Search for almost any premium plugin by name and the first page of results is a mix: the official WordPress.org listing, the developer’s website, a marketplace or two, and several sites offering the “Pro” edition as a free download. They all look official enough, and if the plugin works once installed, the source can seem like a detail.
It is not a detail. What follows is where to download WordPress plugins safely, how to tell a genuine source from a lookalike, and which records to keep once you have paid for a plugin so the next person who looks after your site is not left guessing.
Where to download WordPress plugins safely: the short answer
For almost every business site, there are only three sources you need:
- The WordPress.org plugin directory, for free plugins.
- The developer’s own website, for paid plugins and paid add-ons.
- A well-known marketplace where the developer chose to sell, such as the WooCommerce.com Marketplace for shop extensions or Envato’s CodeCanyon.
Anything else deserves suspicion until you have a good reason to trust it. Below is what each source gives you and why the others are a gamble. This post sits inside our WordPress help guide for owners, under the plugins section.
The WordPress.org directory
The directory is what you are searching when you use Plugins → Add Plugin in your dashboard. Every plugin there must use a licence compatible with WordPress’s own, and new plugins are checked by the WordPress.org plugin review team before they are listed. Plugins found to break the directory’s rules, including serious unfixed security problems, can be closed so nobody new can install them.
That review is a meaningful filter, not a promise. The manual review happens when a plugin is first submitted; later updates do not each get the same human check. So the directory tells you a plugin is real and was acceptable when it joined. Whether it is well maintained now is a separate question, covered in checking a plugin before you install it.
You rarely need to download anything from the directory, because the dashboard installs straight from it. If you do want the zip, for a site where search is blocked or to keep a copy, the plugin’s page on wordpress.org has a Download button.
The developer’s own website
Paid plugins, and paid add-ons for free ones, are normally sold from the developer’s own site. After you buy, you get an account there with three things in it: the zip file to download, a licence key, and your order history. The zip goes in through the upload option described in our post on installing a WordPress plugin, and the key goes into the plugin’s settings so it can receive updates.
Making sure it really is the developer’s site
Lookalike sites exist, so take a moment to confirm where you are buying.
- If the plugin has a free edition in the directory, open its listing and follow the developer’s link from there. That is the most reliable route to the real shop.
- Check the address bar carefully. A spelling slightly different from the brand name, or the plugin name sitting on an unrelated domain, is a warning.
- Be wary of any site selling many different companies’ premium plugins at a fraction of their normal cost. That is a reseller, not the developer.
- Pay with a business card in the business’s name, so the purchase is traceable and the receipt lands in a mailbox you control.
Marketplaces and bundled plugins
Some developers sell through a marketplace rather than, or as well as, their own site. Buying there is fine as long as it is the developer’s own listing. Downloads and licence keys then live in your marketplace account rather than on the developer’s site.
Premium themes sometimes arrive with paid plugins bundled inside, such as a slider or a page builder. Those copies are legitimate, but they often cannot be updated directly from the plugin’s developer, because the licence belongs to the theme author. Updates usually arrive when the theme author releases a new theme package. If a bundled plugin matters to your business, check how it gets updated, and consider buying your own licence for it.
A few developers publish plugins on GitHub or similar code-hosting sites. That can be perfectly safe if the repository is the developer’s official one and linked from their website. It is not safe if it is a stranger’s copy.
Plugins from outside WordPress.org that you should avoid
The risky sources share one feature: they offer someone else’s paid plugin without the developer’s involvement.
- “Nulled” or “cracked” downloads, where the licence check has been removed.
- “GPL club” or bundle sites that sell access to hundreds of premium plugins for one small fee.
- File-sharing links passed around in forums, groups or comments.
- A zip from someone you do not know, sent by email or chat, with no clear origin.
Even when the code in these copies is untouched, you get no updates from the developer and no support. Often it is not untouched. Hidden admin accounts, spam links and code that fetches instructions from another server are all common. Our post on why nulled plugins carry malware goes through what these copies tend to contain and how to check a site that has some. The short version: the money saved is small next to the cost of a cleanup.
Checking a zip before you upload it
When a plugin arrives as a file, a few quick checks are worth making:
- Confirm the source. You should be able to say exactly which account you downloaded it from.
- Look at the name. The zip and the folder inside it usually carry the plugin’s own name. A random string or an unrelated name is a reason to stop.
- Check the version. It should match the latest version listed on the developer’s site or changelog. An old copy means installing bugs that have already been fixed.
- Upload it as you received it. Unzipping and re-zipping can change the folder structure WordPress expects, so leave the file as the developer packed it.
- Back up first, then upload at a quiet time and check the site afterwards.
Keep the zip and the licence records
Buying a plugin is the easy part. Two years later, the hard part is answering simple questions: who bought this, with which email, and when does it renew? Keep a short record for every paid plugin and theme, stored where the business, not one person, can reach it:
| Record | Why you will want it |
|---|---|
| Plugin name and where it was bought | So you know which site to log in to |
| Account email and login | Downloads and renewals sit behind it |
| Licence key and the sites it is active on | Needed when you move hosts or rebuild |
| Purchase date, renewal date, invoice | For renewals, refunds and accounts |
| Who paid, and on which card | So a renewal does not fail quietly |
| A copy of the current zip | A clean reinstall if the site ever needs one |
A password manager shared with the business, or a document only owners can edit, both work. The point is that the information outlives any one developer or staff member. If a licence does lapse, dealing with an expired plugin licence covers what changes and what to do next.
If you are not sure where your plugins came from
Many owners inherit a site and have no idea how its plugins were obtained. The Installed Plugins screen gives a first clue: directory plugins normally show a View details link, while plugins from elsewhere usually show a Visit plugin site link instead, or nothing at all. For each premium plugin, look for a licence page in its settings and see whether a key is entered and active. Then ask whoever built the site for the purchase records.
A premium plugin with no licence, no account anyone knows about and no updates for a long time is worth replacing with a properly bought copy. For where this fits among the other plugin tasks, the overview of WordPress plugins for owners maps out the whole section.
Frequently asked questions
Is it safe to install a plugin zip my web developer emailed me?
It can be, if you know where it came from. Ask the developer which account it was downloaded from and whether the licence is in your business’s name. Better still, ask them to buy it on an account you own, so you can download future versions yourself and the licence stays with you if you change developers.
My theme came with a premium plugin included. Do I need my own licence?
Not to use it. The bundled copy is normally allowed under the theme’s licence. What you usually lack is direct updates and support from the plugin’s developer, so updates depend on the theme author. If that plugin runs something important, such as your page layouts, buying your own licence is worth considering.
Can I keep using a plugin after it is removed from the WordPress.org directory?
It will keep running, but you should find out why it was removed. Plugins are closed for different reasons, including security problems, guideline breaches or the developer’s own request. Until you know which applies, treat it as a plugin that may no longer get fixes and look for a maintained replacement.
Are free plugins from a developer’s website safe if they are not in the directory?
They can be, when the developer is established and the site is clearly theirs. You simply lose the directory’s listing, reviews and support forum as a check, and updates may come through the developer’s own system. Apply the same caution you would to a paid plugin bought from that site.
Inherited sites are where questionable copies tend to hide, because nobody remembers buying them. Going through an unfamiliar plugin list and flagging anything of doubtful origin is part of what our WordPress support service does.
Next in this series: Deactivate or Delete a WordPress Plugin? What Each Does
