On older WordPress sites I often see the same picture: twenty to forty plugins, some of which nobody recognises, two that do the same thing and one that must not be updated because apparently everything would break. That is not a technology stack. It is an archaeological site.
I built the original version of this article in 2019 as a long list of tools I was testing on real websites. Some stood the test, others aged and a few of the categories from that time no longer need a separate plugin at all. So today I recommend a decision system and a shorter foundation.
Work first, plugin second
Before installing anything, write down which problem you are solving and how you will recognise the result. Then check whether WordPress, the theme, the hosting or another plugin you already use provides the function. Every additional installation means updates, new permissions, a possible conflict and more code on the site.
The number of plugins alone determines neither speed nor security. One poorly written add-on can do more damage than ten small ones. Even so, a smaller, understandable setup is easier to maintain.
My current foundation by situation
SEO and indexing
For most ordinary websites, one SEO plugin is enough. Yoast SEO is one maintained option for titles, descriptions, canonical URLs, an XML sitemap and basic structured data. Alternatives exist, but do not install two at once. Technical SEO does not end with a green dot; regularly check actual indexing and the errors described in the technical site health check.
Redirects
If the hosting or edge layer cannot manage redirects better, I use Redirection for smaller sites. It is useful when addresses change and for tracking requests to missing pages. Design bulk redirects in a table first, though; swapping source and destination can create a lovely loop.
Backups
A backup must be automatic, outside the same server and regularly tested by restoring it. If the hosting does not provide this service, UpdraftPlus is one option. A plugin is not a backup strategy until you know where the files are, how long they are kept and who will restore the site.
Cache and performance
Use the hosting or CDN cache first. If you do not have one, simpler installations can try WP Super Cache. After enabling it, compare the site before and after the change and check login, forms and the cart. I describe the detailed order of interventions in the guide how to speed up a website.
Security
Updates, limited accounts, multi-factor login, quality hosting and backups come before the idea that one security plugin will solve everything. Wordfence can add a firewall, file scanning and login protection, but it requires proper configuration and monitoring of alerts. If hosting or a network layer already provides protection, do not duplicate it without a reason.
Diagnostics
When looking for a conflict, Health Check & Troubleshooting is useful. For developers, Query Monitor shows database queries, errors and other clues. Diagnostic tools do not need to remain permanently active on every production site.
Content and administration
Yoast Duplicate Post simplifies cloning and rewriting content. Loco Translate helps manage theme and plugin translations, but store custom changes so that updates do not overwrite them. Handle spam according to the form type and legal setup; for comments, Akismet is a familiar option.
What disappears from the original list
- A standalone AMP plugin as an automatic choice: a fast, usable responsive site matters more than another parallel version of the content.
- Facebook Instant Articles and similar distribution experiments: they are not a general foundation for a site and their lifespan is determined by someone else’s platform.
- A PWA just for a phone icon: it makes sense only with a specific user scenario, offline functionality or repeated work.
- A plugin for every tiny adjustment: a few lines of custom code can sometimes be better, but only if it has an owner, documentation and tests.
- Multiple plugins for schema, sitemap or cache at once: overlapping functions complicate diagnosis.
Checks before installation
- Has the add-on been maintained recently, and is it compatible with your WordPress and PHP versions?
- Are the author and source trustworthy? Install from the official directory or a verified vendor.
- What permissions, data and external services does the plugin use?
- What happens to the content after deactivation?
- Do you have a backup and a test environment?
- How will you measure the impact on speed, functionality and conversions?
In its documentation, WordPress recommends treating hosting, plugins, images, cache and CDN as one system for performance. Read the official optimisation recommendations before layering three optimisation plugins on top of one another.
Regular plugin cleanup
Once a quarter, export a list of active and inactive plugins. For each, record the owner, purpose, last update date and replacement in case of failure. After verifying your backup, remove inactive and unnecessary add-ons. Do not wait for the quarter for critical updates; verify a change on staging first.
An online shop requires an even stricter regime because of payments, orders and WooCommerce compatibility. A separate decision process is in the article about WooCommerce plugins. If you do not know what each installation on your site does, do not start with another purchase. Start with an inventory; I can help with a technical consultation.