Active installs, last-updated date, WP version compatibility. Six months unupdated + under 1k installs = pass.
A backup taken today, verified restorable. No backup, no install — that's the rule.
Most hosts offer one-click staging. Two minutes there beats an outage on production.
Test the homepage, one inner page, checkout/contact flow — plugin conflicts show up where you're not looking.
Deactivate and delete via admin; if white-screened, rename the plugin folder via FTP/file manager to disable it.