A plugin update appears in your WordPress dashboard a little later than expected. Usually, delay sounds bad. This time it may mean several automated security checks are quietly poking at the new code before your site is even offered the update.
That’s good news.
Since June 5, every plugin and theme release submitted to WordPress.org has entered a cooldown period, currently six hours long. During that window, several AI models and Jetpack Scan inspect the changes. On September 9, the Plugins Team announced and launched automatic blocking for releases with high-risk results.
For a small-business owner, the useful part is simple: there is now another safety check between a developer publishing code and you seeing the familiar update badge. You don’t need to switch anything on. And you aren’t expected to sit beside the Update button for six hours.
What changed behind the Update button
New plugins were already reviewed before they first entered the WordPress.org directory. The gap came later. Once a plugin had been accepted, its subsequent releases didn’t pass through a consistent security-review step before distribution.
The WordPress Plugins Team explained the review system and launched automatic high-risk blocking in its official announcement on September 9. The six-hour cooldown and automated review had already been running since June 5. Every plugin and theme release waits there before WordPress.org distributes it through the update API, which powers update notices and one-click updates in normal WordPress dashboards.
While the release waits, multiple AI models examine the code changes and Jetpack Scan performs its own analysis. The findings are cross-checked, then combined into a security score. Since the September 9 launch, a high-risk result blocks distribution automatically and emails every committer attached to the plugin. Lower-risk releases continue normally after the cooldown.
One detail matters here: a high score measures risk. It doesn’t prove that a developer intended to ship malware. As the Plugins Team explains, an accidentally introduced vulnerability can score just as high as intentional malware. Humans can then investigate the release without treating the score as a verdict on someone’s motives.
Automated review has already caught a backdoor
This isn’t just a future promise. On July 28, the automated review detected and scored a backdoor in a release of an unnamed plugin with roughly 20,000 active installations.
Automatic high-risk blocking had not launched yet. The release remained inside the existing cooldown while Wordfence notified the Plugins Team, which manually closed the plugin 26 minutes later. It was never distributed through the WordPress.org update API, so thousands of dashboards weren’t offered that poisoned release through the normal update route.
That’s exactly what a supply-chain defence should do: catch the dangerous package upstream, before every individual shop owner has to spot it alone. We don’t know the plugin’s name, and guessing would be reckless. The meaningful fact is that the release didn’t escape the holding area.
No, your update click won’t take six hours
The wording can sound confusing. WordPress.org holds a release before offering it to sites. The cooldown does not begin when you click Update, and your dashboard isn’t supposed to show an available update then make you wait six hours for installation.
Imagine a plugin developer publishes version 4.2 at midday. WordPress.org keeps that release back while the checks run. Your site may continue showing version 4.1 as current during that time. Once 4.2 clears the cooldown, it becomes available through the update API and your normal update process can begin.
If a developer says an update is released but WordPress doesn’t show it yet, the safety process may explain the gap. Don’t hunt for a ZIP in a random email thread just to save a few hours. Our guide to fake plugin and theme updates explains why that shortcut can end very badly.
A stronger gate, not a magic shield
I like this change. It reduces a real supply-chain risk without giving site owners another complicated panel to configure. But it doesn’t make every WordPress update safe.
Automated analysis can produce false positives, and the announcement doesn’t claim every vulnerability will be detected. A release can also be legitimate and still break your checkout, conflict with a theme, or change how a form behaves. Security review and compatibility testing are different jobs.
The announcement describes releases distributed through the WordPress.org update API. So, as a scope deduction, releases distributed outside that API are outside this gate. That includes:
- premium plugins delivered only through a vendor’s own update server;
- ZIP files uploaded manually from email, chat, or a shared drive;
- plugins installed directly from GitHub or another code repository;
- pirated or nulled themes and plugins.
It also doesn’t clean a site that’s already compromised. If an attacker is already modifying files or creating admin users, a safer future plugin release won’t remove them. A WordPress vulnerability scanner can help identify known vulnerable versions on your site, while the Bearmor Security plugin adds monitoring and protective controls. Neither turns one automated result into a guarantee. Layered checks still matter.
What site owners should do now
You don’t need a dramatic new procedure. Keep the habits that already reduce risk, and treat the cooldown as a welcome extra layer.
- Prefer official sources. Install free plugins from WordPress.org and premium plugins from the real vendor. Don’t sideload a surprise ZIP sent through email or chat.
- Keep updating. The new review is not a reason to leave known vulnerabilities sitting on your site for weeks.
- Keep tested backups and monitoring. An update may be secure yet still break a payment flow or layout. You need a way to notice trouble and recover.
- Remove unused plugins. Deactivated clutter still becomes old software you have to track, and abandoned tools don’t improve while they gather dust.
- Check premium updates separately. Vendor-only releases distributed outside the WordPress.org update API are outside this gate, so confirm the source, licence status, changelog, and support channel.
- Stage risky updates. Test big WooCommerce, booking, membership, payment, or page-builder releases away from the live site first.
If you want a repeatable routine, follow our steps for safely updating WordPress plugins and themes. For owners who’d rather have someone handle backups, testing, updates, and checks, regular WordPress maintenance keeps those jobs from becoming a rushed Friday-afternoon gamble.
Six quiet hours are a fair trade
WordPress.org now has a stronger chance to stop a dangerous release before it fans out across thousands of sites. The July case showed that automated review could flag a backdoor during the cooldown; Wordfence then notified the Plugins Team, which manually closed the plugin. The September 9 launch adds automatic blocking for future high-risk results.
The announcement doesn’t promise that every vulnerability will be found. Premium and manually uploaded code sits outside this system, and even a release passing below the blocking threshold says nothing about whether version 4.2 will annoy your checkout page. So keep backups, monitoring, source checks, and staging.
But if a plugin release takes six extra hours to appear, don’t grumble too loudly. Somewhere in that quiet window, the update is getting a closer look before it reaches your business. That’s time well spent.