The question of inactive WordPress plugins is one that comes up a lot. Is it a security issue to retain inactive WordPress plugins on your site? Is this a problem? Should you keep them or remove them? You’ll discover the full answer to this question and more in the video.
In this Episode 4 of Ask Paulie Anything, I’m going to answer the question that was sent to me on Facebook. It highlighted a good misunderstanding that some people might have about WordPress plugins and security.
Are Inactive WordPress Plugins A Security Risk?
The question was:
Is having all plugins installed on my website but not being activated leaving me open to security risks?
Someone immediately replied “Yes” – one word and that was it.
0:27 – Why That Was Not A Great Answer
One thing we have to understand is that plugins on your website are code and that code could be good, bad or ugly. They could have security risks or they might not.
If a plugin is not active it means that that code is not going to be instantiated, is not going to run normally when WordPress loads, but it’s still code and it’s still on your website.
So, if the plugin itself has a security risk, that security risk, at least in principle, is on your website. It might not be normally loaded with WordPress, it might not have any security risks but it’s still there.
1:22 – Why Are Inactive Plugins A Problem?
It’s not a problem but, do you know what security risks it has or doesn’t have?
So, why to keep it on your website?
If a plugin is not active on your website, don’t keep it on your website.
Installing plugins on WordPress is easy, you click “search” and you install it.
Keeping the plugin also means there’s another plugin you need to keep updated.
So, if you like more work, or if you like to run the risk, by all means, keep inactive plugins on your website.
Bottom line: Remove any plugins on your website that you don’t need. Just get rid of them.
2:03 – Not All Answers To Your Questions Are Correct Answers
I’m going to use this opportunity to highlight something important as well.
When you’re on the internet and you ask a question and someone responds to you with an answer like “Yes, inactive plugins represent the security risk”, it doesn’t mean that it’s correct, it doesn’t mean that’s an accurate answer.
On the internet, anybody can say “Yes”, anybody can say “No” and most people think they know what they know is correct.
That’s OK, but what I want you to understand is when you put a question out there for everyone to read, then anyone can answer and that includes people who don’t fully understand the situation.
Maybe he is right when he says “Yes”. If that code can get executed and that code has security risks associated with it… then he is right. But, most of the time the answer is wrong. It’s not an open security risk. You have an inactive plugin there but we don’t know what that plugin is and we don’t know if that plugin itself has security risks.
So, bottom line again: Don’t necessarily trust that every answer on the internet is complete and in wholly accurate.
I hope that this was useful.
Thank You! Comments, Questions?
If you have any feedback or comments you want to make, please feel free to leave them in the video. Or, if there’s something you’ve always wanted to know about WordPress but never knew who to ask, use the link below.
Good Plugin For Added Security, Absolute MUST Have!
After a very long, extensive search of plugins claiming to do what I thought should have been implemented in core I came across this little gem. It was very easy to implement and works seamlessly with my other security options. If your tired of malicious login attempts and want to…
Lightweight but thorough
Doesn’t slow down my site, and effectively secures it. Very nice.
Excellent Plugin, Excellent Support
Shield Security is a very comprehensive security option and the Pro version is an uncommonly good value. iControlWP support is terrific as well. ***** ***** ***** (15 stars; five for the security, five for the value, five for the support)
This plugin has loads of features and it’s pretty easy to navigate and set up. I had an issue with my theme due to obscuring my WP version but easily got this info from support and now everything runs like a dream.