Opens in a new tab
Safety and security

It moves other people's code.
So it is careful.

A tool that archives, deletes and runs uninstall routines has to be boring in the best way. Everything on this page is a rule in the code, covered by tests.

Guarantees

What it will never do.

These hold for the free plugin and Pro, from the screens, the daily check and WP-CLI alike.

Never archives an active pluginOn a network, not one that is active on any site.
Never overwritesIf something is already where a move would land, the move is refused and you are told why.
Never activates on restoreA restored plugin comes back inactive, even after it has been updated.
Never follows a symbolic linkNot when moving, deleting or building a download, so nothing outside a plugin's own folder is touched.
Never guesses at leftover dataClean up uses only the plugin's own uninstall routine. Plugins without one are reported, not guessed at.
Never acts without permissionEvery action checks a nonce and the matching WordPress capability. Deleting and downloading need permission to delete plugins.
Pro · automatic deletion

A week's notice that someone
has actually seen.

Automatic deletion is off until you turn it on and tick a box confirming that deleted plugins can only be recovered from a backup. Then every deletion follows the same path.

1

Announced

A plugin due for deletion is listed in the email report and in a notice on the Plugins screen that cannot be dismissed.

2

Seen

The clock starts only when the email reached the administration address, or the notice was shown to someone who may delete plugins.

3

A week, then a decision

Restore it, tick “never delete”, or let it go. If the email fails and nobody logs in, nothing is deleted at all.

Unrecognised foldersNever deleted automatically.
Uninstall routinesRun automatically only if you turn that on separately.
A routine that failsIs reported and never retried.
Who can change itOnly users who may delete plugins.
Pro · signed updates

Only updates we signed get installed.

Pro installs an update only if its Ed25519 signature and its checksum both verify. A tampered or swapped download is refused, even if it comes from the right address.

The archive folder

Hard to find, and blocked from the web.

Its name ends in random characters chosen for your site, and it gets access rules for Apache and IIS. On servers that ignore them, such as nginx, the screen and Site Health warn you and say what to block.

Privacy

No tracking. Nothing sent to us.

The free plugin only uses WordPress's own updater when it updates a plugin on restore. Pro also asks WordPress.org about archived plugins' status once a week, which you can turn off.

Open source

GPL, version 2 or later.

Free and Pro alike. You can read every line of what runs on your site.

How it is checked

Tested on four server stacks
before every release.

Each release runs the full test suite against real WordPress installs, including the minimum versions it supports. The code was security-reviewed during development, and the issues found were fixed before release.

Stack
WordPress
PHP
Apache
latest
8.2
Apache, minimum versions
6.2
7.4
nginx
latest
8.2
Multisite network
latest
8.2

Found a security issue?

Please email [email protected] with steps to reproduce, rather than posting it publicly. You will hear back within a few working days.