This is part three of the Lucid Cloud Platform WordPress security series. If you are just getting started, begin with the complete WordPress security guide.
Themes and plugins are what make WordPress so powerful, and also where most of its security risk lives. Every one you install is code you are trusting to run on your site. Choose well and you gain features safely. Choose carelessly and you invite trouble. This guide goes deeper on picking themes and plugins you can rely on.
Every add-on is a piece of trust
When you install a plugin or theme, you are letting someone else’s code run with access to your site and its data. Most developers are careful and well-meaning, but not all code is well written or well maintained, and a flaw in a single plugin can put the whole site at risk. This is not a reason to avoid plugins, they are one of WordPress’s great strengths, but it is a reason to be deliberate about which ones you trust.
A quick vetting checklist
Before installing anything, spend two minutes checking it over. For items from the official WordPress directory, all of this is on the plugin or theme page:
- Reputable source. Stick to the official WordPress directory or established commercial developers with a real website and support.
- Active installs and reviews. A large, happy user base is a good sign that a plugin is reliable and well supported.
- Last updated. Recent updates show the developer is actively maintaining it and keeping pace with new WordPress releases.
- Support and changelog. A responsive support forum and a clear record of changes suggest a developer who takes the work seriously.
Never use nulled or pirated versions
“Nulled” plugins and themes are paid products cracked and offered free on unofficial sites. They are one of the most common ways malware gets onto WordPress, because the crack often hides code that hands control of your site to someone else. The saving is never worth it. If you want a premium product, buy it from the developer, where you also get updates and support.
Fewer is safer
Every plugin adds features, but also a little more code to trust, maintain and keep updated. A site running forty plugins is harder to keep secure than one running ten. Every so often, review your list and remove anything you are not actively using. Deactivating is not enough, because the files remain and can still be exploited, so delete what you no longer need.
Keep everything updated
Choosing well is only half the job. Themes and plugins need updating promptly, because updates frequently fix security issues, and once a fix is public, attackers know exactly what to look for on sites that have not applied it. Turn on automatic updates where you are comfortable, and check the rest weekly. This ties directly into the wider habit covered in the main guide.
When a plugin is abandoned
Sometimes a plugin you rely on simply stops being updated. Treat a plugin with no update in over a year as a warning sign. It may still work, but it is no longer receiving security fixes, and it will eventually fall behind WordPress itself. Look for a maintained alternative before it becomes a problem, rather than after.
The full WordPress security series
- The complete WordPress security guide for small businesses (start here)
- Part 2: Logins and two-factor authentication
- Part 3: Choosing safe themes and plugins
- Part 4: Backups and recovery
