Vet a WordPress Plugin Before You Install It

You found a plugin in a blog roundup, a StackOverflow answer, or a client recommendation. Before you install anything on a production WordPress site, spend three minutes reading its directory listing.

This use-case walks you through the full vetting checklist using the Tools.town Plugin Analyzer. Everything here reads from WordPress.org’s public API — no site scan, no wp-admin access required.

Cluster hub: WordPress.org Ops.

---

Step 1: Get the slug

The WordPress.org slug is the last segment of the directory URL. If you have a URL like https://wordpress.org/plugins/contact-form-7/, the slug is contact-form-7.

If you only have a name:

• Open the Slug Finder and search by keyword.
• Or search directly on wordpress.org and copy the URL.

Do not guess the slug. Common names often have multiple results (several “contact form” plugins exist). Get the exact slug so you are reading the right listing.

---

Step 2: Run the analyzer

Open the Plugin Analyzer and paste the slug or the full wordpress.org/plugins URL. Hit Enter or click Analyze.

The tool fetches:

• The full plugin listing (info API)
• 30 days of daily download counts
• The current WordPress.org core version (to compare against tested-up-to)

All six tabs (Overview, Health, Activity, Zips, Changelog, Downloads) populate from a single server-side request. You do not need to click through them one by one — they are all ready.

---

Step 3: Read the Overview tab

The Overview tab has the fields that matter most for a quick sanity check:

Last updated — this is the date the author last pushed to the WordPress.org SVN repository. Look at both the absolute date and the relative age. A plugin updated 6 weeks ago is recent. A plugin updated 3 years ago deserves more scrutiny, especially if WordPress has had major releases since then.

Tested up to — the highest WordPress version the author has declared compatibility for. This is self-reported — it means “I tested this on my machine” rather than “WordPress.org has validated it.” If the current WordPress is 6.7 and the plugin says “tested up to 6.3,” that is a yellow flag, not an automatic veto. Many stable plugins simply are not updated in the directory because they still work.

Requires PHP — the minimum PHP version the author declared. If your host is on PHP 7.4 and the plugin requires 8.0, the plugin will refuse to activate. Check your hosting PHP version first; the PHP Version Checker will tell you whether your version is still in WordPress.org’s acceptable range.

Active installs — the bucket (e.g., 100,000+, 1+ million). Larger buckets are a weak positive signal that many sites have chosen this plugin. They are not a security badge.

Support threads — open vs resolved counts. A plugin with 500 open threads and 15 resolved is a sign the author is not maintaining the support forum. A plugin with 50 threads and 44 resolved suggests active engagement.

---

Step 4: Read the Health tab

The health score is a 0–100 number built from five slices: update recency, compatibility, popularity, reviews, and support. It is a Tools.town score, not an official WordPress.org badge, and it does not include security data.

Use it as a quick triage:

• 80–100 — The listing signals are positive. Still read the changelog.
• 60–79 — At least one slice is weak. Read which one and decide how much it matters for your use case.
• Below 60 — Multiple signals are weak. This is not an automatic rejection, but understand why before proceeding.

---

Step 5: Check the Activity tab

The Activity tab shows one of three labels: Likely active, Low activity, or Potentially abandoned. This is separate from the health score. A popular plugin can be “low activity” because it is large and stable and moves slowly. Only a plugin that is both old and has a small install count earns “potentially abandoned.”

If the label is “potentially abandoned,” open the plugin’s support forum on wordpress.org (linked in the analyzer) and look for recent posts from the author. Sometimes a listed-as-abandoned plugin has very active GitHub activity and just does not push frequently to the directory.

---

Step 6: Scan the Downloads tab

The Downloads tab shows 30 days of daily zip downloads and a 7-day vs prior-7-day comparison. This is not active installs — it counts zip downloads from the update server.

A plugin with declining downloads over 30 days in a healthy category might indicate users are switching away. A plugin with consistent downloads even on an old listing suggests it is still being picked up and auto-updated. This is a weak signal, but it is real data.

---

Step 7: Read the Changelog tab

The Changelog tab strips the HTML from the listing’s changelog field. Read the last two or three entries:

• Are they dated recently? (Dates here are from the author’s readme, not the directory API.)
• Does the author describe changes clearly or just write “Bug fixes”?
• Are there breaking change notices?

If the changelog ends three years ago with “Minor updates,” that is consistent with the listing’s last_updated. If the changelog has recent entries but the listing’s last_updated is old, the author may be keeping their readme in sync but pushing to the directory infrequently — which is fine.

---

Step 8: Make your decision

You now have:

• Last updated date and relative age
• Tested-up-to vs current WordPress
• Active install bucket
• Tools.town health score and its breakdown
• Activity label with reasoning
• 30-day download trend
• Changelog summary

Go ahead if:

• Last updated is within 18 months or the plugin is stable/utility with no known WordPress.org compatibility issues
• Tested-up-to is at most one major version behind current
• Health score is above 65
• Activity label is “likely active” or “low activity” with a strong install bucket

Test in staging first if:

• Plugin requires a PHP version you have not confirmed
• Tested-up-to is two or more major versions behind
• Health score is below 65
• The changelog has breaking changes in recent versions

Look for alternatives if:

• Activity label is “potentially abandoned” and there is no GitHub activity
• Support forum has dozens of unresolved “fatal error” or “conflict” threads
• The plugin has not been updated since a major WordPress security release

---

After you install

Install from wp-admin → Plugins → Add New (or via WP-CLI: wp plugin install slug --activate). After activation, verify the features you need actually work in your environment before you declare success. A good directory listing does not guarantee compatibility with your specific theme, WooCommerce version, or PHP configuration.

More: See if a plugin looks abandoned, Compare two plugins before switching, all WordPress.org Ops tools.