The best of all WordPress plugins is often the one you don’t install. The official directory offers more than 76,000 free ones, and there is one for everything: a slideshow, a back-to-top button, a popup that appears after ten seconds. Each one is code you will have to update, monitor and sometimes pay for every year. So we install as few as possible, and we build the rest into the theme.
Why we count plugins
Security first. Patchstack, which tracks WordPress vulnerabilities, counted 11,334 new vulnerabilities affecting WordPress, its plugins or its themes in 2025. 91% were in plugins, 9% in themes, and only six in WordPress itself. Almost half had no fix available when they were made public. Every plugin you don’t have is one less way in.
Speed next. Many plugins load their scripts and styles on every page of the site, even when they are only used on one. The form on the Contact page ends up weighing on the home page.
And maintenance. A plugin updates on its own schedule, not yours. An update can conflict with another plugin, or with the theme. The more you have, the more possible combinations there are.
On the sites we build, that usually means six to eight plugins for a business website, and up to about twenty for a complex site: online store, subscriptions, member area, online courses.
The essential WordPress plugins, need by need
Some things can’t be rebuilt in a theme, or only at a price that makes no sense. For those, we pick a proven plugin, maintained by a team that makes a living from it.
| Need | Plugin | Cost | What it does |
|---|---|---|---|
| Editable sections | Advanced Custom Fields (ACF) | Free, paid version | The fields of each page section. You edit your text and images in clear boxes, without touching the layout. |
| Forms | Gravity Forms | Paid, yearly licence | Conditional logic, notifications, consent field, CRM connections. If the site runs through Cloudflare, we add Turnstile against bots. |
| Bilingual site | Polylang or WPML | Polylang free or paid, WPML paid | Depends on the project: we explain the choice in our Polylang or WPML comparison. |
| SEO | Yoast SEO or The SEO Framework | Free, Yoast has a paid version | Titles and descriptions for every page, sitemap for Google, breadcrumbs, structured data. Our choice between the two is explained below. |
| Law 25 consent | Complianz | Free, paid version | Blocks analytics and pixels until the visitor chooses, and lists the cookies for your policy. |
| Sending email | Gravity SMTP or FluentSMTP | Gravity SMTP included with some Gravity Forms licences, FluentSMTP free | The site’s emails go out through a real sending service instead of the server, and land somewhere other than the spam folder. Gravity SMTP if the site already has Gravity Forms, FluentSMTP otherwise. |
| Security | Wordfence | Free, paid version | Application firewall, file scanning and two-factor authentication at login. |
| Online store | WooCommerce | Free, paid add-ons as needed | Only when there is something to sell. |
“Free, paid version” means the free version does the job on most sites, and the paid version adds features some projects need.
Our own site runs six of these plugins.
For SEO, the choice depends on who uses it. Yoast SEO is installed on more than ten million sites, and it is the tool most SEO specialists and marketing teams know. If someone works on your SEO every week, we keep it. Its downside: the dashboard keeps nudging you toward the paid version. When nobody will be tuning SEO day to day, we prefer The SEO Framework. It does the same core work, without ads or nags in the dashboard, and it works with Polylang and WPML. Between the two, it’s sometimes a matter of taste too. Rank Math, popular with some specialists, remains an option if your agency insists.
Wordfence is installed on all our clients’ sites, and two details matter. Two-factor authentication, included in the free version, asks for a code on your phone on top of the password: turn it on for every administrator account, it is the simplest protection against a stolen password. And the free version receives new firewall rules thirty days after the paid version. Yet Patchstack finds that, for the most targeted vulnerabilities, a few hours are enough between disclosure and the first mass attacks. The free firewall helps. It doesn’t replace updates done on time.
What we build into the theme instead
Slideshow, gallery, tabs, FAQ, testimonials, popup, share buttons: on our sites, these are theme sections, not plugins. They follow your design instead of imposing their own. They only load code on the pages that use them. They have no licence to renew and no update that changes their look overnight.
Same for speed. It is handled in the theme and on the server, not with a caching plugin added the week of launch. And backups are made outside the site, on separate storage: a backup kept on the server it protects disappears with it.
The plugins we avoid
Page builders, first. They promise drag-and-drop everything, and they deliver, at the cost of heavy pages and a site that can no longer live without them. Deactivate one, and your pages lose their layout, when they don’t fill up with codes in square brackets. We prefer sections designed for your content, lighter and more accessible.
All-in-one plugins, which do twenty things when you use two. You pay for the other eighteen in weight, settings and potential vulnerabilities.
Plugins for three lines of code: disabling comments, adding a script to the header, changing the logo on the login page. The theme does it without a dependency.
Five questions before installing a plugin
Before adding a plugin, on your site or on a site we maintain, here is what we check:
- Is it maintained? The WordPress directory shows the date of the last update, and a warning appears when the plugin hasn’t been tested with the last three major releases. That’s often a sign it has been abandoned.
- Who pays its developer? A free plugin funded by a paid version has a model that holds up. A free plugin with no model depends on one person’s goodwill.
- What does it load, and where? A plugin used on one page shouldn’t add anything to the others. A speed test before and after installing it shows that quickly.
- What’s left if you remove it? Data stuck in a proprietary format, codes in square brackets in your pages, orphan tables in the database?
- Could the theme do it? If the answer fits in twenty lines of code, the plugin is one too many.
For a paid plugin, add one question: who renews the licence? An expired licence doesn’t break anything on the day. It simply cuts the site off from updates, and so from security fixes. Someone has to know when it expires, and take care of it.
Where to start with your site
Open your site’s plugin list and ask one simple question for each line: what is it for today? The ones deactivated for months can go. The ones whose role nobody knows deserve a check before removal, on a copy of the site if possible.
If the list is long, or if the site was built with a page builder, the site review in our maintenance plans starts exactly there: versions, plugins, backups and access. Our plans also include some licences: ACF Pro, Gravity Forms and Polylang or WPML in all three, Complianz Premium from the Advanced plan, Wordfence Premium in the Expert plan. We renew them, and you have no more renewal dates to watch. Only those are included: any other licence stays yours to renew. And when a site has piled up too many layers to be lightened, our WordPress sites start again from a theme that doesn’t need them.
