Buy a premium plugin from the author or an official reseller, check its licence, release history and support, test it on staging, and record its source and licence holder in your inventory. Never install a copy from an unofficial site, however convenient the price looks.
The WordPress hardening guide is direct on this: do not get plugins or themes from untrusted sources, and restrict yourself to the WordPress.org repository or well known companies.
Why non-directory plugins need extra care
Plugins hosted on WordPress.org must follow published guidelines, including GPL compatibility. A plugin sold elsewhere has not been through the same process, and updates come through the vendor's own channel. That channel is something you must also trust and keep working.
A vetting routine
| Check | Question | Where to look |
|---|---|---|
| Source | Is this the author's own site or an official reseller? | Vendor site, purchase receipt |
| Licence | Who holds the licence, and can the client keep it? | Order and licence terms |
| History | How often are releases made, and do they mention security fixes? | Changelog |
| Support | Do they respond to reports? | Support channel, security contact |
| Requirements | PHP and WordPress versions | Plugin documentation |
| Permissions | What does it add: admin pages, external calls, new tables? | Staging review |
| Update path | How do updates arrive, and who gets the key? | Licence portal |
Licence holder matters
If the agency buys a licence in its own name, the client may lose updates when the engagement ends. Record who holds each licence, and prefer to buy in the client's name. Put the renewal date in the inventory, because a lapsed licence often means no updates, and that means no security fixes.
Test on staging
Install on a copy of the site and look at what changes: new files, new database tables, new admin users, scheduled tasks, outbound network calls. Compare the file list against what you expect. Use a scanner on the code where you can.
Plan for the vendor disappearing
Ask what happens if the vendor stops. Is there a documented replacement? Could you move the data? A plugin that holds business critical data in a proprietary format is a risk you should state to the client.
Record the decision
Write a short entry per plugin: why chosen, source, licence holder, renewal date, who reviews it and when. That record answers the next client or auditor question quickly.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a scan highlights risky patterns in source code, the sort of review a new plugin deserves on staging.
Safeguard offers code and dependency scanning for repositories, and the free scan is a place to try it.
Quick check
Is a plugin from outside WordPress.org unsafe?
Not automatically. Many reputable vendors sell directly. The risk is in unofficial copies and unvetted sources, so verify the vendor.
Who should hold the licence?
Ideally the client, so updates continue if the agency relationship ends.
Sources
Last reviewed: 19 October 2026.
