Key takeaways
- Install plugins for clear needs only: SEO, backups, security, caching, forms, and anything your business specifically requires.
- Plugin quality matters more than quantity — one bad plugin can slow or compromise the whole site.
- Review plugins every few months and remove what you don’t use.
There are over 60,000 free plugins in the WordPress directory, and it’s tempting to install one for every idea. But each plugin adds code to maintain, potential conflicts and security risk. Here’s the essential toolkit I use as a starting point, and the plugin types I avoid.
The essential categories#
| Need | Popular options | Notes |
|---|---|---|
| SEO | Rank Math, Yoast SEO, SEOPress | Skip if your theme handles SEO (this one does) — see Yoast vs Rank Math |
| Backups | UpdraftPlus, BlogVault, host backups | Off-site storage is essential — see backup guide |
| Security | Wordfence, Solid Security, host-level firewalls, Cloudflare | Plus 2FA — see security guide |
| Caching / performance | LiteSpeed Cache (LiteSpeed servers), WP Rocket, FlyingPress, host caching | Use one, not several |
| Image optimisation | ShortPixel, Imagify, EWWW, Converter for Media | Converts to WebP/AVIF and compresses |
| Forms | Fluent Forms, WPForms, Contact Form 7, Gravity Forms | This theme has a built-in contact form with captcha |
| SMTP email | FluentSMTP, WP Mail SMTP | Makes form emails reach the inbox |
| Redirects | Redirection | Logs 404s too — see redirects guide |
| Anti-spam | Akismet, Antispam Bee | For comments |
| E-commerce | WooCommerce | See WooCommerce setup |
How to judge a plugin before installing#
- Updated within the last few months and tested with the current WordPress version.
- Many active installs and good recent reviews.
- Responsive support forum with resolved threads.
- Does one job well, rather than 30 features you won’t use.
- Doesn’t load its CSS/JS on every page if it’s only needed on one.
- Clean uninstall (removes its data if you ask).
- Never “nulled” premium plugins — they commonly contain backdoors.
Need a hand with this?
Get a quick, honest review of your website’s SEO.
Plugins I usually avoid#
- Multiple overlapping performance plugins — they conflict and double-minify.
- Heavy sliders — slow and rarely improve conversions.
- Social share plugins with external scripts — simple share links work fine (like the ones on this site’s articles).
- “All-in-one” toolkits that bundle dozens of modules you don’t need.
- Plugins for tiny code tweaks — a few lines in a child theme or a code snippets plugin is lighter.
- Abandoned plugins — no updates for a year or more.
How many plugins is too many?#
There’s no magic number. Twenty well-built plugins can be faster than five bad ones. Measure instead: use Query Monitor to see slow database queries and hooks, and PageSpeed Insights to see what each page loads.
Maintenance routine#
- Back up before updates.
- Update on staging first for important sites — see staging guide.
- Update plugins one at a time and check key pages, forms and checkout.
- Every quarter, deactivate and delete plugins you no longer use.
WordPress plugins FAQ#
Do plugins slow down WordPress?#
Poorly built ones do. Well-built plugins have little impact. Test after installing.
Should I enable automatic plugin updates?#
For small, well-maintained plugins and security fixes, yes. For major plugins like WooCommerce or page builders, test updates first.
Are free plugins safe?#
Plugins from the official directory with active maintenance are generally safe. The risk comes from abandoned or pirated plugins.