What is a WordPress plugin?

An add-on that gives a WordPress site a feature. Plugins are the most common way WordPress sites get hacked.

Plugins add forms, shops, galleries and SEO tools to WordPress. Each is separate software with its own flaws and updates. Abandoned plugins never get fixed.

Most WordPress break-ins come through an outdated or abandoned plugin, not WordPress itself.

What to do

Delete plugins you do not use; deactivated is not deleted.
Update plugins promptly and check the site afterwards.
Prefer plugins updated in the last six months with many active installs.