The Wordpress administration page shows which plugins have available updates, but is there a way to be notified of just security-related ones, apart from checking out every changelog?
Ideally I'd like a page (or RSS feed even) that I could check as often as I like and that would tell me "this plugin received a security update, update ASAP".

  • downvoting and close voting as the answers show it is mostly a "resource recommendation" type of question which is off-topic, and leads to opinion based answer.s. Sep 7 '17 at 9:19
  • @MarkKaplun Essentially I was asking for a "best practice" here, maybe I should've phrased my question differently.
    – Joril
    Sep 7 '17 at 12:50
  • best practice is to always update. if a security issue is fixed in version 4.0 while you are still at 1.0, will you just update then, fast without testing the other changes? And it does not matter much what might have been a good practice if the plugin and themes authors do not support it. Sep 7 '17 at 17:37
  • @MarkKaplun Since updates are not guaranteed to work flawlessly all the time (strange interactions with other plugins maybe?) updating plugins is not a "fire and forget" operation, it takes time (backup, update, test, maybe rollback) so I was looking for a way to know which are important (=security-related) updates that cannot be deferred, instead of updating every time there's a new version available.
    – Joril
    Sep 7 '17 at 19:12
  • 1
    updating is best practice in the limitations of how wordpress works right now. As long as wordpress support only updates to latest version, and do not support updates to anything else, you do not really have a choice, as the plugin authors do not have a choice. After 1.0 you can not have both 1.1 and 2.0 in the repository, and I do not believe any of the "off repository" plugin and themes implement a different scheme.So while I agree with you that updating plugins sucks, it is the best practice in the limitations of wordpress. Sep 8 '17 at 8:47

I like the WPScan Vulnerability Database. Only the security updates are shown.

If you check that page every day with the Update Scanner addon in firefox, when you open the browser you get the updates, if any.

You have also an email alert subscription option (I've not used it)

  • There's an RSS feed too, very nice!
    – Joril
    Sep 7 '17 at 9:18

following all the plugin updates/bugs is time consuming and not all plugindevelopers have or do the same info policy. so sometimes it helps following your favorite IT-news channel that is collecting actual security risks that come up for the most common plugins or wordpress itself.


(Note: personal opinion of a plugin / recommendation follows.)

You might look at the Infinite WP plugin; it allows you to monitor many WP sites and will alert you to updates of themes/plugins/core . You have to manually start the 'check', and then decide to update any/all sites, but it is a great place to monitor a bunch of WP sites (or even one).

Plus it allows you to easily log into the admin area of a site without having to remember credentials. I use it several times a day to keep track of the ~50 WP sites I maintain. Highly recommended. It's a free plugin, although they have a premium version.


(Note: I am only a very satisfied user; no connection to them other than that.)

There are other plugins that will send email notifications of updates. I just am an enthusiastic user of Infinite WP.

Not the answer you're looking for? Browse other questions tagged or ask your own question.