The right question is not whether a GPL plugin is safe. GPL is a license: it tells you what you can do with the code, and nothing about what is inside the file. What determines security is the file that reaches your site, and you can check that before installing.
Where the risk comes from
The risk is not in the license, but in who distributes the file. A file passed along without oversight can arrive modified: a snippet that creates a hidden administrator account, redirects visitors, or injects spam links into pages. This is what frequently turns up in files offered for free on forums and unidentified download sites.
This type of modification rarely breaks anything right away. The site keeps working, and the problem only shows up days later.
What to check before installing
- Antivirus scan of the file. Each item in the catalog displays a verification badge on its page: the ZIP you download has undergone an antivirus scan, and clicking the badge shows you the date and result. The entire catalog undergoes this scan, and it is repeated whenever the file changes.
- Version and date. Each item’s page shows the version being served and when it was updated. A file left on an old version accumulates security vulnerabilities the developer has already fixed. If you want to compare it with the developer’s version, read why the version here may be different.
- What changed in the release. When the developer publishes release notes, they appear on the item’s page. Security fixes are usually listed there.
- Who keeps providing updates. A file is safe on the day you install it. It stays safe if someone keeps bringing you new versions.
It is worth being honest about the limitation: antivirus scans find known malicious code. They are the first filter, and do not replace the two steps below.
Test before installing on your live site
A new plugin, a new theme, or a new version: install it on a copy first. That is where a conflict can surface at no cost, and where you check whether the item does what it promised. The step-by-step instructions are in how to set up a test environment.
Updating is also part of security
Many WordPress breaches happen through outdated plugins, not new ones. Keeping items on the current version closes the vulnerabilities the developer has already fixed.
The Ultrapack Auto Updater brings catalog updates to the WordPress dashboard and saves a copy of the item before each one. If the new version causes problems, you can restore the previous state through the plugin itself.
Warning signs after installing
- an administrator account you did not create;
- visitors being redirected to another site, sometimes only on mobile or only on their first visit;
- strange links in the page code or footer;
- new
.phpfiles insidewp-content/uploads/, a folder that should only contain images and documents.
If any of these appear: deactivate the suspicious item, change the administrators’ passwords, and restore the most recent backup from before the installation. And contact support, specifying the item and version.
What about the license?
What the GPL allows, and what it does not cover, is explained in What is the GPL license.
