Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I've read many WordPress Security blog articles, where the Security Experts're recommending some special matters to take care when somebody is concern about his/her WordPress site's security. Among them one is:

WordPress Security Tips:
Remove unnecessary plugins, that are not in use

A plugin that has security holes, whether by code or structures or db connections, can be fatal for a site even it's activated into a site - on the other hand, a well structured, well coded, securely db-connected plugin may not have a security hole even it's deactivated. So where the issue exactly is?

I've a site, where there are some plugins, I use them occasionally. I actually don't want to delete them, but when they are not needed, I just deactivate them from the site. Do I need to delete them to secure my site?

...WHY?

share|improve this question
1  
This is a bit like asking "What can go wrong with a helicopter?" Well, about a million different things. I am sure I could write a plugin that would be dangerous even deactivated and there must be many different ways to do that. What is the issue? Well, what is the plugin? Just remove what you aren't using. Hedge your bets. –  s_ha_dum Dec 5 '13 at 14:52
1  
This most likely leads to far to opinionated answers to be a valid question, but in my opinion plugins are just a security problem if they are badly programmed. But that's basically the same as the myth that plugins are generally bad for performance. –  ialocin Dec 5 '13 at 14:52

3 Answers 3

up vote 6 down vote accepted

A plugin that has security holes is a problem, whether or not it is activated. So here are some reasons why it is often recommended to remove plugins that you aren't using.

  1. If you have plugins that you aren't using, you often don't care about keeping them updated. As a result, they won't get any security updates, and that will be a vulnerability on your site. People often think that a plugin that is not running can't negatively affect your site, but in the case of security, an attacker can exploit a security hole in a plugin that is installed, even if it is not activated.

  2. Think about why the plugin is not running in the first place. If it is a plugin that you use regularly, and you just turn on and off as needed, that is fine. However, it could be a plugin that didn't work right, or is no longer being maintained. This second category of plugins are especially a problem for security, as they are often the source of security holes.

If your deactivated plugins are actively maintained and are kept updated, they aren't a problem. But if you have plugins installed that aren't being used and aren't being updated, it is best to remove them.

share|improve this answer

I've seen some pretty crappy plugins, some can include stand-alone scripts that can be attack vectors and not updating or removing those can leave you open to attack.

Disabled plugins from 3rd-party repositories won't receive update notifications because they need to be activated for their update check code to run. Thus, if a vulnerability is discovered in a plugin that is disabled, no update notification will be given -- but hackers will know to test for it.

I've seen a site that had been attacked multiple times through an SQL injection attack performed through a gallery template plugin that had been removed from wordpress.org. Because there was no newer version in the repository, it didn't generate any warnings that the plugin was "out of date" / vulnerable to attack.

Best to only keep plugins that are active and kept updated. Also a good idea to keep track of vulnerability notices, and a matrix of plugins that are installed on which sites so that you can react to a threat before it becomes a problem. I watch this RSS feed for WP-related vulnerabilities:

http://rss.packetstormsecurity.com/search/files/?q=wordpress

share|improve this answer
    
You said: "Disabled plugins from 3rd-party repositories won't receive update notifications because they need to be activated for their update check code to run." I disagreed, because I've seen many plugins from WP repository, are prompting for their updates, though they are disabled. I don't know how??? –  Mayeenul Islam Dec 28 '13 at 1:13
2  
Disabled plugins from wordpress.org will show updates, but plugins from 3rd-party repositories (e.g. Gravity Forms, WooThemes plugins, etc.) can't check for updates unless they are activated -- they hook into the plugin update check to run some code to query the remote repository and can't do that if they are disabled. –  webaware Dec 28 '13 at 7:06

If you check your error logs you will see machines scanning your site for plugins with security holes - so it doesn't matter if plugins are activated or not, as they'll go straight to the problem files, and not try and access them via your WP install per se.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.