 7.1 was the current release on the day we collected the data.

A few limits are worth stating up front:

  • Active installs are rounded. wordpress.org reports them in bands such as "300,000+", so totals are lower bounds, not exact counts.
  • Installs are not sites. One site can run several of these plugins, so the 6.4 million figure counts installations, not unique websites.
  • Closed plugins are missing. Plugins removed from the directory for security or guideline reasons no longer appear in the popular list, so this data cannot show them.
  • Premium plugins are not included. Only plugins hosted on wordpress.org are covered.

The full dataset is published as a CSV file so anyone can check the numbers or run their own analysis.

How recently the top 1,000 were updated

Most of the list is actively maintained. Here is how long it had been since each plugin's last update:

  • Less than 3 months: 802 plugins (80%)
  • 3 to 6 months: 73 plugins (7%)
  • 6 to 12 months: 53 plugins (5%)
  • 1 to 2 years: 31 plugins (3%)
  • More than 2 years: 41 plugins (4%)

The top of the list is the healthiest part. Among the 100 most popular plugins, only one had gone more than a year without an update. The stale plugins are concentrated further down, among plugins with tens of thousands to a few hundred thousand installs. That is the range where a plugin can be installed on many sites while being maintained by a single volunteer.

Plugins still widely installed after a year without updates

Fourteen plugins with 100,000 or more active installs had not been updated in over a year on the day we checked. The largest:

  • Regenerate Thumbnails: 1,000,000+ installs, last updated August 20, 2025
  • Intuitive Custom Post Order: 400,000+ installs, last updated September 16, 2025
  • AMP: 300,000+ installs, last updated April 10, 2025
  • Child Theme Configurator: 300,000+ installs, last updated June 10, 2025
  • Limit Login Attempts: 300,000+ installs, last updated April 4, 2023
  • Health Check & Troubleshooting: 200,000+ installs, last updated July 25, 2024
  • Layout Grid Block: 200,000+ installs, last updated July 11, 2023

This is not a list of dangerous plugins. Some of them do one narrow job and may simply be finished. But each one is a dependency with nobody visibly working on it. If a vulnerability is reported tomorrow, nothing says a fix will ship, and the site owner may not hear about it at all.

Two patterns stand out. Limit Login Attempts, a plugin people install for security, has not been updated since April 2023 and is still on more than 300,000 installs. And PHP Code Widget, which lets administrators run PHP code from a widget, has 70,000+ installs and was last updated in March 2022. Plugins that touch logins or run code are the ones where an unpatched flaw does the most damage.

The "tested up to" warning

93 of the 1,000 plugins say they were last tested with WordPress 6.8 or older, and two declare no tested version at all. When a plugin has not been tested with the latest three major WordPress releases, its wordpress.org page shows a warning that it may no longer be maintained or supported.

"Tested up to" is set by the developer, so it is a signal, not proof. Some active developers forget to bump it, and the plugin works fine. But in our data, every plugin that had gone a year without an update also carried an outdated "tested up to" value. When both signals point the same way, take them seriously.

The plugins are old, not just stale

437 of the 1,000 plugins (44%) were added to the directory before 2015. Age alone is not a problem: many of the best-maintained plugins in WordPress are more than ten years old. It matters because old code that has stopped receiving updates was written for older versions of PHP and WordPress, and nobody is checking how it behaves on current ones.

How to check the plugins on your own site

Checking takes about ten minutes per site.

  1. List what you run. In the dashboard, open Plugins. With WP-CLI, run wp plugin list --fields=name,status,version,update_version.
  2. Check the last update date. Click View details under each plugin name and read Last Updated, or look the plugin up on wordpress.org.
  3. Flag anything over a year old, and anything showing the "not tested with the latest 3 major releases" warning.
  4. Decide per plugin: keep it if it is small and you have a reason to trust it, replace it with a maintained alternative if one exists, or remove it if you no longer need it.
  5. Delete what you deactivate. An inactive plugin's files stay on the server, and some flaws can be reached even when the plugin is not active.

Repeat the check every quarter. Our WordPress maintenance plan checklist puts it on a schedule with the rest of routine upkeep, and the WordPress hardening checklist covers what to lock down around the plugins you keep.

How we will use this data

We plan to repeat this snapshot every quarter with the same method, so changes over time are visible: which plugins come back to life, which ones get closed, and whether the stale group grows. Each update will be published here with its own dataset.

When to get help

If you manage many sites, or you find an unmaintained plugin that your site depends on and cannot simply remove, replacing it safely takes planning. A security audit maps every plugin across your sites against maintenance and vulnerability data, and our WordPress hardening service replaces or isolates the risky ones without downtime.