Audit your WooCommerce store's plugins: versions and updates

See every WordPress plugin on your WooCommerce store, active or not, with installed and latest versions — the inventory the store's sales views never show.

If you sell on WooCommerce, your store is a WordPress site, and the list of plugins installed on it is the part of the business nobody in operations ever looks at. AxisIQ shows it: connect the store once, and you get every installed plugin — active and inactive — with its installed version beside the latest release, its state and its author. AxisIQ does not match those versions against vulnerability advisories; it gives you the inventory every security review starts from, on a screen your team already opens. This guide walks the whole check: the first pass takes a few minutes, and every one after it is a single screen.

It belongs on the dashboard you already use because the commerce side of the store shows you orders, customers and revenue. The plugin screen sits behind a WordPress login that most operations teams do not have and never open. So a plugin three releases out of date — or one nobody remembers installing — can sit under your checkout for a year while the people who look at that store every single day are never shown it once.

What you will have at the end

  • A WooCommerce store connected to your workspace, with its credentials encrypted at rest and proven against the live store before they were saved.
  • A Plugins view listing every plugin the store has installed, with its version, the latest available, active or inactive state, and author.
  • A short list of plugins to update or delete, and a check any non-developer on your team can repeat from the same screen.

What you need

  • A WooCommerce store served over https. The store keys travel in the request, so a plain http address is rejected when you save the connection.
  • REST API keys from the store — a consumer key and secret, created in WooCommerce under its advanced settings. Read access is enough: everything described here reads, and nothing in this guide writes back to your site.
  • Permission in your workspace. Connecting a store and reading through a connected store are deliberately separate grants, so a person can be allowed to see that a store is attached without being allowed to read the store itself. See permissions.

Step 1 — Connect the store

In the Marketplaces app, add a connection: pick WooCommerce, name it something your team will recognise, paste the store URL and the two keys.

AxisIQ makes a live call to the store before saving anything. If the keys are wrong, the URL is wrong, or the store rejects the request, you find out on this screen instead of discovering a dead connection weeks later. Once saved, the keys are stored encrypted and nothing in the product will show them to you again — a secret you can read back is a secret that can be copied. Editing the connection later merges your changes over what is stored, so renaming it never means pasting the secret again, and an edit the store rejects is not saved at all.

More on how connections work: Integrations.

Step 2 — Open the store, then the Plugins collection

Opening a connection gives you the store's own workspace — its profile, its recent trading, and one entry per collection the store can serve. For a WooCommerce connection, one of those is Plugins.

The columns are Plugin, Version, Latest, State and Author, in alphabetical order.

Two things about this list are worth knowing. It merges active and inactive plugins into one view, because a deactivated plugin is still code sitting on your server. And it is the complete inventory rather than one page of it, which is why searching here genuinely searches everything installed instead of filtering the rows that happen to be loaded.

Step 3 — Compare Version with Latest

The useful reading is the gap between the two version columns. Where Version trails Latest, the plugin has an update waiting, and the further behind it is, the more fixes you are missing. Version ordering follows WordPress rules, so 1.10 is newer than 1.9 — the comparison that catches people out when they do this by eye.

AxisIQ does not tell you whether a particular version has a published vulnerability. For that, look the plugin and version up in a vulnerability database or a WordPress security service; this list tells you exactly which plugins and versions to look up.

Step 4 — Fix in this order

  1. Active and out of date. Update it. The row links straight to your WordPress plugins screen, because installing an update is WordPress's job and AxisIQ deliberately does not write to your store.
  2. Inactive. Delete it rather than leaving it deactivated. Inactive code is still deployed code, still on disk, and still reachable if something else on the site goes wrong. A plugin you are not using is not a plugin you need to keep.
  3. Active and current, but unrecognised. Ask who installed it and why. A plugin nobody can account for is worth removing.

Then reopen the view. Every read here goes to the live store, so what you see is the store's current state rather than the results of a scan someone ran last month.

Step 5 — Make it a habit, not a project

There is no alerting on this today and no scheduled scan — it is a view you open. That is worth stating plainly rather than implying a watchdog that does not exist.

So put it in an existing rhythm. Whoever already opens the store workspace to look at last week's trading can spend one more minute on the Plugins list. Monthly is a reasonable floor; after any burst of plugin installs is better. For a D2C brand where the storefront is the whole business, make it part of whatever review already happens before a sale or a campaign, when traffic and stakes both go up.

If you want the store doing more than being read — orders pulled in, stock pushed back — there is no sync engine here to switch on. You write that yourself as a function that calls the store's API and run it on a schedule with Flows. Same connection, though writing to the store needs keys with write access rather than the read-only pair above.

What this check does not cover

Being straight about the boundaries, because a security tool that oversells itself is a liability:

  • Plugins only. Not themes, not WordPress core, not the server underneath. Those matter too and are not in this view.
  • No vulnerability matching. The list shows versions, not verdicts. Checking a version against published advisories is a separate step, with a security service or vulnerability database.
  • A custom or private plugin may show no newer release even when one exists, so an out-of-date copy will not stand out. Your agency's bespoke plugin is exactly the code nobody else has audited.
  • A modified copy of a public plugin reports its original version, so the version columns say nothing about what was changed.
  • WooCommerce only. Shopify stores connect and browse the same way, but their installed apps are not exposed for this kind of check.

None of that makes the list less useful. It makes it a first pass — the same list a security review would ask for on day one, on a screen your team already has open.

FAQ

Does AxisIQ scan my WordPress site? No. It reads the plugin inventory your store reports through its own REST API, using the keys you provided. Nothing is installed on the site and nothing is crawled or probed — the only traffic is that ordinary API read.

Does my plugin list get sent anywhere? No. AxisIQ reads it from your store when you open the view and sends it nowhere else — there is no third-party lookup.

Does AxisIQ tell me which plugins have known vulnerabilities? No. It shows every plugin with its installed and latest version, which tells you what is out of date. Matching versions against published advisories is a job for a WordPress security service or vulnerability database.

Should I delete a vulnerable plugin or just deactivate it? Delete it if you are not using it. Deactivating removes it from the running site but leaves the code on the server, which is why the list shows inactive plugins alongside active ones.

Can I check a Shopify store the same way? No. Shopify does not expose its installed apps in a comparable way, so this view is specific to WooCommerce. Shopify connections still get store profile, trading figures and catalogue browsing.