FadeWatch – Abandoned & Closed Plugin Checker

Description

Know which plugins are dead before they become a security problem.

FadeWatch shows the maintenance status of every installed plugin, right on the Plugins screen:

• Closed on WordPress.org, with the date and reason (for example “Closed on 27 Jul 2023: Security Issue”).
• Possibly abandoned: no update in over 24 months (configurable).
• Ageing: no update in 12–24 months (configurable).
• Maintained: updated recently.
• Not on WordPress.org: premium or custom plugins, and plugins that get their updates elsewhere (Update URI header).
• Couldn’t check: WordPress.org could not be reached. This is never reported as “closed” or “not found”.

Built for accuracy

• A failed request never overwrites an earlier good result.
• “Closed”, “not found” and “couldn’t check” are kept strictly apart.
• If a custom plugin happens to use the same folder name as an unrelated WordPress.org plugin, its data is marked “Not verified” instead of showing the wrong plugin’s status.

Lightweight

All lookups run in the background (WP-Cron), in small batches. Opening the Plugins screen reads one stored option and makes no external requests. The plugin loads no code on the front end of your site.

Features

• Optional “Maintenance” column on the Plugins screen showing each plugin’s status (off by default; turn it on in the settings).
• Report page (Tools → Plugin Maintenance) with a summary, “Check now” button, and CSV export for client reports.
• Two Site Health tests: closed plugins (critical when closed for a security issue) and plugins without updates for a long time.
• E-mail only when something changes. A plugin closed for a security issue triggers an immediate e-mail. Optional weekly summary.
• Closed plugins and failed checks are re-checked every 6 hours, so a reopened plugin is noticed quickly.
• Plugins are re-checked right after they are installed, updated or activated.
• Works when WP-Cron is disabled: “Check now” runs the batches from your browser.
• Multisite: one shared check for the whole network, in Network Admin → Plugins.
• Asks first: nothing is sent to WordPress.org until an administrator allows checks, and checks can be turned off at any time.
• No ads, no account, no tracking.

Not a vulnerability scanner

This plugin checks maintenance status, not known vulnerabilities. It can be used alongside any security plugin.

For developers

Filters:

• fadewatch_plugin_slug – map a plugin file to a different WordPress.org slug.
• fadewatch_skip_plugin – exclude a plugin from checks.
• fadewatch_thresholds – change the “ageing” and “possibly abandoned” thresholds (in months).
• fadewatch_status – override the computed status.
• fadewatch_email_recipients – change notification recipients.

Actions:

• fadewatch_status_changed( $plugin_file, $old_status, $new_status, $evaluation )
• fadewatch_scan_started( $source )
• fadewatch_scan_completed( $results )

External services

This plugin connects to the WordPress.org Plugins API (https://api.wordpress.org/plugins/info/1.2/) to look up the maintenance status of installed plugins: last update date, whether the plugin was closed and why, “tested up to” version, rating and active installs.

• What is sent: only the slug (folder name) of each installed plugin, one request per plugin. The request’s user agent is FadeWatch/<version> and does not include your site address.
• Only after consent: nothing is sent, and no background checks are scheduled, until an administrator ticks “Allow FadeWatch to look up my installed plugins” and clicks “Save and scan now” (or enables “WordPress.org checks” in the settings). Turning that setting off stops all requests and removes the scheduled checks.
• When: after consent, once a day in the background, every 6 hours for closed plugins and failed checks, right after a plugin is installed, updated or activated, and when an administrator clicks “Check now”.
• No personal data about your visitors or users is sent.

This is the same service WordPress itself uses to check for plugin updates. It is provided by WordPress.org: Privacy Policy.