Which jobs count as essential WordPress plugins
A plugin is essential only when WordPress cannot finish that job and the site actually has the job. Five jobs qualify on almost every site. A sixth, a shop, qualifies only when you take payment.
- SEO: one plugin writes the title, the meta description, and an XML sitemap.
- Security: one firewall scans files and limits failed logins.
- Backup: one plugin stores a copy off this server, and you have restored it.
- Cache: one cache layer, not two, so repeat views skip a full PHP build.
- Forms: one form sends a message you actually receive.
- Shop: WooCommerce only if you sell. Skip it on a brochure site.
The server side of this list is WordPress hosting. The plugin does not replace a host that already caches, stores backups, or sends mail. Pick the plugin that matches the host, then stop.
How to install an essential WordPress plugin and see that it worked
Install from the dashboard so you get the copy in the official directory, not a zip from a random site.
- In wp-admin open Plugins, then Add New, and search the plugin name.
- Check active installs, the last update, and that the author still answers support.
- Click Install Now, then Activate. Install one plugin, not a bundle.
- Do the job once: save a title, run a scan, send a form, or take a backup.
- Open the public page in a private window. If the job is not visible, undo that plugin before you add another.
A plugin that has not been updated in years, or that is missing from the directory, does not belong on a live site. Gzip, a responsive menu, and a gallery are usually the theme or the cache plugin. Do not add a second plugin for them.
Rank Math or Yoast for essential WordPress SEO
Install Yoast SEO or Rank Math, not both. Each one sets the title, the meta description, and the XML sitemap. The free directory version covers a normal site.
On 30 October 2026 the WordPress.org popular list showed Yoast SEO in the 10+ million active-install band and Rank Math in the 4+ million band. Either is a maintained pick. Turn on the sitemap, set one title, and view the live URL to see that title.
If you change a URL, add the redirect in one redirection plugin or in the SEO plugin redirect tool. A second SEO plugin will fight the first over the same title tag. Paid add-ons are sold by those makers. This page does not quote them. Buy one only after the free title and sitemap already work.
Which WordPress security plugin to install
The best WordPress security plugin for a normal site is one firewall you will actually run, not a stack of three. Wordfence is the practical pick: firewall, malware scan, and login limits. On 30 October 2026 it sat in the 5+ million active-install band on the popular list.
Solid Security and All-In-One Security do the same job. Top WordPress security plugins overlap. Two firewalls at once cause slow pages that look like a hosting fault. Pick one.
Do not install a phpMyAdmin plugin on the public site. Use the database tool in the host panel, then log out. For the habits around updates and logins, see how to keep WordPress secure.
Why the Essential Plugin bundle is not an essential WordPress plugin
The Essential Plugin portfolio, formerly WP Online Support, is not on this list. On 5 April 2026 a backdoor planted in that set of 31 plugins started writing SEO spam into wp-config.php. The spam was aimed at Googlebot, so a normal visit could look fine.
WordPress.org permanently closed all 31 plugins on 7 April 2026. They cannot be reinstalled from the directory, and there is no update that makes them safe. On 8 April 2026 a forced release, 2.6.9.1, stopped the plugins contacting the attacker's server. It did not remove code already added to wp-config.php. Those dates and the file checks are from the mySites.guru account of the incident, read on 30 October 2026.
If any plugin from that portfolio is still installed, delete it. Then open wp-config.php and look near the line that loads wp-settings.php for PHP you did not put there. Also look in the web root for a file named wp-comments-posts.php, which does not ship with WordPress. Infected copies of wp-config.php were about 6KB larger. Do not download a replacement from the old vendor site.
Why off-site backup is an essential WordPress plugin
A backup you have never restored is a hope, not a backup. Use UpdraftPlus, schedule it, and send the copy to storage that is not the same server. On 30 October 2026 UpdraftPlus was in the 4+ million active-install band.
Restore files and the database together so they match. All-in-One WP Migration is a one-time mover. On that same 30 October 2026 list it was in the 5+ million band. It does not replace a schedule. After you know a restore works, you do not need a second backup plugin running every hour.
Moving an existing site onto WebJi® is not automatic. Free migration is subject to terms and approval, so open a ticket before the old host deletes the account. For a copy kept with the host, see WordPress website backup.
Cache, forms, and image plugins a WordPress site still needs
Cache is essential when the host does not already serve a static copy. If the server is LiteSpeed, install LiteSpeed Cache and nothing else for cache. On 30 October 2026 that plugin was in the 7+ million band. On any other server, one cache plugin is enough.
Do not add a separate gzip plugin if the server or the cache plugin already compresses responses. Forms need one plugin. Contact Form 7 was in the 10+ million band on that same list. Send a test to an inbox you open. If it never arrives, fix mail delivery before you install a second form plugin.
A survey, a quiz, a question-and-answer plugin, or a social feed is not a second essential. Images are often the heaviest bytes. Export WebP at the size the layout uses, or let one compression plugin do it on upload. A watermark, an Instagram feed, or a YouTube gallery is optional. WordPress already embeds a YouTube URL.
Essential WordPress plugins compared by job
Use this table to choose one plugin per job. The free directory build is the row to install first. Paid tiers belong to the plugin maker, and this page does not quote them.
| Job | Install one | Leave it out when | You know it worked when |
|---|---|---|---|
| SEO | Yoast SEO or Rank Math, not both | The other SEO plugin is already active | The title you saved shows on the live page and the sitemap URL opens |
| Firewall | Wordfence, or one other suite | A second security plugin is active | A scan finishes and a bad login is limited |
| Backup | UpdraftPlus, stored off the server | The only copy sits on the same server | You restored files and the database together once |
| Cache | LiteSpeed Cache on LiteSpeed, otherwise one cache plugin | The host already caches and a second plugin is on | A repeat view is served from cache and a real edit shows after you clear it |
| Form | One form plugin | Two form plugins are active | A test message arrives in the inbox |
| Images | WebP at the layout size, by hand or one plugin | You already export WebP before upload | A photo page is not mostly image bytes |
| Shop | WooCommerce | You do not sell online | A test product can be added to the cart |
| Closed bundle | Nothing from the Essential Plugin portfolio | Any plugin from that closed set is installed | The plugin is deleted and wp-config.php has no injected block |
A page builder, a membership plugin, an LMS, or a slider is a project choice. It is not on the essential list.
How many essential WordPress plugins is too many
There is no number you must stay under. A list of 15 plugins is a catalog, not a requirement. Most brochure sites are done at five to eight active plugins. A shop runs more because WooCommerce adds payment and shipping plugins you actually use.
Update after a backup, one plugin at a time if the site sells. A white screen is usually one plugin. Rename that plugin's folder in the file manager to disable it, then reload. Delete plugins you deactivated months ago. They are still code.
Elementor led the popular directory on 30 October 2026, in the 10+ million band. It is a design tool, not an essential plugin. Skip it when the theme already lays out the pages.
Classic Editor was in the 8+ million band on that list and only restores the old writing screen. Skip it if the block editor is fine.
Social posting, a glossary, a partners logo grid, a custom dashboard, and a mobile-only plugin are not essential. A blog does not need its own plugin, because WordPress already publishes posts. Add a plugin only when that job is really on the site, and remove it when the job ends.
Frequently Asked Questions
What plugins does every WordPress site need?
Every site needs one SEO plugin, one firewall, an off-site backup, page cache, and one contact form. Add WooCommerce only if you sell. Do not install a second plugin that does the same job.
How many plugins are too many?
There is no safe maximum. Unused plugins are the problem, because they stay unpatched. Five to eight active plugins cover a normal brochure or blog. A shop needs more. If the site is slow, disable the heaviest plugin first, not every plugin.
Yoast or Rank Math: which free SEO plugin?
Either free plugin is enough. Yoast SEO and Rank Math both set the title, the meta description, and an XML sitemap. Install one, not both. Confirm a title you typed shows on a live page before you pay for a premium add-on.
Do I need a caching plugin if my host has LiteSpeed?
If the server is LiteSpeed, use LiteSpeed Cache and do not add a second cache plugin. If it is not LiteSpeed, one cache plugin is worth it. Clear the cache after a change and reload in a private window to see the new page.
Which free backup plugin is most reliable?
UpdraftPlus is the reliable free pick when the copy is stored off the server and you have restored it once. A backup that has never been restored is only a file. All-in-One WP Migration is for moving a site, not a substitute for a scheduled off-site copy.
Are free plugins from the directory safe?
A directory listing is not a safety certificate. Check that the plugin was updated recently, that people still use it, and that support replies exist. On 7 April 2026 WordPress.org permanently closed the Essential Plugin portfolio of 31 plugins after a backdoor, as reported by mySites.guru on the page linked above. Remove those. Do not reinstall them.