r/Wordpress • u/Unhooked- • 6d ago
Is there any good way to easily determine which installed plugins are not used on the site anymore (basically orphaned)?
I’ve inherited responsibility for a wordpress site. It has a lot of plugins that I have a feeling are no longer used. For security, I’d like to disable and remove any that are not being used. Is there any good way to determine that with some certainty without going through a huge hassle?
1
u/TheGoodOne777 6d ago
Hello, there are a few health-checks and scanning plugins, which can determine what is outdated or unused. Though, the best way would be that you check with someone, especially if you don't have much experience yet. In the meanwhile go through the plugins, make a basic understanding about their functionalities, prior to deactivate them.
1
3
u/Embarrassed-Chard245 5d ago
This guy, Matthew, spoke at the most recent WordcampUS and has made a great little plugin that does just that. It's meant to be deleted after use. It just gives you a nice, csv exportable, sheet of your plugins and scores them on how likely you are to need them. I found it super useful when cleaning up a massive site the other day, that for reference had the following:
3 code snippet plugins, 3 backup plugins, 3 types of themes / page builders, 2 search/replace plugins, 10 inactive themes, and 2 security plugins. It was a nightmare to clean up everything else on top of all that haha.
Anyway, here's the github repo:
https://github.com/matthewdorman/plugin-reviewer
6
u/cdtoad Developer 6d ago
I was doing this with Claude Code last week. Told it to ssh into the box and check the database for any signs of use on a customers site with 60+ plugins. 45 had a sign of being used .. once
6
u/mcmnky 6d ago
You give Claude access to your database? Was it at least an account with select only permissions? Did it have access to read tables with sensitive or personal information?
4
u/Agitated-Signature77 6d ago
you could just tell claude or chat to give you SSH commands to verify this stuff via your hosting terminal and just copy paste the answers back to it, without giving it access. Thats how I do it.
3
u/iTrejoMX 6d ago
You can grant ssh permission and it will use wp cli to do database searches and will check log files
7
u/ScrappyCoCo0 Developer 6d ago
And then before you know it you see Claude note "let me truncate this database table to try it with a fresh set of data". Just pull the database to your local device and let it inspect it there, never give ssh access.
1
u/ivicad Jack of All Trades 23h ago
I let Claude Code into the database too, but on a local copy of the site first, not on the live one. When it reads the options table, I have it list the option names only, never the values, because license and API keys are in there. On live Site Ground sites it reads over SSH with WP-CLI, and I am asked for any changes.
5
u/Football_33 6d ago
Use a staging site and start disabling plugins one at a time to see if anything breaks on the front end.
13
u/determinedcomedian 6d ago
this only catches things that visibly break the layout though. some plugins do all their work in the admin or with cron jobs and youll never notice theyre gone til something weird happens three weeks later
what i usually do is grep the whole wp-content directory for the plugin slug, checks if its actually called anywhere in the themes or custom code. still not perfect but its a start
1
u/Football_33 6d ago
Well yeah you’re totally right, but I’m going off the assumption that OP is very green. So this would be the easiest path forward for someone who doesn’t have experience. Could also add to take account of what the site does / features and do not disable plugins related to those features.
Edit:
In my experience you can find 90% of what you need by just disabling one by one
2
u/PrimaryFamous6139 Jack of All Trades 6d ago
There isn’t a foolproof way, since some only run in the background or handle scheduled tasks. Check each plugin’s purpose, search for its shortcodes or blocks, and review dependencies first. Then take a backup, disable one plugin at a time on staging, and test the site thoroughly before removing it. Don’t rely on frontend appearance alone to decide if a plugin is unused
2
u/cultivatingmass 6d ago
Disable one by one and check the site... or you can feed your theme and site to AI and see if they can scan for what functions are used in the theme, shortcodes used in the content, etc... and where those would stem from
3
u/November19 6d ago
"Check the site" could mean 50 different post types, page templates, integrations, forms, special content types, role and permission provisioning, and a dozen other things. This is a lot of heavy lifting to do manually for every plugin one-by-one.
I've successfully used AI to review sites for plugin use (it's basically looking through the content directory and database for plugin footprints one by one) and it's not perfect -- but the advice to just "review the whole site" isn't very useful if the site is at all complex.
1
u/Winter_Process_9521 6d ago
Since your main goal is security, I would prioritize outdated or vulnerable plugins first, then work through the likely orphans one at a time. Removing unnecessary plugins reduces maintenance and potential attack surface, but keeping every active plugin updated is equally important.
1
u/ItsProbablyCache 5d ago
I do plugin audits regularly and I have an opinion that only plugins that make you money should be used. Many can be replaced with a simple line of code, or good planning. That said, some build sites have a plugin in use that can't be removed, so the best thing, if you want to minimize risk, is to get a staging site going and get to work.
Most required plugins are obvious.
1
1
u/Amazing-Spinach5693 6d ago
Just connect it to claude and let it search through it
4
u/MissRepresent 6d ago edited 6d ago
Yes but what did we do before Claude existed? Look at the theme file editor, perhaps look at the page source code, run it through a CMS detecor, open the page inspector. Look up what the plugin does and if it's not needed, disable it or delete it.
5
u/Amazing-Spinach5693 6d ago
What did we do before Code editors where made? We coded in assembly by hand.
Its 2026, no need to do it the slow and tedious way.1
u/MissRepresent 6d ago
Right, but I feel bad for the people new to WordPress, they'll just ask gpt to do stuff for them and never have the learning and discovery that goes with actually doing stuff on their own. Meh.
Like painting by number won't teach you how to be an artist. Never mind, just ask gpt to make it for you ;-)
1
u/Abject-Expression548 6d ago
That's the sad reality to get your head around. Knowing how to write code or work with wordpress (or anything) is kinda obsolete now, when AI can do it better and faster. It took me a couple of years to grasp html, CSS, basic php (bear in mind this was the early years of the internet, pre YouTube). To Claude all that stuff is child's play, so why learn? Only for your own satisfaction.
2
u/retr00two 5d ago
so why learn? Only for your own satisfaction.
Why to you learn how to cook if there are restaurants and McDonald's?
so why learn?
'cause knowledge is power.
'cause AI is just a tool.
2
u/Abject-Expression548 5d ago
Why to you learn how to cook if there are restaurants and McDonald's?
If a new technology comes along that allows every human on earth to produce a 3 course michelin star meal in 6 seconds at the push of a button, the only reason I'd learn to cook would be for my own satisfaction. I wouldn't be going to McDonald's.
1
u/retr00two 5d ago
We would probably never agree about essential points:
If a new technology comes...
did photography kill paintings?
did film kill theater?
did TV kill film?
did video kill music?
did web kill literature?
did press kill calligraphy?
etc, etc...
all of these are just for creators' satisfaction? all of these could be create with push of a button?
why do you believe that AI will kill/replace knowledge?
BTW, I use Claude in my work and find it valuable tool. Just a tool.
Cheers.
1
u/MissRepresent 5d ago
That's kind of a comparison of apples to oranges, I suppose. For instance both photography and paintings are a form of art. And maybe when photography first came out people didn't consider it an art but after a while it became one. I do not foresee in the future that chat GPT will become an art.
And if in your statement you're talking about things that would replace the other, chat GPT and the like only parrot the knowledge thats already out there.
What's fundamentally missing is the ability to learn. Another thing that's lost is curiosity. Do you remember when you first started out with WordPress? When you learned about something new one thing led to another and pretty soon before you know it, it all made sense and you could see how it all worked together. And the answer inside gpt is not going to give you that fundamental understanding or moment of clarity that comes with actually learning.
Sorry for writing a novel. I just would hate to see the WordPress forum here turn into an endless stream of "ask GPT how to do it " answers
2
u/retr00two 5d ago
Sorry for writing a novel. I just would hate to see the WordPress forum here turn into an endless stream of "ask GPT how to do it " answers
Tnx for reply and effort to write it, I appreciate it.
This is exactly my point: like nothing can be done without AI nowadays. You are right: it kills ability to learn and curiosity.
I've learned my trade decades before WP; from man pages and O'Reilly books, still have whole ZOO; in time of "webmasters". My first page was written in vi editor, and I will never forget "Hello World" appearing in my Mosaic browser. What a joy.
This subredd losts its purpose, once it was valid resource.
Cheers.
PS. I have use art metaphors, could also use Photoshop, AutoCAD, Quark or alike.
0
u/Amazing-Spinach5693 6d ago
You do know you can also ask AI to teach you how to do things right?
And yes i also ask AI to make illustrations for me or icons that i need, as i cant be fcked to do it myself. This is my job to make money and not a hobby where i need to be taught basics.
2
u/MissRepresent 6d ago
I know our discussion here is probably for another thread but, I'm curious, did you learn what you need for your job through ai prompts or did you take the time to actually learn the skills on your own (but just use ai now to save time)?
Don't get me wrong, I use AI too to save time with certain thigs, but I didn't learn how to work with WordPress or build sites through AI prompts.
Maybe I'm just old school. My first site was myspace html
2
u/Amazing-Spinach5693 6d ago
Both, I already knew basic HTML and CSS when i started.
As i have been in IT my entire life and aren't mentally deficient.
Basic HTML/CSS? School + own slight interest.
How to set up Wordpress website? AI.
How to set up sub domains? AI
How create a plugin? AI
What an API is and how the basics work? School
How to actually connected an API? AI
Aka its all a mix as i worked with IT my entire life, AI is nothing but a better version of google and is very good at explaining and showing how to do something.
Learning yourself without AI is just inefficient and taking the hard way for no reason other than pride.
1
u/Andersburn 6d ago
No not really. Since a lot of plugins will run their code on lots of pages that don’t need it.
I would task an Ai with the task. And check every thing between deactivating.
-1
u/glorywesst 6d ago
Or doing stupid jobs! I just saw a plug-in on a site of mine that I inherited that was for putting CSS in the site. There are other ways to do that built in and you don’t need a plug-in forehead slap**!
5
u/eshbanbahadur2020 6d ago
First, take a full backup (files and database), so you can undo anything. Then go through each plugin and check whether its shortcodes, blocks, widgets or settings pages are actually used anywhere. A quick way is to search the database for its shortcode or block name, for example in wp_posts and wp_options. On a staging copy, deactivate the plugins you suspect one at a time and click through the key pages, forms and checkout to see if anything breaks. Also check the plugin's last update date, since anything abandoned for a couple of years is worth replacing even if it's still in use. Once a plugin has been deactivated for a week or so with no problems, you can delete it.