The Short List of WordPress Plugins I Actually Install

Most slow, broken WordPress sites I get hired to fix have one thing in common: forty-three active plugins. People treat the plugin directory like an app store and click "Install" on anything that sounds vaguely useful. Then they wonder why the admin takes nine seconds to load.

Here's the short list I actually install on a brand-new WordPress site, and why.

Security: one plugin, not three

You need a security plugin. You do not need three. They will fight each other and slow your site down.

I default to Wordfence Free. It blocks bad logins, scans for malware, and gives you a clear dashboard. Solid Security (formerly iThemes Security) is the other one I'll use if a client already has it.

Whatever you pick, set it up once, turn on two-factor authentication for the admin user, and stop poking at it.

Caching: make the site feel fast

A fresh WordPress install is slower than it should be because every page is built from scratch on every request. A caching plugin saves the finished page so the next visitor gets it instantly.

• WP Rocket if you have $59 to spend. It's the one I use on my own work because it just works.
• LiteSpeed Cache if your host runs LiteSpeed (most do now). It's free and excellent.
• W3 Total Cache as a fallback. Powerful but the settings panel will make you feel things.

You only need one. If you already have one and your site is fast, don't switch.

SEO: Yoast, with a small qualifier

Yoast SEO is the one I install by default. It's been around forever, the docs are excellent, and it does everything a small business site needs out of the free tier. Rank Math is the popular alternative if you'd rather try something newer — it's fine, I just keep coming back to Yoast.

The qualifier: an SEO plugin doesn't do SEO. It just gives you the controls. You still have to write good titles, real descriptions, and content people want to read. I see people install Yoast, watch the little circles turn green, and assume Google is going to call.

Forms: pick one and stop

Fluent Forms is my current favorite — fast, no bloat, free tier handles most use cases. WPForms is the popular alternative if you want something more polished and you'll pay for it.

If you only need a basic contact form, Contact Form 7 still works fine. Yes, it's old. Yes, the UI is ugly. It doesn't matter; the form will work for ten years.

Backups: have them somewhere that isn't your site

The whole point of a backup is that it survives whatever destroyed your site. So the backup cannot live on the same server. Put it somewhere else.

UpdraftPlus is the easy answer. Free plan + a Google Drive or Dropbox connection, schedule a weekly backup, and you're done. If your host already runs daily backups (check before you assume), you don't necessarily need this — but I'd still want a copy somewhere I control.

Page builder: only if you actually need one

Most small sites don't need a page builder. The WordPress block editor (Gutenberg) has gotten genuinely good, and it doesn't add the page-builder weight.

If you do need one — usually because a client wants to edit complex layouts themselves — Bricks is the modern pick and Elementor is the popular one. Avoid stacking a page builder on top of a theme that already has one. That's how sites get slow.

Plugins I'd avoid on a fresh install

• Jetpack. It's a kitchen sink. Half of it is bundled with WordPress already, and the other half can be replaced by a single-purpose plugin that runs lighter.
• Anything that promises "more traffic" or "instant SEO." These are almost always doing nothing useful and sometimes doing harm.
• Sliders. Carousels on the home page are a UX trope that mostly doesn't convert. Just put your best thing in the hero and trust it.

The rule

Every plugin is code you didn't write running on your site. Each one needs to be updated, can break, and might get abandoned by its developer. So the right number of plugins is "as few as you can get away with."

Keep the list short. Update them monthly. And if you haven't used a plugin in three months, delete it instead of just deactivating it.

If your site already has thirty-something plugins and feels slow, that's something I clean up for clients regularly — let me know and I'll take a look.