WP Update Radar · Original data, October 2026
How many agency websites run plugins closed on WordPress.org? We checked 295
When a plugin is closed on WordPress.org it is removed from the directory and stops getting updates through the WordPress dashboard. Sites that already have it keep running the last copy they installed, and nothing in wp-admin flags it as outdated. We wanted to know how often that happens on sites run by the people who build WordPress sites for a living.
What we checked
- 515 web design and development agency websites, taken from public agency directories in October 2026.
- On each home page we listed the plugins that load files from
/wp-content/plugins/<slug>/. 295 sites loaded at least one plugin this way, using 424 different plugin slugs in total. - On October 29, 2026 we looked up every slug in the public WordPress.org plugins API and recorded which ones are closed, when, and why.
- We excluded two premium plugins (WPML and Events Calendar Pro) whose folder names match old, closed free listings, since the premium versions are still maintained.
Results
- 10 of 295 sites (3.4%) load at least one plugin that is closed on WordPress.org.
- Those 10 sites use 12 different closed plugins.
- WordPress.org's stated reasons: guideline violation 5, security issue 4, author request 3.
- 3 sites (1.0%) load a plugin that was closed for a security issue.
- 6 of the 12 plugins were closed in 2025 or 2026. The oldest closure dates from November 2020.
3.4% sounds small, but these are agency sites, usually the best-maintained site an agency has. Client sites that nobody logs in to every week are unlikely to do better. We are not naming any of the sites.
What "closed" does and doesn't mean
A closed plugin is not automatically dangerous. Authors close plugins they no longer want to maintain, and WordPress.org closes plugins for guideline problems that have nothing to do with security. A "Security Issue" closure is different: WordPress.org pulled the plugin because of a reported problem, and some of those plugins come back later once a fix ships. Either way, a closed plugin gets no updates through the dashboard, so it should be replaced, removed, or at least re-checked.
How to check a plugin yourself
Take the plugin's folder name (its slug) and open the WordPress.org plugins API:
https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&request[slug]=addthis
A closed plugin answers with "error": "closed" plus a closed_date and a reason (for this example: closed 2023-03-27, guideline violation). An open plugin answers with its details, including the current version. To find the slugs a site uses without logging in, follow step 1 of our guide on checking plugin versions from the outside.
Limits of this data
- We only looked at each site's home page, so plugins that load only on other pages or only in wp-admin are not counted. The real numbers are probably higher.
- The sample is agency websites, not a random sample of WordPress sites.
- Closure status changes. These numbers reflect the WordPress.org API on October 29, 2026.
Keeping client sites current
WP Update Radar checks your client sites' public pages once a week and emails one list of outdated plugins, with the installed version and the latest WordPress.org version. It only reports a version when the plugin's own readme or generator tag shows it.