> Turn on auto-update

Having been paid quite well to migrate to and from WordPress, and to help maintain the WP sites of major publishers, I have to say that this is questionable advice. In most cases in my experience, the publisher has employed third-party providers (at huge cost) to develop frameworks and custom plugins that can easily be broken by automatic updates.

Updates need evaluation and testing in staging sites before they can be rolled out. For publishers, the first install of WP is free - everything after that costs plenty.

Like you said, "major publishers" will have those problems due to custom code. Not the sort of websites where Wix or Squarespace would have ever even entered the conversation. You need to keep context in mind.

And not so major publishers, including hundreds, if not thousands in the top 10,000 sites. So it isn't just the Washington Post, et al. This is why I intervene on generalized advice to enable auto-updates on WordPress. I have seen it cause publishers a ton of money, and have lost a number of weekends when called in to perform damage limitation.

'Make sure you keep everything updated!' has a ton of caveats and pitfalls, that's just the reality.

How do you know if a plug-in is reputable without being neck deep in the ecosystem for a year talking to other devs?

I just make sure the install count is something high (if it is lower than say 100k, then probably there is a better plugin out there to do the job) and it has been updated in the past couple months, and it is compatible with the latest version of Wordpress. All that info is directly visible while you are searching for plugins within Wordpress itself on the search page itself. And typically I'll also do a Google search for whatever problem I'm trying to solve and make sure it's recommended by at least two people.

Btw, I'm a senior full stack software engineer. But for my digital media business I operate several Wordpress websites. I don't talk to any Wordpress devs and do any custom Wordpress theme or plugin development (aside from what is available in the GUI and extremely minor CSS tweaks).

Download count and reviews aren’t necessarily trustworthy though.

https://krebsonsecurity.com/2021/05/using-fake-reviews-to-fi...