What to inspect on every plugin
Last update age — months without a release is a maintenance risk.
wordpress.org rating and review volume — low ratings with enough reviews are a signal, not noise.
“Tested up to” vs your running WordPress core version.
Whether the plugin still loads assets site-wide when you only need it on one template.
Security hygiene checklist
Keep core, themes, and plugins updated; delete unused plugins entirely (deactivated is not enough).
Enforce strong admin authentication (2FA where possible) and limit login brute force.
Disable XML-RPC if you do not need it; restrict file editing in wp-admin.
Put a WAF / bot challenge in front of wp-login.php during attacks — then allow trusted auditors with a shared crawl key.
How AuditHQ helps
Create a Website project to audit sites that use WordPress (plugins/themes appear in Stack). Or create a WordPress plugin project with your wordpress.org URL to monitor your own listing — ratings, installs, freshness, support — on a schedule so product owners can track progress over time.