WP Plugin Freshness Audit

=== WP Plugin Freshness Audit === Contributors: moxieworks Tags: plugins, maintenance, audit, stale, outdated, security, updates Requires at least: 6.4 Tested up to: 6.6 Requires PHP: 8.0 Stable tag: 1.0.0 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html

Surfaces stale and outdated plugins in wp-admin. Flags any plugin not updated in 12+ months via the WordPress.org Plugin API.

== Description ==

WP Plugin Freshness Audit adds a Freshness Audit page under the Plugins menu. It queries the WordPress.org Plugin API for each installed plugin and reports the last-update date and days elapsed, highlighting any plugin not updated in the past 365 days with a Stale badge.

What it shows:

• Every installed plugin with its current version
• Last-updated date sourced from WordPress.org
• Days since last update
• Status badge: Stale (≥ 365 days), OK (< 365 days), or Not on WP.org (commercial / custom)

Key facts:

• No external calls on the front end — all API lookups happen inside wp-admin only.
• Results are cached per-plugin for 24 hours. A one-click Clear Cache & Refresh button forces an immediate re-fetch.
• Plugins not found in the WordPress.org repository are marked Not on WP.org — they could be premium or custom plugins and are not marked stale by default.
• Filter to show stale plugins only with the Stale Only toggle.
• No JavaScript, no database tables, no REST endpoints, no telemetry.

Why this matters:

Stale plugins are a leading attack vector in WordPress sites. If a plugin hasn't been updated in over a year, it may no longer receive security patches. This plugin gives you a fast, at-a-glance audit without leaving your dashboard.

== Installation ==

1. Upload the wp-plugin-freshness-audit folder to /wp-content/plugins/.
2. Activate the plugin through the Plugins screen in WordPress.
3. Navigate to Plugins → Freshness Audit to see your audit report.

The page loads cached data on first visit. Subsequent visits within 24 hours show cached results; use Clear Cache & Refresh to force a live re-check at any time.

== Frequently Asked Questions ==

= The page takes a while to load on first visit. Is that normal? =

Yes — on first load, the plugin queries the WordPress.org API for each installed plugin in sequence. Results are cached for 24 hours, so subsequent visits load instantly. If you have many plugins (30+), the first load may take 10–20 seconds.

= Some of my plugins show "Not on WP.org". Should I be worried? =

Not necessarily. Premium plugins, custom-built plugins, and plugins installed from GitHub are not listed on WordPress.org, so no last-update data is available. Check the vendor's own changelog or release notes to assess freshness.

= What does "Stale" mean exactly? =

A plugin is marked Stale when the WordPress.org-reported last-update date is 365 or more days in the past. This is a signal to investigate — it doesn't automatically mean the plugin is insecure, but abandoned plugins often stop receiving security patches.

= Can I change the stale threshold? =

Not via the UI in v1.0.0, but you can filter the constant:

add_filter( 'wpfa_stale_days', fn() => 180 ); — coming in v1.1.0.

= Does this plugin affect the front end? =

No. All hooks (admin_menu, admin_init) fire exclusively inside wp-admin. No code runs on public-facing pages.

= Is there a WP-CLI command? =

Not in v1.0.0. CLI support is planned for v1.1.0.

== Screenshots ==

1. Freshness Audit table showing a mix of Stale, OK, and Not-on-WP.org plugins.
2. Stale Only filter showing only plugins flagged as stale.
3. Plugins menu entry under Plugins → Freshness Audit.

== Changelog ==

= 1.0.0 =

• Initial release.

== Upgrade Notice ==

= 1.0.0 = Initial release — no upgrade steps required.