When the WordPress Plugin Directory closes a plugin for security issues, new downloads stop until the problem is resolved, but copies already installed keep running on your site. If a plugin on your store is closed, treat it as a live risk and plan a replacement or an update.
What the directory guidelines say
The WordPress Plugin Directory guidelines state that security is the ultimate responsibility of the plugin developer and the directory enforces this to the best of its ability. If a plugin is found to have security issues, it will be closed until the situation is resolved. In extreme cases the plugin may be updated by the WordPress Security team and propagated for the safety of the general public.
The guidelines also set rules that matter for store owners. Plugins may not send executable code via third party systems, and may not track users without their consent.
What closure does and does not do
| Question | Answer |
|---|---|
| Is the plugin removed from your site? | No |
| Can new users download it? | Not while it is closed |
| Will it get fixes? | Only if the developer resolves the issue, or in extreme cases the security team updates it |
| Are you notified? | Check the plugin screen and the directory page, and do not wait for an email |
Steps if one of your plugins is closed
- Find the plugin page and read the closure notice, then check whether a fixed version exists.
- Identify what the plugin does on your store: checkout fields, shipping rates, reviews, payment gateway. This sets urgency.
- If a fixed version exists, test it on a staging copy and update.
- If none exists, find a maintained alternative and plan a swap. Until then, disable the features that expose the risk where you can.
- Restrict who can reach the affected admin screens and review access logs for that period.
- Remove the plugin fully once replaced. A deactivated but present plugin can still hold vulnerable files.
How to hear about it sooner
Keep a list of every installed plugin with version and source. WordPress hardening guidance says to restrict yourself to the WordPress.org repository or well known companies and not to get plugins or themes from untrusted sources. Review the list monthly for closed, abandoned or unmaintained entries. See also our checklist for vetting storefront plugins and apps.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a new advisory against an existing component raises an alert.
Quick check
Is a closed plugin automatically deleted from my store?
No. Closure affects the directory listing. Your installed copy keeps running until you remove or replace it.
Does closure mean the plugin is definitely exploited?
No, it means a security issue was found. Check the notice for details and act before exploitation is known.
Sources
Safeguard can inventory dependencies and monitor them for new advisories, with a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
