A WordPress plugin was closed: what it means and what to do
A closed plugin keeps running on your site exactly as before. It just never gets another fix, and WordPress does not tell you.
The WordPress Plugins Team can close a plugin in the directory. Its page shows a closure notice, it cannot be downloaded, and it receives no more updates. On 7 April 2026 the team closed 31 plugins in a single day after a backdoor was found in all of them.
What it does not do is reach the sites already running it. The plugin stays active, unchanged, with no notice in your admin.
Why plugins get closed
WordPress.org records a short reason with each closure, such as:
- Security Issue: a vulnerability or malicious code. The most urgent case.
- Guideline Violation: the plugin broke the directory's rules.
- Author Request: the author withdrew it, often because it is no longer maintained.
- Licensing or trademark problems.
Some closures are temporary and the plugin returns once fixed. Many are permanent.
How to check whether a plugin was closed
Ask the directory's public API, replacing the slug:
https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&request[slug]=PLUGIN-SLUGA closed plugin answers with "error":"closed", the closed_date, and a reason_text such as Security Issue. A plugin that is simply not in the directory answers Plugin not found.
Doing that for every plugin, on every site, every week, is the part nobody manages.
What to do when one of yours is closed
- Read the reason. "Security Issue" means act today; "Author Request" usually means plan a replacement.
- Turn off its automatic updates, so nothing new arrives if the listing changes hands or returns under someone else.
- Find a maintained replacement, test it, and switch.
- Remove the closed plugin, rather than leaving it deactivated: inactive code can still be reached on some servers.
- Check its files against the last genuine release if the reason was security. How a file integrity check works.
Let your site tell you
Touchstone asks the directory about every installed plugin each day. A closed plugin becomes a high-risk finding with the closure date and reason, even if it was closed before you installed Touchstone. From the same screen you can turn off its automatic updates in one click.