Health Check, in the Admin Dashboard, warns against keeping inactive plugins.   But increasingly, in a variety of ways, this is quite useful.  In the old days, plugins were managed by labor-intensive methods, which incidentally resulted in local archives, along with local means of viewing and editing code. Nowadays these methods are mostly gone, and along with them, most of the infrastructure to support local management. It was error-prone, too.

What we have today instead, is a much-better developed WordPress Admin, with additional plugins to further-enhance plugin-management tasks. Plugins must often  for example be compared; this means having two or more

It is said that having these inactive plugins on your site is a security issue.  But, they update just like the active plugins. They all come from the same wonderful WordPress Repo. Arguably, even, Active plugins can often be detected from their effects, in the Live website … making them potentially more of an exposure than the less-visible inactive ones!

You should prevent others from viewing the plugin directory. Depending on how your website server is set up, it is perfectly ordinary to type in www.yoursite/wordpress/wp-plugins, and get a nice listing of all the plugins you use. There are several other core WordPress directories, none of which should be accessible to the public, and all of which often are by default.

Get a Plugin to plug this security hole! For example

While you’re at it, learn about Linux/Apache (Server) Permissions. These are half-a-handful of litte Commands that can be Set. They guard access to the inner workings of a website. Sometimes the guard has to be lowered, in order to do something, and then it doesn’t get put back in place. Sometimes, another piece of software relaxes the setting