To manage WordPress plugins, go to Plugins in your dashboard. From there you can install, activate, update, deactivate and delete them, and you can turn on auto-updates for each plugin separately. One distinction matters more than any setting: a deactivated plugin is still on your server, files and all, while a deleted one is gone. That is why a monthly cleanup of unused plugins does more for your site's safety than any amount of careful activating.
TL;DR:
- Everything you need for a single site is under Plugins in wp-admin, including per-plugin auto-updates, which WordPress added in version 5.5.
- Deactivating a plugin leaves its files on your server. If you aren't coming back to it within a month, delete it.
- Plugins live in wp-content/plugins. Renaming a plugin's folder over SFTP disables it when a fault has locked you out of the dashboard.
- Turn off the built-in plugin file editor with DISALLOW_FILE_EDIT. Make code changes in a child plugin or a code snippet instead.
- Once you run five or more sites, you need central management. The real question is whether you pay per site, per month or once.
Table of Contents
- How to Manage WordPress Plugins From the Dashboard, Step by Step
- Deactivate or Delete: Why the Cautious Choice Is Usually Wrong
- Where WordPress Stores Plugins, and What That Means When You're Locked Out
- Editing Plugin Code: The Built-In Editor and Why You Should Switch It Off
- Plugin Updates: Which to Auto-Update and Which to Watch Closely
- Managing Plugins Across Many Sites: Dashboards, WP-CLI and What They Really Cost
- A Monthly Plugin Audit That Takes 10 Minutes per Site
- Manage Plugins on Every Site by Asking in Plain English
- Frequently Asked Questions
- Sources
How to Manage WordPress Plugins From the Dashboard, Step by Step
If you run one site, you don't need anything beyond what WordPress ships with. The official Manage Plugins documentation from WordPress.org covers the screens. Here is what each one is actually for:
- Plugins → Add New Plugin. Search the free directory, click Install Now, then Activate. You can also upload a .zip file here, which is how most paid plugins get installed.
- Plugins → Installed Plugins. This is your control room. Each row shows the version, whether an update is waiting, and a link to enable or disable auto-updates for that plugin.
- Bulk actions. Tick several plugins and you can activate, deactivate, update or delete them in one go. Use this for cleanup, not for updates on a live shop.
- Dashboard → Updates. This collects core, plugin and theme updates in one list. It is quicker to scan than the plugins screen when you have 30 or more plugins installed.
If you are looking for a free way to manage WordPress plugins, this is it. The built-in screens cost nothing and are enough for one or two sites. Their weakness only shows when you have to repeat the same clicks across many sites.
Deactivate or Delete: Why the Cautious Choice Is Usually Wrong
Most people deactivate a plugin they've stopped using "just in case." It feels safe, but it usually isn't.
A deactivated plugin no longer runs through WordPress's normal loading process. Its files are still in your plugins folder, though. If one of those files can be reached directly in a browser and contains a vulnerability, an attacker doesn't care whether you clicked Deactivate. Deactivated plugins also stop showing up in your mental checklist, so they tend to miss updates for months.
A deactivated plugin is still code on your server. Delete it and it has nothing left to exploit.
Our position: deactivate only as a temporary test, for example while you work out which plugin is causing a conflict. If a plugin has sat deactivated for 30 days, delete it. You can reinstall it from the directory in about 20 seconds.
Pro Tip: Before you delete a plugin, check whether it ships an uninstall routine. Many form, SEO and membership plugins delete their own database tables and settings when you remove them through the dashboard. That is tidy, but it is a disaster if you meant to come back to it. If you might reinstall, export the plugin's settings first. Or remove its folder over SFTP instead, which deletes the code without triggering the uninstall routine.
Where WordPress Stores Plugins, and What That Means When You're Locked Out
WordPress keeps plugins in three places, and knowing them is what gets you back in after a bad update:
- wp-content/plugins/ holds every regular plugin. Each one gets its own folder.
- wp-content/mu-plugins/ holds "must-use" plugins. These load automatically, can't be deactivated from the dashboard, and are often added by hosts. If you see one you don't recognize, ask your host before touching it.
- The database stores the list of which plugins are active, in the
active_pluginsentry of the options table. Each plugin's settings usually live in that same table or in tables of its own.
Since version 5.2, WordPress has had a recovery mode. When a plugin causes a fatal error, it emails the site admin a link that lets you log in with that plugin paused. If the email never arrives, which happens often on sites with weak mail delivery, connect over SFTP or your host's file manager and rename the faulty plugin's folder, for example to woocommerce-off. WordPress can't find it, deactivates it, and your dashboard comes back. If you don't know which plugin caused the fault, rename the whole plugins folder, log in, rename it back, and then reactivate plugins one at a time.
This is also the honest answer to "how do I download a plugin to manage it manually?" Download the .zip from the plugin's directory page or from the vendor's account area, unzip it, and upload the folder to wp-content/plugins/.
Editing Plugin Code: The Built-In Editor and Why You Should Switch It Off
You can edit plugins inside WordPress. The Plugin File Editor sits under the Plugins menu, or under Tools on sites running a block theme. It lets you change any plugin file in the browser.
Please don't use it. Three reasons:
- Your change disappears at the next update. The update replaces the whole plugin folder, including your edit.
- A typo takes the site down. WordPress checks some edits before saving them, but not all. A broken file on a live site means a white screen and an SFTP rescue.
- The editor is a gift to anyone who steals an admin login. With it, a stolen password becomes full code execution on your server.
The WordPress Advanced Administration handbook documents the fix. Add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php and both the theme and plugin editors disappear. There is a stricter option, DISALLOW_FILE_MODS, which also blocks installs and updates from the dashboard. That is useful on locked-down client sites, as long as you are updating them by some other route.
If you genuinely need to change how a plugin behaves, use the hooks and filters it provides. Put that code in a small custom plugin or a code snippets setup, so it survives updates.
Plugin Updates: Which to Auto-Update and Which to Watch Closely
WordPress added per-plugin auto-updates in version 5.5. The WordPress.org guide to plugin and theme auto-updates explains the toggle. It doesn't tell you which plugins deserve it, so here is how we would split them.
| Plugin type | Auto-update? | Why |
|---|---|---|
| Security, backup, spam filtering | Yes | Delayed patches cost more than a rare bad release |
| Small single-purpose utilities | Yes | Low blast radius, easy to roll back |
| SEO plugins | Yes, but check weekly | Updates are frequent and rarely break the front end |
| Page builders | No | Major releases can change layouts site-wide |
| WooCommerce and its payment extensions | No | Test on staging; a broken checkout costs money hourly |
| Anything custom or edited | Never | An update overwrites your changes |
Abandoned plugins are a bigger risk than buggy updates. The plugin directory shows a warning on any plugin that hasn't been tested with the last three major WordPress releases.
"This plugin hasn't been tested with the latest 3 major releases of WordPress." When you see that banner, start looking for a replacement.
The banner doesn't mean the plugin is broken today. It means nobody is watching it, so the next security report may never get a fix.
Managing Plugins Across Many Sites: Dashboards, WP-CLI and What They Really Cost
Somewhere around the fifth site, the built-in screens stop working for you. Here is the arithmetic. Ten sites with 20 plugins each means 200 plugin installs to keep current. Even at three minutes per site for a weekly login, check and update, that is about 26 hours a year spent only on clicking Update.
There are four realistic ways to handle this:
| Method | Cost model | Best for | Main trade-off |
|---|---|---|---|
| Logging into each site | Free | 1–3 sites | Your time scales linearly |
| Hosted management dashboards | Free core, paid add-ons per site per month | Agencies wanting uptime and backup reports in one place | Bills grow with every client site |
| Self-hosted management dashboards | Free core, paid extensions | Technical teams willing to run another WordPress install | You maintain the manager too |
| WP-CLI | Free | Developers with SSH access | Needs shell access many cheap hosts don't give |
People often search for what the best-known hosted dashboard costs. The model across that category is consistent: the core dashboard is free, and add-ons such as backups, uptime monitoring and white-label reports are charged per site, per month. Check current prices on the vendor's own page, because they change. That model is cheap for three sites and steadily less cheap at thirty. The one-click "WordPress manager" tools bundled into some hosting control panels are free, but they only see the sites on that one server.
If you have SSH access, WP-CLI is the most powerful free option. wp plugin list --update=available shows what's outdated. wp plugin update --all --dry-run previews the updates without applying them. wp plugin deactivate --all is the command-line version of renaming the plugins folder.
There is also a newer route. Since WordPress 5.5, the REST API has had a plugins endpoint, so an authenticated tool can list, activate, deactivate and install directory plugins without using the dashboard at all. That is what AI tools use when you ask them to manage plugins for you. It relies on Application Passwords, and if you want the plumbing explained, start with our plain-English guide to APIs.
A Monthly Plugin Audit That Takes 10 Minutes per Site
Once a month, ask five questions of every site:
- Is anything deactivated? Delete it unless it's part of a test you're running this week.
- Is anything untested with recent WordPress versions? Look on its directory page for the three-release warning.
- Are two plugins doing one job? Two SEO plugins, two caching plugins and two form builders are the classic offenders, and they conflict.
- Is every paid license active? An expired license usually means no updates, and the plugin screen won't always warn you.
- Did anything update and change behavior? Spot-check the homepage, a form and, on shops, the checkout. Our WooCommerce MCP guide covers what to lock down there.
Plugin count matters less than people think. A site with 35 well-maintained plugins is safer than one with 12 abandoned ones. Judge plugins by who maintains them, not by how many you have.
Manage Plugins on Every Site by Asking in Plain English
The time drain described above comes from repetition: the same checks and updates across ten tabs. PressHand runs on your own machine or server and connects Claude or ChatGPT to every WordPress site you own. You can ask "which sites have plugin updates waiting?" or "deactivate the old slider plugin on the three client sites," and it does the work. Plugins are one of 83 jobs it handles, alongside posts, menus, images, comments, CSS and live SEO scoring.
It costs $97 once, for every site you own, with no per-site fee. The Agency licence is $197 and adds rebrand and resell rights. Updates are free for the first year, then optional at $49 a year. One honest caveat: PressHand does exactly what you ask. It won't decide whether a page builder update is safe for a live shop, so keep testing big updates on staging first.
Frequently Asked Questions
How do I manage my plugins in WordPress?
Go to Plugins → Installed Plugins in your dashboard. From there you can activate, deactivate, update, delete and set auto-updates for each plugin, and bulk actions let you change several at once. For more than a handful of sites, use WP-CLI, a central dashboard or an AI client connected through the REST API.
Where are plugins stored in WordPress?
Regular plugins live in wp-content/plugins, each in its own folder. Must-use plugins live in wp-content/mu-plugins and load automatically. The list of active plugins and most plugin settings are stored in the database's options table.
How can I edit plugins in WordPress?
WordPress includes a Plugin File Editor, but any edit you make there is overwritten at the next update, and the editor is a security risk. Disable it with DISALLOW_FILE_EDIT in wp-config.php. Customize behavior through the plugin's hooks, in a small custom plugin or code snippet, instead.
How much do multi-site plugin management dashboards cost?
Most hosted dashboards offer a free core and charge for add-ons such as backups, uptime monitoring and reports, billed per site, per month. That is inexpensive for a few sites and adds up across a large client roster. Check each vendor's current pricing page, since rates change.
Is it safe to leave plugins deactivated?
Not for long. A deactivated plugin's files stay on your server and can still be reached if they contain a vulnerability, and deactivated plugins tend to miss updates. Delete anything you haven't used in 30 days, after exporting its settings if you might need them again.
Sources
- Manage Plugins | WordPress.org Documentation
- Plugins and Themes Auto-Updates | WordPress.org Documentation
- wp-config.php | WordPress Advanced Administration Handbook
- wp plugin commands | WP-CLI Handbook, WordPress Developer Resources