Most WordPress hacks do not come from WordPress itself. They come from plugins and themes. Every plugin adds code that runs on your server, so installing one is a decision about trust. The incidents of autumn 2026, such as the Bricksforge file-upload flaw, are a good reminder to ask a few questions before clicking Install.
The checklist
- Last update: a plugin that has not been updated for a year or more is a warning sign. WordPress shows this on the plugin page.
- Compatibility: check that it is tested with your current WordPress and PHP version.
- Active installations and reviews: popular, well-reviewed plugins get more eyes, but also more attention from attackers, so popularity alone is not proof of safety.
- Vulnerability history: search the plugin name in a public vulnerability database. A few past fixes are normal; ignored or repeated critical bugs are not.
- Developer and support: is there a real company, a changelog and answered support threads?
- Need: does the plugin do something you could do with a built-in feature? Fewer plugins mean a smaller attack surface.
- Risky features: be extra careful with plugins that accept file uploads, process forms, connect remote management or ask for admin-level access.
Never use nulled plugins
Free copies of paid plugins and themes from unofficial sites are one of the most common ways to get infected. They very often contain hidden backdoors, and they do not receive updates. If a premium plugin is worth using, it is worth buying a license from the official source.
After installing
Install on a staging copy first when the plugin is important, keep automatic updates on for security releases, and remove plugins you stop using. A deactivated plugin still sits on the server and can still be attacked, so delete it.
Frequently asked questions
How many plugins are too many?
There is no magic number. Quality and maintenance matter more than count, but every extra plugin adds risk, so keep only what the site really needs.
Are free plugins less safe than paid ones?
Not by definition. Safety depends on the developer’s maintenance and security practices, not on the price.
Can you review the plugins on my site?
Yes. We audit installed plugins, remove the unnecessary ones and set up an update routine as part of our WordPress maintenance.
Read next
- Essential WordPress Plugins for a Business Website
- Bricksforge Plugin Vulnerability: What Happened and How to Fix It
- WordPress Updates, Backups and Vulnerability Monitoring: A Simple Routine
Need help keeping your WordPress site secure? We offer maintenance, updates and security checks. Contact us
