Installing and updating plugins

You can manage plugins from the panel rather than logging into each site.

Installing

Open the site, then Plugins, then search. You are searching the WordPress plugin directory itself, so what you find is what you would find on wordpress.org. Install it and activate it from here.

Updating, and why to let us do it

Out-of-date plugins are how almost every compromised WordPress site is compromised. It is not usually a sophisticated attack — it is an automated scan that found a known hole in a plugin that has had a fix available for months.

Turn automatic updates on. If you have a lot of sites, update across the estate rather than site by site.

Before updating something important

If a site is business-critical, test the update on staging first. Staging is a copy of the site you can break without anybody noticing.

Removing what you are not using

Deactivating a plugin is not removing it: the code is still on disk and can still be reached. Delete plugins you have stopped using. A deactivated plugin with a known vulnerability is very nearly as dangerous as an active one, and it is the kind that nobody remembers to update because nobody remembers it is there.