Skip to content
PluginCanary

The early-warning system for WordPress plugins

Know when a WordPress plugin turns risky, before it hits your sites.

Ownership changes, closures, unpatched vulnerabilities and abandoned plugins. We watch every plugin on wordpress.org daily and alert you only about the ones you actually run.

Run a whole stack?Check my whole site
News Kit Addons For Elementor
3,000+ active installs
Healthy
91/ 100 Canary Score

Vulnerability published 21 Oct 2026 still has no fix after 14 days.

Ownership100
Maintenance100
Security100
Support70
Reputation70

Latest Critical event on the Radar, 4 Nov 2026.

78,153
plugins monitored
966
ownership changes this month
17
plugins closed this month
1,304
open unpatched vulnerabilities

Updated nightly from public sources.

Latest on the Radar

Newest Critical events

See the full Radar
Security4 Nov 2026
News Kit Addons For Elementor
3,000+ installs

Vulnerability published 21 Oct 2026 still has no fix after 14 days.

Security4 Nov 2026
Advanced Twenty Seventeen
unknown installs

Vulnerability published 21 Oct 2026 still has no fix after 14 days.

Security4 Nov 2026
MAS Videos
1,000+ installs

Vulnerability published 21 Oct 2026 still has no fix after 14 days.

Security4 Nov 2026
Participants Database
unknown installs

Vulnerability published 21 Oct 2026 still has no fix after 14 days.

Security4 Nov 2026
SchedulePress - Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher
10,000+ installs

Vulnerability published 21 Oct 2026 still has no fix after 14 days.

Security3 Nov 2026
Remove Google Fonts - Disable, Block, or Replace with Bunny Fonts for GDPR Compliance
unknown installs

Vulnerability published 3 Nov 2026 with no patched version yet.

How it works

Three steps, then we do the watching

  1. Connect your sites

    Install the free connector plugin, or paste your plugin list. We only read plugin names and versions.

  2. We watch every wordpress.org plugin daily

    Ownership, closures, security, maintenance, support and reviews, with the history wordpress.org throws away.

  3. Get alerted with what to do

    Only about plugins on your sites, with the evidence, affected sites and healthier alternatives.

One alert, everything you need

What happened, which sites, what to do

One event sends one alert per workspace, never one per site. Every alert links to the evidence behind it and suggests healthier alternatives. Critical alerts arrive within minutes by email and Slack.

  • Critical: instant, by email and Slack
  • Warning: daily digest at 07:00 your time
  • Info: weekly summary
From [email protected]Example alert

[Critical] Example Contact Form changed owner and shipped a new release

Affects 12 of your sites

Evidence
A new committer made a first commit on 12 Oct 2026. None of the previous committers has committed since August. Version 4.2.0 shipped on 21 Oct 2026.
What to do
Do not update. Review the 4.2.0 release or replace the plugin, and turn off auto-updates for it.
Healthier alternatives
Example Form Builder 91Example Quick Forms 86
Example only: the plugin names and dates are made up to show the format.

For agencies

Monitor every client site from one screen

Connect sites with a lightweight plugin or paste a plugin list. See which clients carry the most plugin risk, and act before a problem reaches a client.

2
Critical
9
Warning
1
Sites stale
Riskiest sites
client-one.example34 pluginsAvoid
shop.example41 pluginsAt risk
lawfirm.example22 pluginsWatch
studio.example18 pluginsHealthy
Example dashboard with sample sites.

Open methodology

Every score comes from fixed, published rules. No AI decides a plugin's status.

Read the methodology

Public data sources

wordpress.org Plugins API, Trac commit logs, reviews and download stats, and the Wordfence Intelligence feed.

See all sources

Built by plugin makers

Built by the team behind WPFactory and WooBeWoo plugins on 200,000+ sites. No sponsored placement, no affiliate links.

About us

Monthly report

State of WordPress Plugins

Our first monthly report is in preparation: plugins added and closed, ownership changes, vulnerabilities by category, and the biggest risers and fallers.

See reports

Questions

Is PluginCanary a security scanner?

No. We do not scan your files or your site. We track public signals about the plugins you run and warn you when they change.

Where does the data come from?

Public sources only: the wordpress.org Plugins API, Trac commit logs, reviews, download stats and the Wordfence Intelligence vulnerability feed.

How is the Canary Score calculated?

From five weighted sub-scores: ownership, maintenance, security, support, and reputation and momentum. The formulas are public on the methodology page.

What does the connector plugin send?

Your site URL, WordPress and PHP versions, and the list of plugins with versions. Never content, users, files or credentials.

Do plugin authors pay to be listed or ranked?

No. There is no sponsored placement and there are no affiliate links.

Is there a free plan?

Yes. Monitor up to 3 sites and get instant Critical alerts by email, free.