{"id":5272,"date":"2026-03-03T14:14:33","date_gmt":"2026-03-03T17:14:33","guid":{"rendered":"https:\/\/awp.agency\/?p=5272"},"modified":"2026-02-25T19:53:19","modified_gmt":"2026-02-25T22:53:19","slug":"fix-you-should-remove-inactive-plugins-you-should-remove-inactive-plugins-in-wordpress","status":"publish","type":"post","link":"https:\/\/awp.agency\/en\/blog\/solucionar-deberias-eliminar-los-plugins-inactivos-you-should-remove-inactive-plugins-en-wordpress\/","title":{"rendered":"Fix: You should remove inactive plugins (You should remove inactive plugins) in WordPress."},"content":{"rendered":"
\n
\n

If you've recently logged into the \u00abSite Health\u00bb section of your admin panel, chances are you've come across a persistent, yellow-marked recommendation: \u00abYou should remove inactive plugins.\u00bb<\/strong> (or in English, its original version: \u00abYou should remove inactive WordPress plugins\u00bb.\u00bb<\/em>). At first glance, this may seem like a minor, almost cosmetic suggestion. After all, if the plugin is \u00aboff\u00bb, what harm can it do?<\/p>\n

As a Senior WordPress developer focused on the profitability and security of websites, I assure you that this warning is much more than just spring cleaning. Inactive plugins represent latent security risks, unnecessary overhead and what we call \u00abtechnical debt\u00bb.<\/p>\n

In this article, we will break down exactly why this error appears, the real risks it hides and how to fix it step by step, based on official documentation and my technical experience optimizing high-traffic sites.<\/p>\n<\/div>\n

What does \u00abYou should remove inactive plugins\u00bb really mean?<\/h2>\n

WordPress introduced the Site Health tool to help website owners keep their installations safe and fast. When you see the message \u00abYou should remove inactive plugins\u00bb, the system has detected software installed on your server that is currently not running on the frontend<\/em> nor in the backend<\/em> of your site.<\/p>\n

Many users fall into the trap of thinking that \u00abDeactivate\u00bb equals \u00abDelete\u00bb. It's not. By deactivating a plugin, you are simply telling the WordPress database to stop loading that specific code on page startup. However, the physical files (PHP, JS, CSS) remain on your server.<\/p>\n

Key Data:<\/strong> WordPress considers this practice a \u00abRecommended Security Enhancement\u00bb. It's not a fatal flaw that will break your site today, but it is a vulnerability waiting to be exploited tomorrow.<\/div>\n

Latent security risks: The danger of executable code<\/h2>\n

The main reason you should heed this warning is security. There is a common myth: \u00abIf the plugin is inactive, hackers can't use it\u00bb. In my experience auditing hacked sites, this is absolutely false.<\/p>\n

Even if a plug-in is deactivated, its files remain on the server and constitute \u00abexecutable code\u00bb<\/strong>. PHP files inside the plugin folder can be called directly through an HTTP request if the server is not perfectly configured to block it.<\/p>\n

According to technical discussions in the official forums, moderators warn that the hackers can attack and execute this code even without the plugin being active.<\/a>. This is especially critical if you are dealing with old or outdated software.<\/p>\n

The common attack scenario<\/h3>\n

Imagine you installed a form plugin two years ago, deactivated it but did not delete it. Today, a \u00abRemote Code Execution\u00bb (RCE) vulnerability is discovered in that old version of the plugin. A bot scans your website, detects the `\/wp-content\/plugins\/plugin-vulnerable\/` folder and executes the malicious script directly, completely ignoring that WordPress has it \u00abdisabled\u00bb.<\/p>\n

2. Technical impact on performance and the database<\/h2>\n

Beyond security, keeping plugins inactive affects the overall health of your infrastructure. They are not invisible to the system.<\/p>\n

Space consumption and backups<\/h3>\n

Every file counts. Inactive plugins consume valuable disk space. On servers with limited storage, this is an obvious problem. But the real impact is seen in backups.<\/p>\n