Measured 2026-09-16 · 58,938 plugins

9.2M WordPress sites are running plugins their authors walked away from

23,362 of the 58,938 plugins in the WordPress directory — 39.6% — have not been updated in over two years. They still install. They still run. Nobody is shipping a fix if one is ever needed.

23,362

Abandoned 2+ years

39.6%

Share of directory

9.2M

Active installs affected

The uncomfortable part: some of them are security plugins

These were installed specifically to protect a site. They are the plugins a site owner is least likely to audit, because installing them felt like the responsible thing to do.

Limit Login Attempts300K installs · 3.5y stale
BackUpWordPress80K installs · 2.4y stale
Disable REST API80K installs · 3y stale
Easy SSL Plugin for SAKURA Rental Server50K installs · 6.8y stale
Login Logo40K installs · 2y stale
reCAPTCHA for MW WP Form30K installs · 2.4y stale
Change WordPress Login Logo20K installs · 2.1y stale

The largest abandoned plugins

Ordered by how many sites still run them. “Stale” is time since the last release.

Plugin	Installs	Stale	Tested up to
Template Kit	400K	2.1y	6.4.10
Limit Login Attempts	300K	3.5y	6.2.11
Health Check & Troubleshooting	200K	2.1y	6.6.7
Layout Grid Block	200K	3.2y	6.2.11
Search & Replace	100K	2.1y	6.5.10
AddQuicktag	100K	5.3y	5.7.17
WooSidebars	100K	2.5y	6.5.10
WP Downgrade \| Specific Core Version	100K	3.4y	6.2.11
BackUpWordPress	80K	2.4y	6.5.10
Disable REST API	80K	3y	6.3.10
Heartbeat Control	80K	3y	6.3.10
Fixed Widget and Sticky Elements for WordPress	70K	3.5y	6.2.11
PHP Code Widget	70K	4.5y	5.9.16
Facebook Chat Plugin	70K	4.2y	5.9.16
Title Remover	70K	5.3y	5.7.17
Hotjar	70K	2.9y	6.0.14
Async JavaScript	70K	3.2y	6.2.11
WP Show Posts	60K	2.4y	6.1.12
Brazilian Market on WooCommerce	60K	2.6y	6.4.10
Easy Theme and Plugin Upgrades	60K	4.4y	5.7.17
Enhanced Media Library	60K	2.2y	6.5.10
Column Shortcodes	60K	3.9y	6.0.14
All In One Favicon	60K	3.1y	6.2.11
Add From Server	60K	5.8y	5.5.20
HTML Editor Syntax Highlighter	60K	2.5y	6.5.0
Easy SSL Plugin for SAKURA Rental Server	50K	6.8y	5.3.23
Contact Form 7 add confirm	50K	8.6y	4.9.31
Portfolio Post Type	40K	6y	5.5.20
WP Extra File Types	40K	2.9y	6.3.10
Revision Control	40K	8.5y	4.9.31
WP Edit	40K	7.9y	4.9.31
Login Logo	40K	2y	6.6.7
Disable Google Fonts	40K	7.6y	5.1.24
underConstruction	40K	2.5y	6.4.10
Increase Maximum Upload File Size	40K	3.1y	5.8.15
My-Plugins	30K	13.2y	3.5.2
Export Media Library	30K	3.4y	6.2.11
reCAPTCHA for MW WP Form	30K	2.4y	6.5.10
Hide Title	30K	7.3y	5.2.26
Display PHP Version	30K	3.3y	6.2.11
Enhanced Text Widget	30K	2.2y	6.6.7
TS Webfonts for さくらのレンタルサーバ	30K	2.6y	6.2.11
WP Updates Notifier	30K	6.6y	5.3.23
Self-Hosted Google Fonts	30K	8.3y	4.9.31
Scripts n Styles	30K	3.3y	6.2.11
Lightweight Social Icons	30K	6.5y	5.4.21
Social Media Widget	30K	2.3y	6.4.10
Exclude Pages	20K	8.8y	3.4.2
JetSticky For Elementor	20K	3.1y	6.3.10
Link Manager	20K	8.8y	6.1.12
Site Offline Or Coming Soon Or Maintenance Mode	20K	2.5y	6.4.10
Gutenberg Block Editor Toolkit	20K	2.3y	6.5.10
Mega Addons For WPBakery Page Builder	20K	2.7y	6.2.11
Advanced Automatic Updates	20K	5.3y	5.0.27
Disable Feeds	20K	8.5y	4.9.31
Change WordPress Login Logo	20K	2.1y	6.6.7
Hide Admin Notices	20K	2.6y	6.4.10
Contact Form 7	20K	5.7y	5.6.19
Any Mobile Theme Switcher	20K	2y	6.6.7
WP Maximum Execution Time Exceeded	20K	5.6y	5.6.19
Material Design Icons for Page Builders	20K	2.5y	6.5.10
Seed Fonts	20K	2.1y	6.6.7
Spider Blocker	20K	2.4y	6.5.10
elegro Crypto Payment	20K	6.8y	4.9.31
PuSHPress	20K	4.5y	5.9.16
WP Test Email	20K	2.1y	6.6.7
External Thumbnail	20K	10.2y	4.5.33
Visual Form Builder	20K	4.3y	6.0.14
Add Category to Pages	20K	6.9y	5.2.26
JivoChat Live Chat	20K	2.9y	6.4.10
Multiple Post Thumbnails	20K	7.8y	5.0.27
Meks Simple Flickr Widget	20K	2.1y	6.6.7

What this does and does not mean

An old plugin is not automatically a vulnerable one. A small plugin that does one narrow thing may genuinely need no changes for years. But it also stops being tested against new WordPress releases, and if a flaw is found, there is no longer anyone obliged to fix it.

The WordPress directory shows a last-updated date on every listing. It does not tell you that 39% of the catalogue crossed the two-year line, or which of the plugins on your site are among them — which is the only version of this question that matters to a site owner.

Source: the official WordPress.org plugin API, read 2026-09-16, covering 58,938 plugins. “Abandoned” here means no release in over 730 days. Active install counts are the directory’s own rounded buckets, so the affected-installs total is an approximation built from those buckets. Figures can be reproduced from the same public API.