The WordPress directory has closed about 50,700 plugins. The live directory, the one you can still install from, is about 74,000. Closed is a different set: the slug is still known, and the directory refuses to serve the plugin.
A closed listing is easy to hear as a security event. The reason field says something broader. About one in three closures is a guideline violation. About one in five is labelled unused. About one in six is the author asking for the plugin to be taken down. Security issues are about one in eight.
What the directory wrote down
Every closed row in this record carries the reason the API returned the last time the slug was asked. Six labels cover almost all of them.
| Reason | Plugins | Share of closures |
|---|---|---|
| Guideline violation | About 16,000 | About 1 in 3 |
| Unused | About 10,500 | About 1 in 5 |
| Author request | About 8,800 | About 1 in 6 |
| Unknown | About 6,600 | About 1 in 8 |
| Security issue | About 6,400 | About 1 in 8 |
| Licensing or trademark | About 2,300 | About 1 in 20 |
What this means: most plugins that leave do so because the listing broke a rule, because nobody was shipping it, or because the author took it down. A security closure is a large group. It is not the typical one.
2018 was a cleanup, not a breach
The year on the closed date is uneven. 2018 accounts for about 14,300 closures, more than any other year in the record. About 9,800 of those are labelled unused. Security closures that year were about 100.
No later year repeats that shape. Closures since 2019 run between roughly 2,000 and 5,000 a year, and the mix shifts toward guidelines, author requests, and security. 2026, still unfinished, already has about 2,200 closures.
What this means: a spike in the closed count is not, by itself, a spike in vulnerabilities. In this record the largest spike is a pile of plugins marked unused.
Security closures are newer than the rest
The security rows have their own history. Before 2021 the directory closed fewer than 200 plugins a year for a security issue. After that the count steps up, and 2024 is the heaviest year in the record.
| Year | Closed for a security issue |
|---|---|
| 2020 | About 100 |
| 2021 | About 600 |
| 2022 | About 800 |
| 2023 | About 500 |
| 2024 | About 2,000 |
| 2025 | About 1,700 |
| 2026, to 4 October | About 600 |
2026 is a partial year, so it cannot be lined up against 2024 yet. The level since 2021 is still far above the years before it.
What this means: security closure is a practice the directory now does in volume. It is also recent. Reading the whole history of closed plugins as a history of exploits will over-count the early years and under-count the last five.
Closed is not the same as quiet
A separate count looks at plugins that are still live and have not shipped a release in two years. Those you can still install. A closed plugin you cannot. The status split on the statistics page is the place those two facts sit next to each other: live, closed, and the thinner “not found” set, where the API has nothing at all for a slug that was once in the index.
What to do with a closed plugin
- Read the reason before you read the year. Unused, author request, and a guideline violation ask for different next steps.
- Treat a security closure as a reason to find out what replaced it. That is the group where the code itself was the problem.
- Do not treat a quiet live plugin as closed. Installable and maintained are different, and this record keeps them in different counts.
- A trademark or licensing closure is about the listing. It is a small share of the total, and it is not a statement about whether the last release had a vulnerability.
The main conclusion
About 50,700 plugins have left the directory. About a third were closed over guidelines, about a fifth for going unused, and about a sixth because the author asked. Security is a real and growing share. Across the whole record it is about one closure in eight.
Data note: Figures come from this site’s copy of the public WordPress plugin directory, read on 4 October 2026. Reasons are the labels the plugin API returns, rounded here so a later refresh of a few dozen rows does not change the sentence. The statistics page is the same record on a slower refresh, so its closed total can sit a little behind this piece.