A WordPress plugin you rely on was closed. What now?
Short answer: A closed plugin can no longer be downloaded from WordPress.org and gets no updates through it, but it keeps running on your site. Closure has several possible reasons, from the author's own request to a security issue, so check the closure date and reason, look the plugin up in a vulnerability database, and judge how exposed it is. If there's any sign of a security problem, or it handles forms, payments or logins, plan a replacement now; a closed plugin that does something minor can sometimes wait a few weeks while you choose a successor.
The warning usually shows up when someone opens the plugin's page to check something else. There's no notice in your dashboard for many closures, which is why it can go unnoticed for months.
Step 1: Understand what you're looking at
WordPress.org's plugin handbook describes two different notices:
- Closed. "This plugin has been closed" is shown to all visitors. Plugins closed since January 2018 include the closure date, and after 60 days the notice is updated to show why.
- Out of date. Plugins that don't declare support for the last three major WordPress releases get a warning that they haven't been tested recently. That's a maintenance warning, not a closure.
The handbook lists the reasons a plugin can be closed:
| Reason | What it usually means for you |
|---|---|
| Author request | The developer stopped maintaining it (or moved it elsewhere, sometimes as a paid product) |
| Guideline violation | It broke a directory rule; may or may not affect you technically |
| Licensing or trademark violation | A licensing or naming problem, not necessarily a code problem |
| Merged into core | Its feature is now part of WordPress itself |
| Security issue | A security concern was found; treat as urgent |
The handbook also says further details aren't shared outside the WordPress.org security team and the plugin authors, except in extreme circumstances. If the closure is recent, the reason may not be shown yet, so treat it as possibly security-related until you know otherwise. The detailed plugin guidelines confirm that a plugin found to have security issues is closed until the situation is resolved.
Step 2: First things to do today
- Note the plugin name, version you run, and closure date.
- Search a vulnerability database such as Patchstack's or WPScan's for the plugin. Check whether your version is listed, and whether a fix exists.
- Check the developer's own site. Sometimes the plugin moved to a new name, a paid version, or GitHub, with the closure being an administrative step.
- Take a backup before you change anything.
- Don't delete it on a busy day. Removing a plugin that controls forms, layouts or redirects can break pages instantly.
Step 3: Risk check
Answer these honestly. More "yes" answers mean replace sooner.
- Is there a known vulnerability affecting your version? If yes and there's no fix, replace or disable it as soon as possible.
- Does it accept input from visitors? Forms, file uploads, comments, search, login or registration features are higher risk.
- Does it touch money or personal data? Checkout, payment, membership, CRM sync.
- Can people without accounts reach what it does? Public-facing features carry more exposure than admin-only tools.
- Does it still work on your PHP and WordPress versions? A plugin that blocks future updates holds the whole site back.
- How deeply is it woven in? A page builder or custom-fields plugin used on every page is harder to swap than a small widget.
A closed plugin that adds a simple admin feature, with no known vulnerability, is low urgency. A closed form plugin with an open security report is an emergency.
Step 4: Replace or keep
Replace (usually the right call)
- Write down exactly what the plugin does on your site: which pages, which settings, which data it stores.
- Shortlist replacements that are actively maintained: recent updates, tested with the current WordPress version, active support forum, and a clear developer or company behind them.
- Check if WordPress now does it. If it was "merged into core", the feature may already be built in.
- Test on staging. Install the replacement, recreate settings, migrate data, then deactivate the old plugin and check every affected page.
- Migrate data carefully. Forms entries, redirects, custom fields and SEO settings often need export/import tools or a developer's script. Keep the old data until you've confirmed the move.
- Remove the old plugin from live once the replacement works, and delete it rather than just deactivating it.
Keep (temporarily, with conditions)
Keeping a closed plugin can be reasonable only if:
- there's no known vulnerability,
- it was closed at the author's request rather than for security,
- it does something minor and admin-only, and
- you set a review date to replace it.
Some developers continue a plugin outside WordPress.org. If you switch to that source, make sure you trust it, and remember updates will no longer come through the normal dashboard channel.
Monitoring so it doesn't surprise you again
- Review your plugin list quarterly. Open each plugin's WordPress.org page and look for closed or out-of-date notices.
- Use a vulnerability alert service. Several security plugins and services notify you when an installed plugin has a known issue.
- Keep the plugin count down. Every plugin is something that can be abandoned. Remove ones you don't need.
- Prefer plugins with a business behind them for anything critical, such as forms, shop features or backups.
FAQ
Will a closed plugin stop working?
Not by itself. It keeps running, but it gets no updates through WordPress.org, which becomes a problem as WordPress and PHP move on or if a vulnerability is found.
Can a closed plugin come back?
Yes. A plugin closed for a fixable reason, including security, can be reopened once the issue is resolved. Check its page again before investing in a replacement.
How do I know why it was closed?
The plugin page shows the reason about 60 days after closure. Before that, check the developer's announcements and a vulnerability database.
Is an "out of date" warning the same as abandoned?
Not necessarily. It means the author hasn't confirmed compatibility with recent WordPress versions. Check the plugin's update history and support forum before deciding.
If a closed plugin sits behind your forms or checkout and you'd like it swapped out without losing data, tell us which plugin it is.