Module 5 · 5.3

English

Nederlands English Deutsch

Choosing and assessing plugins

Module 5: Themes and plugins · Reading time: 9 minutes

Learning objective: After this lesson you can assess a plugin before installing it, and recognise the red flags.

Key concepts: plugin, hooks (actions and filters), last updated, tested up to, required PHP version, active installations, reviews, support forum, vulnerability, freemium, nulled plugin, overlap

What a plugin is, and why that matters

A plugin is a piece of PHP code that gets loaded alongside WordPress with every request (lesson 1.2). WordPress has hooks everywhere: fixed moments where plugins can hook in. There are two kinds:

actions: "do something now", for example adding a script to the page, or sending an email after an order;
filters: "change this", for example adjusting the title of a page or editing the content of a Post.

This means a plugin can change almost anything on your website. And it runs with the same rights as WordPress itself: it can read and write your database, create files, send email. Installing a plugin is therefore giving trust to its creator. A good plugin makes your website better; a bad or abandoned plugin is the most common way in for intruders (lesson 7.1).

Where to get plugins

The plugin directory on wordpress.org (also reachable via Plugins > Add New in your Dashboard). Every plugin is checked when submitted, and the plugin directory removes plugins with an unresolved security vulnerability.
The website of a known developer, for paid plugins or extensions.
Never from a download site that offers paid plugins "for free". Such nulled plugins are often modified with a backdoor, spam links, or code that later uses your website for something else. You also get no updates, so known vulnerabilities stay open. The money you save, you pay back at the first clean-up after a hack.

The five characteristics on the plugin page

Every plugin page on wordpress.org shows the same information on the right. Read it in this order:

Characteristic	What it tells you	Red flag
Last updated	Whether it's still being worked on	More than a year ago. A plugin that hasn't had an update in a long time may not work well with newer versions of WordPress and PHP
Tested up to (WordPress version)	Whether the developer has checked it with recent versions	A much older version than the current one. wordpress.org then shows a warning
PHP version (required)	The minimum PHP version	Not a red flag by itself, but check whether it works with your (newer) version
Active installations	How many websites use it	Very few installations means few people to notice bugs. Not always bad (a small, specific plugin), but look more closely
Reviews and support	What users think and whether the developer answers questions	Many recent one-star reviews; under "Issues resolved in last 2 months" a low number out of the total

When reading reviews, pay particular attention to recent negative ones: is it about an update that broke something, about aggressive advertising, about data being sent out? And check the support forum to see whether the developer responds.

A plugin that has been removed from wordpress.org shows a notice when opened that it has been closed, often with the reason (for example "security issue"). If you have such a plugin, replace it.

Looking beyond the plugin page

Vulnerabilities: there are public databases of known vulnerabilities in WordPress plugins, for example those from Patchstack, Wordfence and WPScan. Look up the plugin's name: did it have vulnerabilities, and how quickly were they fixed? A plugin with a vulnerability that was fixed quickly is not a bad plugin. A developer who does nothing for months, is.
Freemium: many plugins are free with a paid add-on. That's fine, but watch out for notices that spam your Dashboard or features you can only use with the paid part.
External services: does the plugin send data about your visitors to a service run by the developer (a spam filter, a statistics service, cloud-based image compression)? This needs to be covered in your Privacy Policy and sometimes in a data processing agreement (lesson 9.3). Good plugins mention this in their description.
What it loads: a plugin for a form on your contact page doesn't need to load scripts on all your other pages. With your browser's developer tools (Network tab) you can see what a plugin adds to a page.

One task, one plugin, and preferably none

The most important question comes before the plugin page: do I actually need a plugin for this?

Can WordPress do it itself? A simple sitemap (lesson 9.2), lazy loading (lesson 4.4), columns, buttons and tables (lesson 4.1) are already built in.
Can the theme do it? With a block theme you can do a lot with the Site Editor.
Can it be done with a few lines of code in your own small plugin or child theme? Then you don't need a package of thousands of lines for one function.
Do I already have a plugin that does this? Overlap (two cache plugins, two SEO plugins, two security plugins) causes conflicts and duplicate work.

A website with ten well chosen plugins is healthier than one with forty. Not because the number counts, but because every plugin has to be kept up to date, can clash with others, and can have a vulnerability.

Recording your assessment

For every plugin you install, note down: what it's for, why this one and not another, who maintains it, and when you last reviewed it. That sounds like a lot of effort, but it's exactly what you need when tidying up (lesson 5.4), during a hack (lesson 7.5), and when someone else takes over your website.

Summary

A plugin hooks into WordPress via hooks and runs with the same rights; installing one means giving trust.
Get plugins from wordpress.org or a known developer, never nulled.
Read last updated, tested up to, PHP version, active installations and reviews/support; look up known vulnerabilities.
First ask whether you need a plugin at all; avoid overlap.
Record why you use a plugin.

Quiz

Exercise

Exercise A5.3: Read a plugin page. Choose a plugin from the wordpress.org plugin directory that you use or are considering, and enter the slug (the last part of the address, for example contact-form-7 from wordpress.org/plugins/contact-form-7/). Also enter what the page shows for last updated (the date), tested up to and required PHP version. The programme retrieves the same information from the public plugin API of wordpress.org and compares it.

Exercise D5.3: A scorecard for three plugins. Choose a need (for example a contact form, a cookie notice, or a backup) and compare three plugins. Fill in the five characteristics for each plugin, look up whether there were known vulnerabilities and how quickly they were fixed, check whether it sends data to an external service, and pick one. Explain in a few sentences why, and whether you actually need the plugin at all.

Exercise D5.3: A scorecard for three plugins

You do this exercise yourself; no one checks it. Tick off what you've done and mark the exercise as done.

Three plugins compared
The five characteristics noted per plugin (last updated, tested up to, installations, ratings, forum)
Checked for known vulnerabilities
Checked whether the plugin sends data to external services
One plugin chosen

Which need do you want to solve?

Your table with the characteristics per plugin

Which one did you choose, and why?

Do you actually need the plugin?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing