Last week, Rank Math PRO users who updated at the wrong moment got a backdoor straight from the vendor’s own servers. The plugin had done nothing wrong for years. Then, for eleven hours, it was the way in. (The full story is in CVE Watch.)
It’s a useful reminder of what installing a plugin actually means. You’re not adding a feature. You’re giving someone else’s code full access to your files, your database and every password in wp-config.php, and you’re agreeing to run whatever they send you next. Every plugin is a vendor you trust with your whole site, for as long as it’s installed.
That doesn’t mean never install plugins. It means each one has to earn its place.
What a plugin really costs
The price tag is the smallest part. The rest of the bill:
- Access. WordPress has no permission system for plugins. A contact form plugin can read your users table just as easily as your SEO plugin can.
- Attack surface. Every form, AJAX action, REST route and upload handler a plugin adds is something an attacker can probe. Most plugin vulnerabilities live in features the site owner never used.
- The update channel. Whoever controls the plugin’s updates can change the code on your site. That’s the vendor, plus anyone who breaks into the vendor.
- Weight. Scripts and styles on every page, extra database queries, scheduled tasks, admin notices.
- Lock-in. Shortcodes, custom tables and builder layouts that stop working, or turn into junk, the day you remove it.
Seven questions before it goes in
1. What problem does it solve, exactly?
“Better SEO” isn’t an answer. “Writes a meta description and Open Graph tags for every post, and builds the XML sitemap” is. If you can’t say exactly what it does for you, you can’t tell whether something smaller would do the same.
2. Could the theme do it in 50 lines?
A lot of popular plugins wrap something WordPress can already do with a filter or two. Turning off comments, disabling XML-RPC, adding security headers and cleaning junk out of <head> are each a few lines in a theme. On this site they live in the theme, and none of them needed a plugin. Code you wrote is code you can read, and it only changes when you change it.
3. How much does it bring with it?
You want one feature. The plugin ships forty. Look at what it adds: admin pages, REST routes, front-end scripts, cron jobs, database tables, “helpful” upsells. Every one of those runs whether you use it or not. A plugin that does one thing well beats a suite that does twenty.
4. How does the vendor handle security?
Look the plugin up on Patchstack or Wordfence Intelligence. A history of vulnerabilities isn’t a dealbreaker on its own. Popular code gets looked at, and bugs get found. What matters is what happened next: were they fixed quickly, were they disclosed clearly in the changelog, or did a critical fix sit for weeks?
5. Where do its updates come from?
Free plugins from WordPress.org update through WordPress.org. Commercial plugins usually update from the vendor’s own server, tied to a license key. That’s one more piece of infrastructure you’re trusting, run by a company of unknown size and security. It’s not a reason to avoid paid plugins, but it’s a reason to know which of yours phone home, and to stop them updating production on their own.
6. Is anyone home?
Check the last update date, the WordPress and PHP versions it’s tested with, and whether support questions get answers. A plugin that hasn’t been touched in two years isn’t stable. It’s abandoned, and the next vulnerability in it may never get fixed.
7. How hard is it to leave?
Before you install, picture removing it. Does content survive? Shortcodes left behind as raw text, builder layouts that collapse, data in tables nothing else can read? The harder a plugin is to remove, the more carefully you should choose it, because you’ll be living with it for a long time.
Keep asking after it’s installed
Earning a place isn’t a one-time test. Every few months, go down the list and ask whether each plugin would get in today. Needs change, vendors change hands, and the feature you installed it for may now be in WordPress core.
And when a plugin goes, delete it. A deactivated plugin doesn’t run, but its files are still on the server, and some vulnerabilities can be reached by requesting a plugin’s files directly. Deactivated isn’t removed.
What earned a place here
This site runs Yoast SEO. It passes the test: titles, meta descriptions, social tags and sitemaps for every post would be a lot of code to write and maintain, the vendor has a long track record, and it updates through WordPress.org. Everything else is either in the theme or not on the site.
That’s not a rule everyone should copy. A shop needs a store, and a membership site needs memberships. The point is that every plugin on the list is there because it answered these questions, not because it was the first result for “WordPress plugin for…”.
Fewer plugins means fewer vendors you’re trusting, fewer advisories to read, and fewer mornings like the one Rank Math PRO users had last week.