May 3, 2018 by Paul G. | Ask Paulie Anything

Are inactive WordPress plugins a security risk? – Ask Paulie Anything, Episode 4

The question of inactive WordPress plugins is one that comes up a lot. Is it a security issue to retain inactive WordPress plugins on your site? Is this a problem? Should you keep them or remove them? You’ll discover the full answer to this question and more in the video.

In this Episode 4 of Ask Paulie Anything, I’m going to answer the question that was sent to me on Facebook. It highlighted a good misunderstanding that some people might have about WordPress plugins and security.

Are Inactive WordPress Plugins A Security Risk?

The question was:

Is having all plugins installed on my website but not being activated leaving me open to security risks?

Someone immediately replied “Yes” – one word and that was it.

0:27 – Why That Was Not A Great Answer

One thing we have to understand is that plugins on your website are code and that code could be good, bad or ugly. They could have security risks or they might not.

If a plugin is not active it means that that code is not going to be instantiated, is not going to run normally when WordPress loads, but it’s still code and it’s still on your website.

So, if the plugin itself has a security risk, that security risk, at least in principle, is on your website. It might not be normally loaded with WordPress, it might not have any security risks but it’s still there.

1:22 – Why Are Inactive Plugins A Problem?

It’s not a problem but, do you know what security risks it has or doesn’t have?

So, why to keep it on your website?

If a plugin is not active on your website, don’t keep it on your website.

Installing plugins on WordPress is easy, you click “search” and you install it.

Keeping the plugin also means there’s another plugin you need to keep updated.

So, if you like more work, or if you like to run the risk, by all means, keep inactive plugins on your website.

Bottom line: Remove any plugins on your website that you don’t need. Just get rid of them.

2:03 – Not All Answers To Your Questions Are Correct Answers

I’m going to use this opportunity to highlight something important as well.

When you’re on the internet and you ask a question and someone responds to you with an answer like “Yes, inactive plugins represent the security risk”, it doesn’t mean that it’s correct, it doesn’t mean that’s an accurate answer.

On the internet, anybody can say “Yes”, anybody can say “No” and most people think they know what they know is correct.

That’s OK, but what I want you to understand is when you put a question out there for everyone to read, then anyone can answer and that includes people who don’t fully understand the situation.

Maybe he is right when he says “Yes”. If that code can get executed and that code has security risks associated with it… then he is right. But, most of the time the answer is wrong. It’s not an open security risk. You have an inactive plugin there but we don’t know what that plugin is and we don’t know if that plugin itself has security risks.

So, bottom line again: Don’t necessarily trust that every answer on the internet is complete and in wholly accurate.

I hope that this was useful.

Thank You! Comments, Questions?

If you have any feedback or comments you want to make, please feel free to leave them in the video. Or, if there’s something you’ve always wanted to know about WordPress but never knew who to ask, use the link below.

Ask Your Own Question Here.

As always, if you’re watching this video on YouTube, click to subscribe or, if you use Facebook, click to “Like” or share it – whatever you want to do. 🙂

Hello dear reader!

If you want to level-up your WordPress security with ShieldPRO, click to get started today. (risk-free, with our no-quibble 14-day satisfaction promise!)

You'll get all PRO features, including AI Malware Scanning, WP Config File Protection, Plugin and Theme File Guard, import/export, exclusive customer support, and much, much more.

We'd be honoured to have you as a member, and look forward to serving you during your journey towards powerful, WordPress security.

Try ShieldPRO Today →

ShieldPRO Testimonials
@daviesda's Gravatar @daviesda

Reliable and secure

I’m a little paranoid these days about the security of my WordPress sites after getting badly hacked a year ago. I look after several installations of WP and I now have WordPress Simple Firewall running on all of them. After a couple of months of use I’m totally confident in…

@vollerworld's Gravatar @vollerworld

Such a great plugin! Auto updates rule!

Love the way i can control auto-updates with this plugin! Adds to the safety and security of all my sites!

@priyadidn's Gravatar @priyadidn

Topnotch security plugin!

so far this one satisfied me..

@peter-hall's Gravatar @peter-hall

Shield Security

Brilliant plugin. easy to install, load, go and forget.

Comments (1)

    “Ask Paulie anything” is really a great idea! Thanks for helping us out on the complicated technical stuff Paul.
    Much appreciated.

Leave a Comment

Your email address will not be published. Required fields are marked *

Click to access the login or register cheese