WordPress is a fantastically powerful and versatile content management system (CMS), but like any software, it comes with its share of issues, especially when it comes to security.
One question many WordPress site owners ask us is whether deactivated plugins pose a security risk.
Plugins are the “extensions” – the extra bits of software, mostly written by third-party authors, that raise WordPress from a bare-bones content system to a fully-fledged website builder than can run any type of website, from informational to e-commerce.
It is very often useful to deactivate plugins. Some reasons include evaluating new plugins, considering alternatives, debugging a website and fixing errors.
It is sometimes very difficult to tell if a plugin is actually doing anything! đ€
For example, in a complex e-commerce setup, you might have a plugin which adds a certain capability, perhaps giving the customer the ability to upload a photo to allow their product to have their photo printed on it.
In a site with just a few products, you could just eyeball each one to tell if the plugin is being used. But what if you have thousands of products? There is often no better way to tell if a plugin is being used than to deactivate it for a while and see what happens!
Now, while the answer isnât a straightforward yes or no, there are important considerations that website owners should understand when it comes to leaving plugins deactivated.
What Happens When a Plugin is Deactivated?
When you deactivate a plugin in WordPress, its functionality is completely disabled. The plugin no longer interacts with your website, and its code does not run. However, the pluginâs files and data remain on your server unless you delete it entirely. This distinction between deactivation and deletion is critical in understanding the potential risks.
Deactivation vs Deletion
There are two ways to remove a plugin from your site: deactivation and deletion.
If you deactivate the plugin, you do not remove the software or its data. It is simply switched off, but can be switched back on at any time.
If you delete the plugin, you physically remove its software. In many cases you also remove any data it is storing too, though with some plugins, this data deletion is optional, allowing you to reinstate the plugin if you want to.
Why Deactivated Plugins May Be a Security Risk
While deactivated plugins may seem harmless at first glance, there are scenarios in which they can become a vulnerability:
Code Remains Accessible
Even when a plugin is deactivated, its files remain stored on your server. If the plugin has known vulnerabilities, a hacker might exploit them by directly accessing the plugin’s files. This could occur through other vulnerabilities on your site, such as weak server security or compromised admin credentials.
Outdated Plugins
Deactivated plugins are often overlooked during routine WordPress maintenance. If the plugin is not updated to address security flaws, it could become a weak point in your siteâs defences. Hackers often exploit outdated software, and a deactivated plugin is no exception.
Targeted Attacks
Cybercriminals sometimes scan websites for the presence of specific vulnerable plugins. If a vulnerable plugin exists on your server, even if itâs deactivated, it could still be targeted by an attacker.
Human Error
Deactivated plugins can clutter your WordPress plugins list, making it harder to manage and maintain your site effectively. This increases the likelihood of forgetting about an outdated or vulnerable plugin, leaving your site exposed.
Can Deactivated Plugins Be Safe?
There are scenarios where keeping deactivated plugins is relatively low-risk:
- Short-term deactivation: If youâre troubleshooting your site or temporarily disabling a plugin for a specific reason, the security risk is minimal as long as the plugin is up to date.
- Secure hosting: If your website is hosted on a secure server with strong firewall protections, the risk of deactivated plugins being exploited is reduced. However, itâs not eliminated entirely.
Now let’s look at what the best practice is. We recommend you delete plugins that are no longer in use to avoid any potential problems.
How to Minimise Risks Associated with Deactivated Plugins
If you decide to keep deactivated plugins on your site, we recommend that you follow these best practices to minimise potential risks:
Keep Plugins Updated
- Even if a plugin is deactivated, itâs important to update it regularly. Updates often include security patches that address vulnerabilities.
Audit Your Plugins Regularly
- Periodically review your list of active and deactivated plugins. Delete any plugins that you no longer need or plan to use.
Use Trusted Plugins Only
- Only install plugins from reputable developers and the official WordPress plugin repository. Avoid downloading plugins from unverified third-party sources.
Secure Your Website
- Use strong passwords, enable two-factor authentication, and ensure your website is hosted on a secure server. A well-secured site is less likely to be exploited, even if it has deactivated plugins.
Install a Security Plugin
- Use a security plugin like Wordfence, Sucuri, or iThemes Security to scan your site for vulnerabilities. These plugins can alert you if a deactivated plugin poses a potential risk.
The Case for Deleting Unused Plugins
If youâre not using a plugin, the best course of action is to delete it entirely. Hereâs why:
- Reduced Attack Surface: By removing unused plugins, you eliminate potential entry points for hackers.
- Improved Performance: Deleting unused plugins frees up server space and reduces clutter in your WordPress dashboard, making it easier to manage your site.
- Simpler Maintenance: With fewer plugins to monitor and update, youâll spend less time on maintenance and reduce the risk of overlooking an outdated or vulnerable plugin.
How to Safely Remove Deactivated Plugins
To ensure youâre removing deactivated plugins safely and thoroughly, follow these steps:
Backup Your Website
- Before making any changes, create a complete backup of your website, including files and the database. This ensures you can restore your site if anything goes wrong.
Review Plugin Data
- As mentioned, some plugins store data in your database. Check whether the plugin has an option to delete its data upon removal. If not, you may need to manually clean up the database after deletion, which can be a complex technical task.
Delete the Plugin
- Navigate to the âPluginsâ section in your WordPress dashboard, locate the deactivated plugin, and click âDelete.â
Verify Deletion
- After deleting the plugin, check your server files to ensure all associated files have been removed.
So
While deactivated plugins are not usually an immediate threat to your WordPress site, they can pose a security risk under certain circumstances. Best practice is to delete any plugins youâre not actively using. If you choose to keep deactivated plugins, ensure they are regularly updated, and conduct routine security audits to minimise potential vulnerabilities.
By taking a proactive approach to plugin management, you can protect your WordPress site and ensure it remains secure, efficient, and easy to maintain.
Remember: a well-maintained site is the cornerstone of a successful online presence.
Or use our WordPress maintenance service! đ