Get plugins from the CMS's official directory or the vendor, and check the licence, who maintains it, when it was last updated, which core and PHP versions it supports, and whether security fixes are covered. Confirm in writing what a licence bundles and what costs extra. Remove anything unused.
From the original phpWordPress forum · archived copy
a forum member ·
I purchased the full Developer package in April, how do I get the free plug-ins? Couldn't see them in the package. Contact Builder module Automatic Google SiteMap generation module Automatic Link directory module
phpWordPress staff (Product Line Manager) ·
Those should be wrapped in the bundle you got. If you're sure you don't have them, just send an email to support guys, and you'll get download links in a second...
a forum member ·
No, not there, it was a custom package. I'll contact support, thanks
View the archived thread on the Wayback Machine. Usernames and contact details have been removed.
In 2006 a customer who bought a developer package could not find three plug-ins the vendor had promised with it: a contact builder, a Google sitemap generator and a link directory module. The vendor said they should be in the bundle and offered download links on request. The same questions come up now: where do plugins come from, what does a licence include, and how do you judge one before installing it?
Where do CMS plugins come from?
Every large CMS has an official place to start, plus commercial vendors outside it.
| CMS | Official source | What the documentation says |
|---|---|---|
| WordPress | WordPress.org plugin directory | Describes itself as the largest directory of free and open source WordPress plugins |
| Drupal | Drupal.org project pages | Recommends installing modules with Composer, especially those with dependencies |
| Joomla | Joomla Extensions Directory | Lists extensions by category, with Top Rated and Most Reviewed views |
Commercial plugins are sold by their developers, often outside these directories. WordPress hardening documentation advises getting plugins and themes from the official repository or established companies rather than untrusted sources. Treat a premium plugin offered free on a third-party download site as unverified code and avoid it.
What is bundled and what costs extra?
The 2006 thread shows why this needs to be written down. A bundle’s contents depend on the order, and a custom package may differ from the standard one. Before you pay, ask:
- Which plugins are included, and for how long do you receive updates?
- Is support for them included, or only the download?
- Does the licence cover one site or many?
- What happens to the plugins if you stop paying?
Keep the answers with the invoice. If a promised plugin never arrives, the thread’s outcome is the right model: the customer contacted support, quoted what was in the package and asked for the links. Do the same, and keep the dated reply so a later dispute has a paper trail. Our licensing guide and cost guide cover the wider picture.
How do I check a plugin’s licence?
Most plugins for the major open-source CMSs are GPL. Drupal’s licensing page says modules and themes are derivative works of Drupal and, if distributed, must be under GPL version 2 or later. WordPress guideline 1 requires everything in its directory to comply with the GPL or a GPL-compatible licence.
What the WordPress directory does forbid is locked features. Guideline 5 says plugins may not contain functionality restricted or locked until you pay or upgrade. So a free directory plugin cannot hold back features behind a payment wall, but a vendor may still sell a separate paid version elsewhere, so read the terms of any paid add-on.
How do I judge whether a plugin is maintained?
Use signals you can verify. None is conclusive alone.
| Signal | Where to look | What it suggests |
|---|---|---|
| Compatibility fields | WordPress readme headers: Tested up to, Requires at least, Requires PHP | The author states which versions it was tested with |
| Current release | Stable tag and changelog | Whether releases continue |
| Security coverage | Drupal’s security advisory coverage note on the project page | The security team publishes advisories for it |
| Opt-in conditions | Drupal requires the vetted role, a full project and no open security-tagged issues | A minimum quality bar for coverage |
| Reviews | Joomla Extensions Directory ratings and reviews | Other users’ experience, which varies in quality |
| Upgrade readiness | Joomla asks you to check all extensions before moving to Joomla 6 | Whether the developer has released a compatible version |
Also read the issue tracker and support forum. A plugin with many unanswered reports is a warning even if it was updated last month.
What security rules apply?
Two points from the documentation matter most.
First, responsibility sits with the developer, and the directory can pull a plugin. WordPress guideline 2 says it is the sole responsibility of developers to ensure their files comply with the guidelines, and guideline 18 reserves the right to remove any plugin. A listing is not an audit.
Second, your own housekeeping counts. WordPress hardening documentation says to keep plugins updated and delete any you are not using. Apply the same to Drupal modules and Joomla extensions. Remove, not just deactivate, the ones you do not need.
Privacy is part of vetting. Guideline 7 says plugins may not contact external servers without explicit and authorised consent. Check what a plugin sends and where, especially analytics, comment and advertising add-ons on a publisher’s site.
What should a news site look for?
Publishers have specific needs. Check that a plugin does not slow article pages, does not inject links or ads you did not choose, and keeps working when you edit templates. For features like sitemaps, structured data and newsletter signup, compare two or three options and run them on a staging copy first. See our testing approach for what we do and do not verify ourselves.
How do I add and remove plugins safely?
- Install on a staging copy first.
- Take a backup before adding anything to production.
- Record the plugin name, version, source and licence in your inventory.
- Test publishing, templates and performance with it enabled.
- Review the list at each CMS upgrade, because the upgrade guide shows major versions often break extensions.
This page summarises vendor documentation; Word & Press has not tested the plugins or directories it names.
Questions people ask
Where should I download CMS plugins from?
Start with the CMS's official directory: WordPress.org for WordPress, Drupal.org for Drupal, and the Joomla Extensions Directory for Joomla. For commercial add-ons, buy from the vendor's own site. Avoid copies on third-party download sites, which may be altered.
Are free plugins safe to use on a news site?
Free does not mean safe or unsafe. Check the licence, when it was last updated, which versions it supports, and who maintains it. Drupal marks projects covered by its security team. WordPress documentation advises keeping plugins updated and deleting ones you do not use.
What should I do if a bundled plugin is missing from my licence?
Ask the vendor in writing, quoting the order or licence terms, and request the download link and version. If the package was custom, say so. Keep the reply. If the vendor cannot supply it, ask for the feature to be delivered or the price adjusted.
How many plugins is too many?
There is no fixed number, but each plugin is extra code to update, test and secure. WordPress hardening documentation says to delete plugins you are not using. Choose one maintained plugin per job and review the list at every upgrade.
Sources
- The WordPress.org plugin directory describes itself as the largest directory of free and open source WordPress plugins. — source, checked 10 October 2026.
- WordPress plugin guideline 1 states that all code, data and images stored in the plugin directory hosted on WordPress.org must comply with the GPL or a GPL-compatible licence. — source, checked 10 October 2026.
- WordPress plugin guideline 5 states that plugins may not contain functionality that is restricted or locked, only to be made available by payment or upgrade. — source, checked 10 October 2026.
- WordPress plugin guideline 7 states that plugins may not contact external servers without explicit and authorised consent. — source, checked 10 October 2026.
- WordPress plugin guideline 2 states it is the sole responsibility of plugin developers to ensure all files within their plugins comply with the guidelines, and guideline 18 reserves the right to disable or remove any plugin from the directory. — source, checked 10 October 2026.
- WordPress plugin readme.txt files carry header fields including Tested up to, Requires at least, Requires PHP and Stable tag, which describe the latest WordPress version tested, the minimum WordPress and PHP versions needed, and the current release. — source, checked 10 October 2026.
- WordPress hardening documentation says to make sure your plugins are always updated, to delete any plugin you are not using, and to obtain plugins and themes from the official WordPress.org repository or established companies rather than untrusted sources. — source, checked 10 October 2026.
- Drupal's security advisory policy says stable releases of covered projects display a note that they are covered by the security advisory policy, and covered means the Drupal Security Team issues public announcements about vulnerabilities and keeps them confidential until a fix is ready. — source, checked 10 October 2026.
- Drupal project maintainers opt in to security advisory coverage by meeting conditions including having the vetted role, being a full project rather than a sandbox, and having no open issues tagged as security. — source, checked 10 October 2026.
- Drupal's licensing page states that Drupal modules and themes are a derivative work of Drupal and, if distributed, must be distributed under GPL version 2 or later. — source, checked 10 October 2026.
- Drupal's module installation documentation says the recommended way of adding a module is with Composer, especially for modules that have dependencies. — source, checked 10 October 2026.
- The Joomla Extensions Directory lists extensions by category and offers Top Rated and Most Reviewed browsing. — source, checked 10 October 2026.
- Joomla's 5 to 6 guide says to check all extensions for compatibility with Joomla 6 and to disable the Behaviour - Backward Compatibility plugin in order to upgrade. — source, checked 10 October 2026.