Before installation

• Download from an official source and verify the publisher

• Read changelog and release cadence

• Check WordPress, PHP and WooCommerce compatibility

• Review privacy, telemetry and external services

• Inspect capabilities and written data

• Back up and test in staging

Warning signs

• Unverifiable forwarded ZIP files

• Claims of 100% security or automatic fixes for everything

• No version, changelog or licence

• Administrator access or API keys beyond the task

• Unexplained data or scheduled jobs left after deactivation

After installation

Observe network requests, scheduled tasks, database growth and error logs. Update one component at a time with a rollback point.