Case: Removing 14 Dead Plugins Cut the Attack Surface in Half

Case: Removing 14 Dead Plugins Cut the Attack Surface in Half
A site carried 31 plugins; 14 were deactivated-but-installed, 3 abandoned (no update in 2+ years).

Inventory SOP:

— Step 1: Export the plugin list with version + last-update date.
— Step 2: Flag anything not updated in 12 months — found 5.
— Step 3: Delete (not just deactivate) every plugin not active. Deactivated code still executes via direct file requests. Removed 14.
— Step 4: Replace 2 abandoned plugins with maintained equivalents.
— Step 5: Cross-check remaining plugins against the WPScan vulnerability feed.

Outcome: 31 → 17 plugins. WPScan flagged 2 known CVEs in the deleted set — both would have been exploitable. Update workload dropped 45%.

Run this every time.