Essential WordPress Plugins

Four jobs, then stop. A new WordPress site needs backups, security, performance and a way to collect enquiries. Everything after that should have to argue for itself, because every plugin is a permanent obligation: another update path, another way to break, another author who might stop.

The useful question is never "what are the top plugins" but "what job is not currently being done".

The four that earn their place immediately

Backups. The one non-negotiable. Off-site, automatic, and restorable by you — a backup you have never restored is a hypothesis. Many hosts include this; check whether you can restore it yourself before adding a plugin. See backup plugins and how to back up a WordPress site.

Security. Login rate limiting and monitoring, and above all two-factor authentication. Note the order: updates and 2FA prevent far more than a plugin's firewall does. Security plugins covers what the paid tiers add.

Caching. Unless your host already caches at the server level, in which case adding a second page cache makes things worse rather than better — choosing a cache plugin starts with exactly that check.

A form. Almost every site needs a way to be contacted that is not a mailto link. Contact form plugins.

That is the whole list. A site with those four covered is in better shape than most sites with thirty plugins.

Then, only if the site needs it

Each row is a real need for some sites and dead weight for others. Install when you hit the need, not in anticipation of it.

Check what core already does

A surprising share of the plugin market duplicates something WordPress ships with. Before installing, confirm you actually need it:

• XML sitemaps — core generates them.
• Image sizes and lazy loading — core does both.
• Galleries, buttons, columns, embeds, tables of contents — all core blocks now, which is most of what old "essential plugins" lists were for. See what is a block in WordPress.
• Application passwords for API access — core.
• Automatic updates for core, plugins and themes — core.
• Site Health, which reports most configuration problems — core.

How to judge one before installing

Five checks, two minutes:

1. Last updated, and the WordPress version it is tested against. Over a year is a risk.
2. Active installations and recent reviews — specifically the one-star ones, which describe the failure modes.
3. Support forum activity. Are questions answered by the author?
4. What it loads on the front end. A plugin that only runs in the admin costs visitors nothing.
5. How it stores data. A plugin that creates its own tables and its own post types is harder to remove later.

Then install it on a staging copy first, especially anything touching caching, security or the checkout. The wider discipline is in how to update WordPress plugins safely.

Removing is as valuable as adding

Every audit finds the same things: plugins nobody uses, two plugins doing one job, and a plugin left deactivated for two years.

• Deactivated is not removed. Its files are still on disk and still a vulnerability if it has one. Delete it.
• Two plugins with the same job is worse than either alone — two page caches fight, two SEO plugins emit two canonical tags.
• Uninstall properly, because many plugins leave tables and options behind: how to delete a WordPress plugin completely.
• Audit annually, alongside the licence renewals you are paying for — what a WordPress site costs.

Common mistakes

• Installing a list. A "top 20 plugins" article is not a requirements document for your site.
• A security plugin instead of updates. The order is backwards, and it is the most common version of this mistake.
• A caching plugin on a host that already caches, producing stale pages nobody can explain.
• Two form plugins, because the first one was never removed.
• Installing for a feature core added two years ago.
• Free tiers of five commercial plugins, each nagging for an upgrade on every admin page.

If something breaks

Assume a plugin conflict before assuming anything else — it is the single most common class of WordPress fault. Deactivate all, confirm the problem goes, then reactivate in batches: how to fix plugin conflicts in WordPress. With SSH available the whole loop is faster from the command line — WP-CLI commands worth knowing.