25 Essential WordPress Plugins (And 6 You Should Delete)

Lists of essential WordPress plugins have a structural problem. They are written as a ranking, which implies the reader should install most of them, and they rarely mention that two entries do the same job, that one has been effectively abandoned, or that a third is famous for hammering your own server.

This list is organised by job instead. Twenty-five plugins across nine categories, with the honest note on each, plus a section on six commonly recommended plugins that are worth removing. Pick one per category you actually need and ignore the rest. ThemesCraft has no affiliate relationship with anything named here.

The four that are genuinely non-negotiable

If you install nothing else, install one from each of these four rows. The order is the order of consequence when they are missing.

Job	What happens without it	Pick one
Backups	A bad update or a compromise is unrecoverable	UpdraftPlus, Solid Backups, or your host’s own
Security	Automated scanning finds an unpatched site within weeks	Wordfence, Solid Security, or Sucuri
SEO	No control over titles, meta, indexing or schema	Rank Math, Yoast, SEO Framework or Slim SEO
Forms	No way to be contacted other than a published address	WPForms Lite, Fluent Forms or Contact Form 7

Backups: three worth using

• 1. UpdraftPlus. The default recommendation and deservedly so. Scheduled backups to Google Drive, Dropbox, S3 and others, with restore from the dashboard. The free version covers most sites completely. Migration to a new host is a paid add-on.
• 2. Solid Backups. Commercial only, formerly BackupBuddy. Strong at scheduled off-site storage and full-site migration. Worth it when you manage several client sites rather than one.
• 3. WPvivid. Free backup and migration in one, which is the gap UpdraftPlus leaves. Smaller team behind it, so weigh that for a business-critical site.

Security: three, and you need exactly one

• 4. Wordfence Security. Firewall, malware scanning, login protection and live traffic. The most complete free option. The scanner is resource-hungry, so schedule it off-peak on shared hosting.
• 5. Solid Security. Formerly iThemes Security. Lighter than Wordfence, focused on hardening and login security rather than continuous scanning. A good fit when your host already provides a firewall.
• 6. Sucuri Security. Free plugin for auditing and integrity monitoring; the firewall that makes it genuinely strong is a paid cloud service that filters traffic before it reaches your server.

Two security plugins at once is a classic self-inflicted wound. They both modify .htaccess, both add login restrictions, and the interaction locks people out of their own sites regularly. Choose one.

SEO: four, same caveat

• 7. Rank Math. The most generous free tier: redirects, multiple focus keywords, wide schema support, Search Console integration. Dense interface with a lot of switches to misconfigure.
• 8. Yoast SEO. Fewer decisions, mature, well documented. Redirect management and internal link suggestions are paid-only.
• 9. The SEO Framework. Sensible defaults, no content analysis by design, no upsell noise. The choice when you want it configured once and silent.
• 10. Slim SEO. Automatic titles, descriptions, schema and sitemaps with almost no settings at all. Minimal footprint, minimal manual control.

Forms: three

• 11. WPForms Lite. Easiest drag-and-drop builder of the three. The free version is deliberately limited; conditional logic and payments are paid.
• 12. Fluent Forms. Notably lighter than most form plugins and generous in its free tier. The better pick when performance matters.
• 13. Contact Form 7. Free, unlimited, and around forever. Configuration is a template syntax rather than a visual builder, and styling is entirely your problem.

Performance: four

• 14. WP Rocket. Commercial. Caching, file optimisation, lazy loading and preloading with sane defaults out of the box. The reason people pay is that it works without tuning.
• 15. LiteSpeed Cache. Free and excellent, on LiteSpeed or OpenLiteSpeed servers. On other stacks you get only a subset of the benefit.
• 16. W3 Total Cache. Free, powerful, and the one most likely to break your site if you enable options you do not understand. Change one setting at a time.
• 17. ShortPixel or Imagify. Image compression and WebP or AVIF conversion. Images are the largest payload on most pages, which makes this the highest-leverage performance plugin after caching.

Check with your host before installing any caching plugin. Kinsta, WP Engine and several others cache at server level and explicitly disallow or discourage plugin caching. Running both produces stale pages and support tickets.

Editing and layout: four

• 18. Advanced Custom Fields. The single most useful plugin for building anything structured: custom fields attached to posts, pages or custom post types. The free version is enough for a great deal of real work.
• 19. Elementor. The most widely used page builder, with the largest template and add-on ecosystem. The trade-off is markup weight and a meaningful commitment, since content built in it is hard to move out.
• 20. Bricks or Breakdance. Newer builders specifically designed around cleaner output. Worth evaluating if Core Web Vitals are the reason you are looking.
• 21. WPCode. Adds code snippets, header and footer scripts and tracking tags without touching functions.php, and keeps them when you change themes. Quietly one of the most useful utilities on this list.

The remaining four

• 22. Akismet. Comment spam filtering, bundled with WordPress. Free for personal sites, paid for commercial use. If you run open comments, you need this or an equivalent.
• 23. Redirection. Manages 301s and monitors 404s. Genuinely valuable during a site restructure. Note that it logs to your database, so cap the retention period or the table grows without limit.
• 24. Site Kit by Google. Brings Search Console, Analytics and PageSpeed data into the dashboard. Convenient rather than essential; the underlying tools are free and more capable in their own interfaces.
• 25. WP Crontrol. Shows what is scheduled to run on your site and when. Unglamorous, and the fastest way to find out why a site is mysteriously slow or why emails fire at odd hours.

Six commonly recommended plugins worth removing

This is the section that older lists omit, and it will do more for most sites than adding anything above.

Plugin	Why it is on every list	Why to reconsider
Broken Link Checker (classic on-site version)	Finding broken links is genuinely useful	The original crawls from your own server continuously and is a well-known cause of resource overages. Use the cloud version or an external crawler
AMP	Was a requirement for the Google news carousel	That requirement was removed. For most sites AMP is now a second version of every page to maintain for no benefit
Jetpack, installed whole	Bundles many features in one install	You typically want one module and load all of them. The standalone Jetpack plugins give you the same feature at a fraction of the weight
Hello Dolly	Ships with WordPress	It is a demonstration plugin that prints song lyrics in the admin. Delete it
Any second SEO or security plugin	Each was recommended separately somewhere	Duplicate meta tags, conflicting canonicals, competing .htaccess rules and lockouts
Page builder add-on bundles	Hundreds of extra widgets	You use four. All of them load on every page. Enable only the modules you use, if the bundle allows it

Deactivated plugins still sit in your file system and still need updating to avoid being an entry point. Deactivation is a test; deletion is the fix.

How many plugins is too many

There is no number, which is why the question keeps getting asked. Twelve well-built plugins can be lighter than four bloated ones. The useful test is not a count at all.

1. Can you name what each one does? If you cannot remember why a plugin is installed, that is your first removal candidate.
2. Was it updated in the last six months? An abandoned plugin is a scheduled security incident. Check the last-updated date on its WordPress.org page.
3. Does it load on pages that do not use it? A form plugin loading its CSS and JavaScript on every page of the site is paying a cost on 95% of your traffic for the benefit of 5%.
4. Is it duplicating something you already have? Hosts increasingly bundle caching, backups and security. Paying twice in both money and page weight is common.

Run that audit once a quarter. Most sites lose three or four plugins each time with no visible change, which is the outcome you want.

If a plugin update is what brought you here, our guide to recovering when a plugin update breaks your site covers the triage, and plugins not installing on WordPress handles the opposite problem. For the SEO plugins specifically, what they actually do is worth reading before you pick one. And when nothing in the repository does the one specific thing you need, building a small plugin yourself is more approachable than it used to be, provided you review what you ship.

Frequently asked questions