How Many WordPress Plugins Are Abandoned? The Real Data

Short answer: of the roughly 60,000 active listings in the WordPress.org plugin directory, a meaningful chunk — by most tracking estimates somewhere around one in five to one in four — hasn't been updated in two years or more, which is the practical line most developers use for "abandoned." Tens of thousands more have already been pulled from the directory entirely and sit in "closed" status, many explicitly tagged as abandoned by their own authors or by WordPress.org's plugin review team. If you're picking a plugin to install, or trying to out-rank one, that number matters more than it looks.

How Many WordPress Plugins Are Abandoned Right Now?

WordPress.org doesn't publish a single running "abandoned" counter, so the figure gets pieced together from a few public signals: last-updated dates on live listings, the "Closed" status flag in the plugin repository, and the explicit "abandoned" closure reason WordPress.org assigns when an author disappears or requests removal.

• Active directory: roughly 60,000 plugins are currently installable from WordPress.org.
• Stale-but-listed: independent tracking consistently finds that 20–25% of active listings haven't shipped an update in 2+ years — these still install and often still work, they're just not maintained.
• Closed/abandoned: WordPress.org has closed well over 20,000 plugins historically for reasons including "abandoned," security vulnerabilities, and guideline violations — these no longer appear in search or install from the dashboard.

That means the abandoned problem is really two separate problems: plugins that are technically live but unmaintained (the bigger, riskier bucket because people are still installing them), and plugins that are fully closed and no longer discoverable. You can see which plugins are actually gaining installs versus stagnating by checking WordPress plugin rankings — active install trend lines are one of the fastest ways to spot a plugin that's losing momentum before its listing even goes stale.

How WordPress.org Actually Defines "Abandoned"

There's no automatic timer that abandons a plugin. WordPress.org's plugin team closes a listing when one of a few things happens: the author requests closure, the author goes unresponsive to a security report for an extended period, or the plugin is flagged for guideline violations and never fixed.

The signals that matter more than the label

A plugin can sit at "last updated 3 years ago" and still work fine if it's a simple utility with no dependency on core APIs. A plugin that hasn't been updated in 6 months can be a serious security risk if it touches forms, payments, or user data. Don't treat the date alone as the verdict — treat it as a prompt to check further.

Why So Many WordPress Plugins Get Abandoned

Most abandonment isn't malicious — it's economics. A solo developer builds something useful, gets a few thousand installs, and then real life (a job, a family, burnout) takes over and the free-tier plugin stops being worth the unpaid support burden.

• No monetization path: a plugin with no premium upsell has no revenue to fund ongoing work.
• Acquired and sunset: larger companies buy a plugin for its install base, then quietly deprioritize it in favor of their own product.
• Scope creep from WordPress core: block editor, PHP version bumps, and REST API changes mean standing still is actually falling behind — plugins need active work just to stay compatible.
• Better alternatives emerge: a newer plugin solves the same problem more cleanly, installs migrate, and the old maintainer loses motivation.

This is also exactly why plugins like Contact Form 7 and Classic Editor are worth studying as counterexamples — both are old, both solve a problem many assume is "solved," and both are still actively maintained because their authors (or, in Classic Editor's case, Automattic) treat core compatibility as non-negotiable.

Is It Safe to Use an Abandoned Plugin?

Sometimes, but you're taking on risk the developer used to carry. An abandoned plugin with no dependencies on PHP/WordPress internals and no user-input handling can run for years without issue. One that processes forms, handles payments, or touches the database is a different story — unpatched vulnerabilities in abandoned plugins are a recurring entry point for WordPress site compromises.

Before trusting an older plugin in production, read through the most common WordPress plugin security mistakes — a lot of them show up specifically in plugins nobody's patched in years. If security is the core job of the plugin, compare it against what's actually winning installs right now in the WordPress security plugin market rather than defaulting to whatever ranked well three years ago.

What This Means If You're Building or Marketing a Plugin

Abandoned plugins are a market opportunity, not just a cautionary tale. Every plugin that goes stale in a category with real search demand leaves installs up for grabs — users searching for the same solution still land on the old listing, see the stale date, and bounce to whatever ranks next to it.

1. Find the stale leaders in your category using competitor analysis to see which top-ranked plugins have slowing install growth or aging "tested up to" tags.
2. Check the keywords they still rank for with a keyword research tool — abandoned plugins often still hold position for terms they're no longer worth ranking for, which is exactly where you position a replacement.
3. Know how many keywords to actually target in your own readme rather than copying a bloated, outdated one — see how many keywords a plugin readme should target.
4. Write a short description that actually converts the traffic you pick up from a competitor's decline — this breakdown covers what to change.

If you're the one at risk of being the stale listing, understand the cost first. A single rank drop compounds fast — this analysis of what a rank drop actually costs in installs shows how quickly a slipping position bleeds into lost weekly installs, which is the real mechanism behind abandonment turning into irrelevance.

How to Check If a Plugin on a Live Site Is Abandoned

If you're auditing a client site or researching a competitor's stack rather than browsing the directory, the fastest path is to see what's actually installed and running. The plugin & theme detector identifies the plugins and themes a live site is using, so you can cross-reference what you find against its last-updated date and support activity before deciding whether to flag it, replace it, or route around it.

It's also worth checking whether the plugin you're worried about is controlled by one of the handful of companies that own a disproportionate share of top-ranked listings — see who really owns the top 10 plugin spots. Plugins owned by larger teams rarely get abandoned outright; they get deprioritized instead, which looks different in the data and requires a different response.

FAQ

How many plugins are in the WordPress.org directory in total?

Roughly 60,000 plugins are active and installable from WordPress.org at any given time. Historically, well over 100,000 have been submitted, with a large share later closed for abandonment, security issues, or guideline violations.

What officially counts as an abandoned WordPress plugin?

There's no automatic cutoff — WordPress.org closes a plugin when the author requests it, stops responding to a security report, or fails to resolve a guideline violation. In practice, most developers treat 18–24 months without an update as the working definition of abandoned, even if the listing is still live.

Does WordPress.org delete abandoned plugins?

Not immediately. The plugin is marked "Closed" and removed from search and the install dashboard, but existing installs keep running until the site owner removes it or an incompatibility breaks it. The code itself isn't deleted from existing sites — it just stops being distributed to new ones.

Is it safe to keep using an abandoned WordPress plugin?

It depends entirely on what the plugin touches. A simple, self-contained utility with no form handling or database writes can keep working safely for years; a plugin that processes user input, payments, or authentication becomes a growing security liability the longer it goes unpatched.

How can I tell if a plugin is abandoned before I install it?

Check the "Last updated" date and "Tested up to" WordPress version on its listing, then skim the support forum for unanswered threads older than six months. If all three point the same direction — old update, outdated compatibility tag, ignored support requests — treat it as abandoned regardless of install count.

Can I take over or fork an abandoned WordPress plugin?

Yes. WordPress.org allows committed contributors to request ownership of an abandoned plugin's slug through the plugin review team, and forking under a new name is always an option under the GPL. Many now-popular plugins started as revivals of abandoned ones with a new maintainer and a cleaned-up codebase.

Why do so many WordPress plugin developers abandon their projects?

Mostly economics and burnout: free plugins generate support demand without revenue, and WordPress core changes (block editor, PHP versions, REST API) require ongoing work just to stay compatible. Solo developers without a monetization path are the most likely to walk away once the unpaid maintenance cost outweighs the benefit.