Blocked plugins and phishing kits

A small number of plugins are not allowed on our hosting: fake plugins that hide an attacker's admin account, plugins that inject adverts or redirects into your pages, crypto-miner droppers, and plugins whose updates are known to take sites offline. Files that make up a phishing kit (fake bank, mail or delivery login pages that send what visitors type to someone else) or a backdoor are refused too.

When you install or upload one

Installing a blocked plugin from your dashboard, uploading its zip, or uploading a theme or plugin zip that contains a phishing kit is refused straight away, with a message that names the file. Nothing reaches your site. Choose a different plugin — almost every blocked one is a fake copy of a real plugin, so search for the original by its author.

When one arrives another way

Plugins added inside WordPress itself, files uploaded over SFTP or the file manager, and restores are checked by our servers within minutes, and every site is checked in full every day. If we find something:

• you get one e-mail naming the site, and
• the site's security settings list exactly what we found and where, under **Blocked plugins

and phishing kits**.

Depending on what it is, we either ask you to delete it, or move it out of your site's public folder ourselves. Nothing is ever deleted: a moved plugin or folder is kept in a protected quarantine folder in your hosting account, where nobody can open it from the web.

What to do next

1. Delete the plugin or files we list, if we have not moved them already.
2. If you did not add them yourself, assume the site or an account on it was broken into:

change your WordPress, hosting and FTP passwords, remove WordPress users you do not recognise, and update every plugin and theme.

3. Run Scan now on the security card to check the rest of the site.

If you think we got it wrong

Press Ask us to check next to the item, or reply to our e-mail. Our team looks at the file with you and, if it is safe, puts it back exactly where it was.

Plugin updates that cannot take your site offline

When we update plugins for you (the Update plugins bulk action), we update them one at a time and check the site before and after each one: the home page must still load, without a WordPress error, and the site's error log must not show a new PHP error. If an update breaks the site, we put the previous version back straight away, hold that version for your site, and e-mail you once. If the same version breaks two sites on our hosting, we hold it for every site so nobody else receives it.

Held updates are listed under Plugin updates on the same card. A hold is released on its own when the plugin's author publishes a newer version. You can also release a hold on your site yourself (Release the hold), for example after fixing the conflict, and the next plugin update applies it again.