Plugin Removed from the WordPress.org Plugin Directory: What Does It Mean?

You want to install a trusted plugin on a new website, but the search in your dashboard no longer finds it. On WordPress.org, the download button has been replaced by a short notice: “This plugin has been closed”. Meanwhile, the very same plugin keeps running perfectly on your other websites. What happened? The plugin has been removed from the official plugin directory. That can be harmless. But it can also mean that your website currently has an open security hole that nobody is going to fix. Here you will learn what is behind such a closure, how to assess the risk and which steps make sense now.

What does it mean when a plugin has been removed from WordPress.org?

Strictly speaking, WordPress.org does not delete a plugin, it closes it. The plugin page then shows a sentence like “This plugin has been closed as of June 24, 2024 and is not available for download.” For you as a site owner, that has very concrete consequences:

• The plugin can no longer be downloaded from WordPress.org or installed from the dashboard.
• As long as it stays closed, WordPress.org does not distribute new versions. So there are no more updates, and that includes security updates.
• Copies that are already installed are left alone. WordPress does not deactivate or delete anything, the plugin simply keeps running.
• The source code remains publicly visible in the SVN repository of WordPress.org.

The third point is the tricky one. Because everything looks normal on your website, you usually do not notice the closure at all. WordPress does not show any notice about it in the dashboard. A ticket that aims to change exactly that has been sitting in the WordPress Trac since 2014. It was rejected at one point and reopened in 2023. The question of how to warn users without causing needless panic is simply not that easy to answer.

Also, do not confuse a removed plugin with an outdated one. A plugin that has not been updated for years is often still listed in the directory as usual. WordPress.org then only points out that it has not been tested with the last three major releases of WordPress. A closed plugin, on the other hand, has been pulled from circulation completely.

Why are plugins removed from WordPress.org? The five official reasons

The plugin directory is looked after by the Plugins Team of WordPress.org. The team does not close plugins on a whim, but for one of five reasons that are laid down in the official developer documentation. These are exactly the reasons that later appear on the plugin page:

• Security Issue: The plugin contains a confirmed vulnerability. With few exceptions, the team then closes the plugin immediately. According to the team’s handbook, there is no grace period along the lines of “fix this within seven days or you are out”.
• Guideline Violation: The plugin does not follow the rules of the directory. Typical cases are tracking without consent, code that has been made unreadable on purpose, or links to the developer that show up on your website without being asked for.
• Licensing/Trademark Violation: The plugin contains code that is not compatible with the GPL, or its name makes use of someone else’s trademark.
• Author Request: The developer closed the plugin themselves. Sometimes they simply lack the time, sometimes the plugin is now only available as a paid version on their own website.
• Merged Into Core: The feature is now built right into WordPress. This almost exclusively concerns feature plugins, which are used to try out new features before they land in WordPress.

By the way, the Plugins Team does not find many of the security problems on its own. Security researchers often report a vulnerability there, for example when the developer does not respond to their reports.

Why is the reason for the closure only shown after 60 days?

Right after the closure, the plugin page only shows the date. WordPress.org adds the reason 60 days later, and even then only as a broad category from the list above. What exactly happened is only shared with the developers who have commit access to the plugin and with the security team. Details are made public only in exceptional cases.

That seems opaque at first, but it is easy to understand. If the page said “Security Issue” on the very day of the closure, attackers would know right away where to look, while thousands of websites are still running the plugin without protection. The waiting period gives the developer a chance to fix the vulnerability before word gets around.

Also read the sentence below the notice. “This closure is temporary, pending a full review” means that the closure is provisional and the plugin is currently being examined more closely. “This closure is permanent” means that the closure is meant to be final. For KingComposer, a page builder that used to be very widespread, the page has said “Reason: Security Issue” since February 2022, for example.

Is a plugin that has been removed from WordPress.org dangerous?

The honest answer: it depends. A closure alone does not prove that there is a vulnerability. If the developer simply abandoned their plugin, it may keep working without problems for years.

Still, you should take every removed plugin seriously as a warning sign:

• At first, you do not know the reason. During the first 60 days, a closure can be caused by a critical vulnerability or by a harmless formal mistake. From the outside, you cannot tell the difference.
• Security updates stop. If a vulnerability becomes known, it stays open. That is exactly why closed plugins are interesting for attackers: they know that many websites will keep using them for a long time.
• Compatibility starts to crumble. With every new version of WordPress and PHP, the risk grows that the plugin throws errors or, in the worst case, takes your website down.

June 2024 showed how quickly a closure can turn into a real problem. Attackers had used passwords from old data breaches to get into developer accounts on WordPress.org and planted a backdoor in several plugins, as Wordfence reported at the time. Among the affected plugins were Social Warfare and Blaze Widget. Social Warfare quickly received a clean version. Blaze Widget, however, has been permanently closed since June 24, 2024, reason: Security Issue. Anyone who had installed the manipulated version saw nothing of this in their dashboard.

Plugin removed from WordPress.org: what should you do now?

There is no need to panic. But you should not put the topic off either. This is the best way to go about it:

1. Read the notice on the plugin page. You will find the page at wordpress.org/plugins/ followed by the slug of the plugin. The slug is the name of its folder in wp-content/plugins. Pay attention to the date, to whether it says temporary or permanent and, once the 60 days are over, to the reason.
2. Check whether a vulnerability is known. Look up the plugin in one of the big vulnerability databases, for example Wordfence Intelligence, Patchstack or WPScan. If a vulnerability is listed there for your installed version, the case is clear: deactivate the plugin immediately. If your website depends on it, you will quickly need a temporary solution (more on that in a moment).
3. Find out whether the developer carries on. Some plugins just move, for example to GitHub or to the developer’s own shop, or they are now only available for a fee. A look at the developer’s website usually clears things up quickly. However, updates will then no longer arrive automatically via WordPress.org, but through whatever channel the developer chooses.
4. Ask yourself honestly whether you still need the plugin. Older websites in particular often contain plugins that were installed for a single purpose at some point and then forgotten. If you no longer know what it is there for, deactivate it in a staging environment and see whether anything is missing.
5. Look for a maintained alternative. What matters is the date of the last update, the number of active installations, the most recent WordPress version it was tested with and whether anyone actually answers in the support forum. A plugin with a large user base and an active team is usually the safer choice compared to a niche solution that a single person works on in their spare time.
6. Replace the plugin cleanly. Make a backup first, test the switch in a staging environment and carry over settings and content. Keep shortcodes in mind as well, because after the plugin is deleted they will otherwise show up as plain text on your pages. Finally, delete the old plugin completely. Deactivating it is not enough: with some vulnerabilities, all attackers need is for the files to still be on the server where they can be called directly.

What if you cannot replace the plugin right away? Then at least protect it. A Web Application Firewall, for example from Wordfence, Patchstack or your host, can block known attacks on the plugin until the switch is done. Agencies with their own developers have one more option: plugins on WordPress.org are licensed under the GPL or a compatible license. That means you are allowed to take over the code and maintain it yourself. In that case, however, security updates are entirely your responsibility.

You can find more about keeping your plugins in good shape in our guide How to keep WordPress plugins updated and secure.

How do you find out whether an installed plugin has been closed?

Doing it by hand is tedious. You would have to open the matching page on WordPress.org for every single plugin. That is fine for five plugins, but not so much for 30 plugins across several client websites.

The Plugin API of WordPress.org is faster. For a closed plugin, instead of the usual data it returns an error with the value closed:

curl -sg "https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&request[slug]=SLUG"

Replace SLUG with the folder name of the plugin. If the response contains "closed":true, the plugin has been closed. You will also find the date of the closure there and, once it has been published, the reason. The -g option makes sure that curl does not mistake the square brackets in the address for placeholders.

If you use Wordfence: its scan also compares your plugins with WordPress.org and reports removed plugins as a critical problem. Nothing gets deleted in the process, the decision stays with you.

So that you do not get a needless scare: not every plugin you cannot find on WordPress.org has been removed. Premium plugins such as WP Rocket or Gravity Forms were never listed there. They get their updates directly from the vendor.

How InspectWP detects removed plugins on your website

InspectWP takes this check off your hands. The report detects the plugins on your website from the traces they leave in the source code and compares each of them with WordPress.org. If a plugin has been closed, this is shown right on its card, and the check for removed plugins turns red. If WordPress.org later reopens the plugin, the flag disappears with the next report. Plugins that have not received an update for more than a year are flagged separately as outdated. Premium plugins that were never listed in the directory do not count as removed.

In the Premium and Agency plans, you also see the installed versions and known vulnerabilities of your plugins. With the InspectWP WordPress Connector, InspectWP also picks up every installed plugin, including those that leave no traces in the frontend. In the audit PDF for your clients, a removed plugin appears as an urgent item with a clear recommendation. Since a plugin that is still maintained today can be closed next month, automatic reports are worth it: InspectWP then checks your projects regularly and notifies you if you want. A free report quickly shows you whether a removed plugin is currently running on your website.