Ownership change
The listed author or contributor list no longer matches the stored snapshot. A dropped original author means the handover is already complete.
Know who controls your WordPress plugins
Touchstone reads the public WordPress.org directory and the public plugin SVN repository, and tells you when a plugin on your site changes hands.
- Free and GPLv2
- No telemetry, no licence check
- Runs entirely on your own site
Nobody reviews a change of ownership
When a plugin is sold, WordPress.org performs no audit and sends no notification. The new owner inherits commit access, and their first release reaches every site running it through the ordinary update channel.
In April 2026 the WordPress Plugins Team closed 31 plugins at once. A single buyer had acquired the portfolio through Flippa, planted a backdoor across all of them, and waited. Most of those sites were running a vulnerability scanner the entire time, and a scanner has nothing useful to say about a plugin whose code has not turned malicious yet.
A transfer is not an attack. It is the window in which one becomes possible — and the only moment at which you still get to choose.
- 31
- Plugins closed by the WordPress Plugins Team on 16 April 2026
- 8
- Months the backdoor sat dormant after being planted in August 2025
- 1
- Buyer, one Flippa listing, and the whole portfolio’s commit access
- 0
- Notifications WordPress.org sends when a plugin changes hands
A provenance record for every plugin you run
Three steps, once a day, entirely from public sources.
1
Baseline
On the first scan it inventories every installed plugin and reads back up to 200 commits of SVN history, recording each committer with their first and last revision.
Recorded plugin-slug · committer-a r1–r2981 · committer-b r302–r2104
2
Compare
Every day it re-reads both public sources and diffs them against the stored record. A name that was not there before is the signal; five rules decide what kind of signal it is.
Changed author replaced · +1 unseen committer at r2982
3
Decide
The trust score moves, the plugin rises to the top of the list, and an admin notice appears for a high-severity finding. You acknowledge it, mute the plugin, or go and look.
Scored trust 94 → 61 · band ok → watch
Scans run on WP-Cron, ten plugins at a time, never during a front-end request. Your visitors never touch this code.
Five rules
Each one watches a trust boundary, and fires before any payload can ship.
New committer
A previously unseen SVN username has committed for the first time. This is the event that precedes a payload, usually by weeks or months.
Dormant then active
180 days of silence followed by a commit. Escalates when it lands alongside an ownership change or a new committer.
Abandoned or withdrawn
No update in 365 days, escalating past 730 — and fires again if the plugin is removed from the directory entirely.
Unknown origin
The plugin is not in the directory, so it has no public history and cannot be monitored. It is listed as a blind spot rather than given a grade it has not earned.
One number a client can understand
Every plugin carries a deterministic score from 0 to 100. Same inputs, same score, with nothing you cannot explain to the person paying the invoice.
- Time-decaying
- A deduction applies in full for 90 days, at half weight to 180, then expires.
- Acknowledgement-aware
- An event you have reviewed and accepted deducts nothing.
- Mute-aware
- A muted plugin is still scored, just kept out of the default view and out of your inbox.
0/100
Band boundaries are fixed and published.
- Risk 0–49
- Watch 50–79
- OK 80–100
Five screens, inside the admin you already use
No new dashboard to log into, and nothing for your client to learn.
- Inventory sorted by risk, so the plugin that needs you is first
- The full committer timeline for every directory plugin
- Acknowledge or mute in one click, per event or per plugin
- CSV export, for the report a client actually reads
Everything it knows is public. Everything it sends is a slug.
There are no certifications on this page because there are none to show. Here is the whole mechanism instead.
The only two endpoints it contacts
- api.wordpress.org/plugins/info/1.2/
- Listed author, contributor list, last update date.
- plugins.svn.wordpress.org/
- Public commit history — who committed, and when.
A plugin slug is the only thing sent to either. Open them in a browser and you will see exactly what the plugin sees.
What it refuses to do
- Block, delay or modify an update
- Scan your code for malware
- Check for known vulnerabilities — keep your scanner
- Send telemetry, analytics or a licence check
GPLv2, so the source is in front of you. The free build contains no licensing code at all.
Detection is free, and stays free
Every rule, every score, every screen, on every site, with nothing held back to sell you later.
Free
Available now
$0forever
- All five detection rules
- Trust score for every plugin
- Five admin screens and a dashboard widget
- Events log with CSV export
- Opt-in email digest
- Ten documented extension hooks
Pro
In development
$59/yr, 5 sites
- Update quarantine — hold an update when the score has just dropped, until a human approves it
- Policy gates
- Trust timeline
- Release diff
Agency
In development
$179/yr, 25 sites
- Everything in Pro
- Fleet dashboard across every site you manage
- White-label client reports
- Outbound host baseline
Pro and Agency are planned, not purchasable. Neither has shipped, and neither will ever live inside the free plugin — WordPress.org forbids paywalls in a hosted plugin, which is why the free build carries no licence code at all.
Questions worth asking first
They detect known vulnerabilities and malware signatures, which means something bad has already been written. Touchstone detects the trust-boundary event — an ownership transfer, a new committer — that precedes it. They work a different layer of the same problem, so run them alongside this rather than instead of it.
Manually: open the plugin’s WordPress.org page, read the listed author and contributors, then open its SVN development log and compare the committer usernames against what you saw last time. That works for one plugin, once. Touchstone does it for every plugin on your site, every day, and tells you only when something changed.
No. Scans run on WP-Cron in small batches, ten plugins per tick by default, with API responses cached for twelve hours, so nothing is ever fetched during a front-end page load and the plugin produces no public-facing output at all.
Plugin slugs, to api.wordpress.org and plugins.svn.wordpress.org. That is the complete list. No telemetry, no analytics, no phone-home, no licence check. It is disclosed in the readme under External Services, and you can verify it in the source.
Not in the free plugin, and that is deliberate — it observes, it does not intervene. Update quarantine is the anchor feature of the planned Pro add-on, which would hold an update for review after a trust event fires. It has not shipped.
Most are, yes. So you acknowledge it once and it deducts nothing from the score ever again, or you mute the plugin entirely. Staying quiet until something genuinely changes is the whole design — an alert you learn to ignore is worse than no alert.
They have no public commit history, so they cannot be monitored. They are listed as unknown origin and counted as a blind spot rather than given a grade they have not earned.
One of your plugins has already changed hands
Touchstone is finished and in review at WordPress.org. When it lists, it will find yours within a day.
Coming soon to WordPress.orgFree and GPLv2. Requires WordPress 6.2 and PHP 7.4 or newer.