Check if a WordPress plugin is safe to install — know the risks before you hit 'install'.
Used by WordPress developers, agencies, and site owners.
Plugin Risk Score pulls live data from the WordPress.org Plugin API and scores each plugin across five factors — recency of updates, WordPress version compatibility, install base, user ratings, and developer support responsiveness — giving you an instant Low, Moderate, or High risk verdict before you hand a third-party plugin the keys to your site.
Every check pulls live data from the WordPress.org Plugin API. Each of the five factors below is graded green, amber, or red — worth 3, 2, or 1 points. We total them, divide by the maximum, and turn it into a percentage. 75%+ is Low Risk, 50–74% is Moderate, anything below 50% is High Risk.
How long it's been since the developer last shipped a release to WordPress.org.
Plugins that go quiet for a year or more typically aren't getting security patches. Three years without an update is effectively abandoned.
How recent a version of WordPress the developer has explicitly tested the plugin against.
WordPress ships major releases roughly every four months. A plugin that hasn't been tested against the current branch may break, conflict with core changes, or quietly fail on newer PHP versions.
How many live WordPress sites are running this plugin right now.
A large install base means real-world testing across thousands of stacks, and a higher chance someone has already reported any nasty edge case. Tiny plugins can be brilliant, but they get less scrutiny.
The average WordPress.org user rating, weighted by how many ratings the plugin has received.
Ratings expose what the changelog won't — frequent breakage, dark patterns, support that ghosts you. A handful of five-star reviews from a brand-new plugin isn't meaningful, so we flag low sample sizes amber regardless of the score.
The percentage of support threads in the plugin's WordPress.org forum that the developer has marked resolved.
It's the cleanest available signal that someone is actually behind the wheel. A plugin with a healthy install base but a dead support forum is a plugin you'll be debugging alone.
One nuance worth flagging: the Last Updated check counts double when a plugin is more than three years old. Abandonment is the single strongest risk signal, so we weight it accordingly rather than letting a healthy install base mask a long-dead codebase.
A score is only useful if it leads to a decision. Here's how we'd act on each verdict, based on a decade of cleaning up WordPress sites that didn't.
You're probably fine. A few habits to keep it that way.
Worth a closer look before — or instead of — installing.
Treat this as a real exposure and plan a way out.
The score is calculated across five factors pulled live from the WordPress.org Plugin API: how recently the plugin was updated, whether it has been tested against the current version of WordPress, its active install count, user ratings, and how well the developer responds to support threads. Each factor is rated green (3 pts), amber (2 pts), or red (1 pt). The total is expressed as a percentage — 75%+ is Low Risk, 50–74% is Moderate Risk, and below 50% is High Risk.
Low Risk (75%+) means the plugin scores well across all five criteria and is generally safe to install. Moderate Risk (50–74%) means some factors warrant attention — the plugin may be slightly out of date or have limited rating data. High Risk (below 50%) indicates significant issues such as abandonment, incompatibility with the current WordPress version, or poor developer support.
All data is fetched live from the WordPress.org Plugin API each time you run a check, so it always reflects the current state of the plugin at that moment.
Plugin Risk Score only works with plugins listed in the free WordPress.org plugin repository. Premium plugins sold exclusively through third-party marketplaces or a developer's own website are not available via the WordPress.org API and cannot be checked.
Yes, completely free. No account required, no limits, no paywalls.
Practical, no-jargon advice on vetting WordPress plugins.
A high star average on a WordPress plugin means less than you think. Here's how to read reviews properly and spot the patterns that mislead most site owners.
Active installs signal how battle-tested a plugin is — but the number is widely misread. Here's what the thresholds actually mean, and when they matter most.
The "tested up to" badge on every WordPress plugin page is widely misread. Here's what it actually tells you — and what to do when it lags behind.
Prystine handles WordPress maintenance, plugin management, and security for businesses who'd rather not worry about it.
Speak with Prystine →A one-page checklist for vetting any WordPress plugin before you install it — straight to your inbox.
We build small, focused tools for the people who run websites. If Plugin Risk Score is useful to you, you might like these too.
Having worked with WordPress since 2016, we've tried a lot of tools to help us build and maintain sites safely and efficiently. These are the ones we trust and recommend to other site owners, all of which we have used ourselves and some on a daily basis.
Read all our WordPress plugin and tool reviews on Prystine.
Please note these are sponsored links, we may receive a commission when you click through and make a purchase. We only recommend products we trust and use ourselves, but please always do your own research before purchasing.