A plugin readme tells you the WordPress version it was tested up to, the PHP version it needs, its stable tag, its licence and its authors. Read those lines before installing, but remember they are claims by the author, not proof that the code is safe or maintained.
Agencies install plugins quickly, so a two minute routine pays off.
The headers that matter
According to the WordPress plugin handbook, the readme header carries fields such as Contributors, Tested up to, Stable tag, Requires PHP and License.
| Header | What it says | How to use it |
|---|---|---|
| Tested up to | The WordPress version the plugin was tested against; minor versions are ignored | If it lags several major releases behind, ask why |
| Requires PHP | The minimum PHP version | Compare with the PHP version on the client's host |
| Stable tag | The version the directory treats as the release | Check it matches the version you are installing |
| License | The licence the plugin uses | Confirm it is compatible with your use |
| Contributors | WordPress.org usernames of authors | Check whether they have other maintained work |
What "Tested up to" does and does not mean
The handbook says the field names the WordPress version the plugin has been tested against, and that minor versions are ignored because plugins should not break with a minor update. So a plugin tested up to the current major release is a good sign of recent attention. An old value is a prompt to look closer, not proof of a problem.
Compare Requires PHP with the host
The PHP project says each branch is actively supported for two years and gets security fixes only for two more, and then reaches end of life. A plugin that supports old PHP versions may be fine, but your client's host should be on a supported branch regardless. Check both.
Check the licence
The WordPress.org plugin guidelines require plugins in the directory to be compatible with the GPL, and recommend GPLv2 or later. A missing or odd licence line is a reason to ask questions.
A five minute routine
- Open the readme and read the header lines above.
- Check the changelog for recent releases and for security fixes mentioned.
- Look at the support forum for unanswered security reports.
- Check the plugin's other requirements, such as extra services or accounts.
- Install on staging first and review what it adds.
What a readme cannot tell you
It cannot tell you whether the code is free of vulnerabilities, whether the author will answer a security report, or whether the plugin phones home. For that you need a scan, a review of permissions and network behaviour, and an inventory entry so you can respond to advisories later.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a new advisory is tied back to installed components, which is why recording what you install matters.
For code dependencies in client repositories, the free scan from Safeguard shows known vulnerabilities in a few minutes.
Quick check
Is a plugin with an old Tested up to value unsafe?
Not automatically. It suggests less recent testing, so look at the changelog and support activity before deciding.
Does the readme prove the plugin is maintained?
No. It is written by the author. Check release dates and support responses as well.
Sources
- How your readme.txt works, WordPress plugin handbook
- Detailed plugin guidelines
- PHP supported versions
Last reviewed: 19 October 2026.
