What a plugin actually is
Code written by someone else, running with full access to your database and everything on your pages. That is a reasonable thing to accept for real functionality and an unreasonable one for a convenience you use twice a year.
The question is never “is this plugin good?” It is “is this worth the permanent maintenance and risk?”
Five questions before installing
- Is this solving a real problem or a preference?
- When was it last updated, and by whom?
- How many sites use it, and what do recent reviews say?
- Does it add scripts to every page or only where needed?
- Could ten lines of code in the theme do this instead?
Auditing what you have
- List every plugin and what it is for — several will be unexplainable
- Deactivate anything nobody can justify, then check the site
- Replace anything unmaintained for over a year
- Note which ones load on every page unnecessarily
Most sites we audit can remove a third of their plugins with no loss of function.
The ones worth having
| Purpose | Worth a plugin? |
|---|---|
| Security hardening | Yes |
| Backups | Yes, or at host level |
| SEO fields and sitemaps | Yes |
| Caching | Yes, unless the host provides it |
| Contact forms | Yes |
| Sliders and effects | Rarely |
| Anything you could write in the theme | No |
Deactivated is not removed
A deactivated plugin still has its files on the server and can still be a vulnerability. Delete what you are not using.
That single step closes the most common route into a WordPress site.