You can vet a WordPress plugin in ten minutes, before it ever touches your site. Five checks cover it: update pulse, one-star reviews, business model, performance footprint, exit cost. A plugin that passes all five is a safe install. A plugin that fails two deserves a better alternative.
Most plugin regret traces back to a thirty-second decision. The search result looked fine. The star average looked fine. Six months later the plugin is abandoned, or slow, or impossible to leave. The checklist below is how you spend ten minutes once, at the start, instead.
One disclosure before the checks. We sell block plugins, and a suite of them. That gives us informed opinions about what a trustworthy vendor looks like . And an obvious interest. Every check below works on our products too. Run them on us.
How to vet a WordPress plugin in ten minutes
Five checks, roughly two minutes each. Run them on anything new before it reaches a live site.
Check the pulse
Open the plugin’s page on WordPress.org. Look at the last-updated date and the tested-up-to version. Updated within six months is healthy. Silent for more than a year is a warning.
Read the one-star reviews
Skip the average. Read the five most recent one-star reviews and the vendor’s replies. You are looking for patterns — broken updates, vanished support — and for how the vendor answers.
Find out who pays for it
Work out how the plugin stays maintained. A pro tier, a paid service, a company behind it — anything visible. A plugin with no income is running on borrowed time.
Weigh what it loads
Install it on a staging site. Check what scripts and styles it adds to a page that does not use it. A well-built plugin loads assets only where they are needed.
Price the exit
Ask what leaving would cost before you commit. Deactivate the plugin on staging and look at the content it managed. Clean markup survives; shortcodes leave holes.
Result
A plugin you can install with confidence — or a rejection that cost ten minutes instead of six months.
Check one: is the plugin alive?
Everything else depends on this one. A plugin is a relationship with a maintainer, not a file. WordPress ships updates twice a year. PHP moves. Browsers move. A plugin nobody maintains falls behind on a schedule you can’t control.
The pulse lives in three places on the WordPress.org listing. The last-updated date: within six months is healthy for a stable plugin. The tested-up-to version: more than two WordPress releases behind means nobody checked. The support forum: unanswered threads for months tell you what your future questions will get. We settle it in what “tested up to” means on WordPress.org.
The changelog is worth thirty seconds on its own. A good one reads like a maintenance log: fixes. Compatibility notes, small improvements, dated and regular. A changelog that’s all marketing — “New! Amazing templates!” — with no fixes tells you where the vendor’s attention lives. And a changelog that simply stopped is the loudest signal on the page.
A quiet changelog isn’t automatically fatal. Some small plugins are genuinely finished. But “finished” is safe only when the plugin touches nothing sensitive. We wrote up the full failure sequence in what happens when a plugin is abandoned. The short version: abandonment shows up here first, months before it shows on your site.
Check two: read the reviews backwards
The star average is the least useful number on the listing. Averages compress five years of history into one digit. They hide the update that broke everything last month. Read the reviews backwards instead: one-star first, newest first.
You’re reading for two things. First, patterns. One angry review is noise. Five recent reviews describing the same broken update are data. Second, replies. A vendor who answers one-star reviews — patiently, with fixes . Is showing you their support culture in public. A wall of unanswered complaints is doing the same.
Volume matters as much as the score. A 5.0★ average from nine reviews is a coin flip. Ultimate Blocks holds 4.9★ from 729 reviews as of August 2026 . Ours, so discount accordingly, but that’s the shape a checkable signal has. Hundreds of reviews, years of history, a visible reply pattern. Any plugin worth your site can show you the same.
The support forum is the same evidence, less curated. Reviews are written at emotional peaks; forum threads show the ordinary Tuesday. Scan the last month of threads. How fast do questions get answers? Do the answers come from the vendor or from strangers? That’s the service you’re actually signing up for.
Check three: who pays for this plugin to exist?
Every plugin costs money to maintain. Developer hours, support time, testing against each WordPress release. If you can’t see where that money comes from, the honest answer might be “nowhere”. Plugins funded by nothing get abandoned by default — not through malice, just entropy.
So look for the business. A pro tier is the clearest signal: paying customers make maintenance an obligation. A company with several products spreads the risk further . One product’s slow quarter doesn’t kill the roadmap. A solo hobby project with no income can still be excellent. It just has no reason to still be excellent in three years.
This is also why “just use the free version forever” is not. Always the frugal move. The free tier is funded by the pro tier. We’ve written about when upgrading actually makes sense . But as a vetting matter, a visible pro tier is a green. Flag even if you never buy it.
One wrinkle: plugins change hands. A plugin you vetted three years ago may have a new owner today. With a different business model and different standards. Ownership changes are usually announced in the changelog or on the vendor’s blog. It’s another reason the yearly re-check below isn’t optional.
Check four: what does it load?
Performance fear is the most common reason people avoid plugins. It’s usually aimed at the wrong target. Slowness doesn’t track how many plugins you run. It tracks what each one loads, and where. One plugin that ships 400 KB of scripts to every page outweighs. A dozen tidy ones.
So measure the one in front of you. Install it on staging. Open a page that doesn’t use the plugin at all. And check the network tab for its scripts and styles. Loading assets everywhere is the tell of a careless build. Loading them only where the plugin runs is the tell of care. We ran this test on our own category in do block plugins slow down WordPress. Count assets, not plugins.
Don’t let a caching plugin take this test for you. Caching hides slow assets from repeat visitors, not from first-time ones . And search engines measure the first visit. A plugin that needs caching to be acceptable failed the check. Caching is a multiplier for good decisions, not an amnesty for bad ones.
Check five: what does leaving cost?
The last check is the one nobody runs. Because it means imagining the end at the beginning. Every plugin has an exit cost. You pay it when the plugin is abandoned, or outgrown, or replaced by something better. The time to price it is now, while the price is zero.
The staging test takes two minutes. Add some content with the plugin, then deactivate it. What survives? Blocks that render to clean markup degrade gracefully. The content stays readable. Shortcodes leave raw [brackets] in your posts. Proprietary formats leave nothing at all. That difference explains the block editor’s approach. Leaving a page builder remains a project, not a click.
Data location matters too. Some plugins store everything in your posts and options, where exports and backups already reach. Others keep their world in custom database tables. Which only their own export tools can translate. Neither is wrong. But the second kind makes the export button a load-bearing feature . Check it exists before you need it.
Green flags
✓ Updated within six months
✓ Vendor replies to one-star reviews
✓ A visible business model
✓ Assets load only where used
✓ Content survives deactivation
Red flags
✗ A year or more of silence
✗ Complaints with no replies
✗ No visible income at all
✗ Scripts shipped to every page
✗ Shortcodes woven through content
Running the checklist on a site you already have
Most readers arrive with twenty plugins already installed, not zero. Don’t audit all twenty this afternoon. Triage by exposure instead. Anything handling forms, logins, payments or uploads gets the full five checks first . Those are the plugins that can hurt you. Decorative and admin-side plugins can wait for the yearly pass.
Expect the audit to argue for fewer plugins, better chosen. That’s the usual outcome, and it compounds: fewer vendors to track. Fewer update cycles, fewer pairs of plugins that can disagree. The counting side of that argument has its own post.
What the checks can’t tell you
Honesty about the limits. No checklist predicts the future. A healthy plugin can be sold to a worse owner next year. A thriving vendor can pivot. The checks measure the present, and the present is simply your best available evidence.
Two habits cover the gap. First, re-run the pulse check yearly on everything installed. It takes minutes, and an unmanaged plugin list is where problems compound quietly. Second, when money is involved, vet the deal as well as the plugin. Paid tools deserve the deeper treatment we laid out in vetting a lifetime deal. Check refund terms, track record, and the vendor’s math.
And keep the refund window in your pocket. A serious vendor’s money-back guarantee is the checklist’s safety net . It turns a wrong pick into a refund email instead of a sunk cost. Note the window’s length before you pay, and test the plugin properly inside it.
Create a plugin selection record
- Required outcome.
- Mandatory acceptance criteria.
- Products evaluated.
- Authorised source.
- Current maintenance evidence.
- Support evidence.
- Security review.
- Compatibility results.
- Editor workflow results.
- Accessibility results.
- Performance results.
- Data and service map.
- Deactivation effects.
- Complete cost range.
- Account ownership.
- Update owner.
- Recovery route.
- Replacement option.
- Decision and approver.
- Next review trigger.
Keep rejected candidates with concise reasons. This prevents repeated weak evaluations and forgotten constraints.
Recheck after meaningful change
Review after acquisitions, pricing changes, long update gaps, incidents, or important platform releases.
- Confirm the requirement remains current.
- Confirm ownership remains assigned.
- Confirm support remains available.
- Confirm updates remain dependable.
- Confirm data remains portable.
- Confirm recovery remains tested.
- Confirm complete costs remain acceptable.
A previous approval is evidence, not permanent permission. Products and site consequences both change.
Run a final pre-installation gate
- The download source is authorised.
- The requirement remains current.
- The selected version is approved.
- Compatibility evidence remains relevant.
- A suitable backup exists.
- Staging reflects important conditions.
- Testing has named owners.
- Recovery authority remains available.
- Account access is organisational.
- Support eligibility is understood.
- Data flows are documented.
- Expected services are available.
- Editor training is planned.
- Production timing is accepted.
- Removal effects are understood.
Stop installation after any critical failure. Reopen evaluation with the failed requirement clearly recorded.
Final selection questions
- Would the team still choose this product without promotional urgency?
- Can current evidence support every mandatory requirement and constraint?
- Does the product preserve acceptable content, data, and migration routes?
- Can named owners maintain, support, recover, and replace it?
- Does complete cost remain acceptable under conservative adoption assumptions?
Frequently asked questions
Are plugins with more installs always safer?
Safer on average, not always. A big install base means more testing and more pressure to maintain. But large plugins get abandoned and acquired too. Install count is one signal — the update pulse and review replies are better ones.
How many plugins is too many?
There’s no magic number — thirty careful plugins beat five careless ones. Count costs, not plugins: what each loads, who maintains it. Whether anyone remembers why it’s installed. We’ve written a full audit method for exactly this question.
Should I ever use nulled plugins?
No. Nulled copies of paid plugins are a well-documented malware channel, and they never receive updates. You’d be installing unpatched code from an untrusted source with no support. Every part of that fails the checklist.
Do deactivated plugins slow my site down?
Not meaningfully — deactivated code doesn’t run. But it still counts as attack surface, still sits in backups. And still confuses the next person auditing the site. If a plugin has been deactivated for a month, delete it.
How often should I re-vet installed plugins?
Once a year, pulse check only: last update, tested-up-to, anything odd in recent reviews. Five minutes for a typical site. Do it when WordPress ships a major release — that’s when unmaintained plugins start showing cracks.
The verdict
If a block plugin is what you’re vetting, our answers are public. Four plugins, updated continuously, one-star reviews answered, free versions to test everything on staging first. The paid version is one suite at $299 — one-time, unlimited sites, 30-day money-back guarantee. Run the checklist on us before you spend a cent. That’s what it’s for.
Leave a Reply