Plugins are what make WordPress what it is: with just a few clicks, a simple blogging platform can be transformed into an online shop, a booking system, a membership site or a multilingual corporate website. Tens of thousands of free plugins are available in the official plugin repository, and thousands more are sold separately. However, plugins come at a price: every piece of code running on your site can slow it down and create a security vulnerability. The vast majority of successful attacks against WordPress sites occur via an outdated or poorly written plugin.

In this guide, we’ll show you how to choose a good plugin, which categories are essential for an average website, how to install and maintain them, and what to do if a plugin causes your site to malfunction.

How do plugins work?

A plugin is a PHP code package that integrates with the system via WordPress ‘hooks’: it adds new functions or modifies existing ones. The code for every active plugin is loaded every time a page is loaded; many of them run database queries, add stylesheets and JavaScript to the page, and store data in the database. Therefore, it is not the number of plugins that matters, but their quality: ten well-written plugins place less of a burden on the system than one poorly written one.

How do you choose a good plugin?

Before installation, check the plugin’s information page:

• Last updated: if it was updated more than a year ago, it may no longer be under active development. WordPress will warn you if a plugin has not been tested with the last three major versions.
• Number of active installations and reviews: a high number of installations and good reviews aren’t a guarantee, but they’re a good sign.
• Support: do the developers respond on the support forum, and are the reported bugs resolved?
• Compatibility: the versions of WordPress and PHP with which it has been tested.
• Developer: is there a well-known company or an active developer behind it?
• Known vulnerabilities: you can search for them in the Patchstack or WPScan databases.

Never install ‘nulled’ or cracked premium plugins from unofficial sources: these almost always contain malware or backdoors. Our knowledge base article discusses the risks associated with cracked (‘nulled’) themes and plugins.

Free or premium? Free plugins in the official repository undergo basic checks, and many of them are excellent. The premium version is worth it if you genuinely need the extra features or direct support. Updating premium plugins requires a licence key: if it expires, the plugin will no longer receive security updates.

Ask yourself: do you really need this feature? Couldn’t an existing plugin, a template or a few lines of code do the job? Every plugin you don’t install is one less security and performance risk.

What does an average website need?

Category	What is it for?	Examples
SEO	Meta titles and descriptions, sitemap, structured data	Yoast SEO, Rank Math, SEOPress
Security	Login protection, two-factor authentication, firewall, malware scanning	Wordfence, Solid Security, Patchstack
Backup	Regular backups to external hosting	UpdraftPlus, BackWPup
Cache	Page caching, CSS/JS optimisation	WP Super Cache, W3 Total Cache, WP Rocket; LiteSpeed Cache on a LiteSpeed server
Image optimisation	Compression, WebP/AVIF, resizing	ShortPixel, Imagify, EWWW Image Optimizer
Forms	Contact us, request a quote	Contact Form 7, WPForms, Fluent Forms
Cookie Policy	Consent to tracking codes (GDPR)	Complianz, CookieYes
Online shop	Products, basket, payment	WooCommerce

A few comments:

• Only use one from each category. Having two SEO or two caching plugins will cause conflicts, leading to errors or duplicate code.
• Backups: aWh’s cPanel and WordPress hosting plans include daily backups, so the backup plugin is mainly required for a second copy that is independent of the hosting (for example, cloud storage).
• Cookie policy: if you use analytics or marketing tracking codes, the visitor’s consent is mandatory; our GDPR guide covers this.
• The WordPress image optimisation guide covers image optimisation.

Installation

From the official repository: Plugins › Add New, search, then Install and Activate.

From a ZIP file (for premium plugins): Plugins › Add New › Upload Plugin, then select the file. If the file is too large, increase the PHP upload limit or upload it via FTP to the wp-content/plugins folder.

With WP Toolkit (aWh WordPress hosting), you can install, update and deactivate plugins on multiple WordPress sites at the same time.

Maintenance

Updates. A significant proportion of plugin updates are security patches, so don’t put them off. For trusted plugins, enable automatic updates (on the Plugins page, for each plugin individually), whilst for large, complex plugins (such as online shops or website builders), try them out in a test environment first. Our guide on updating plugins securely covers update strategies, whilst our knowledge base article explains how to set up automatic updates.

Testing environment (staging). It’s worth testing major updates or new plugins on a copy of your site. On aWh’s WordPress hosting, you can create a staging copy with a single click using WP Toolkit; the steps for this are described in the article on creating a staging environment with WP Toolkit, and there is also a WordPress staging blog post on the subject.

Cleaning up. The code for plugins that have been deactivated but are still installed remains on the server and can be exploited if there are any vulnerabilities. If you’re not using them, delete them. After deletion, data from many plugins remains in the database; our database optimisation guide explains how to remove this.

Once a year, go through all your plugins: do you still need them, are they still being updated, and are there any better alternatives?

If a plugin is causing problems with the site

Following an update or the installation of a new plugin, you may encounter a white screen, a ‘critical error’ message or a display error.

1. If you can access the admin panel: disable the most recently updated or installed plugin.
2. If you can’t access it: in your hosting account’s File Manager or via FTP, rename the plugin folder under wp-content/plugins (for example, bovitmeny → bovitmeny-off). WordPress will then disable it. If you’re not sure which one is causing the problem, rename the entire plugins folder, then re-enable them one by one.
3. WordPress’s recovery mode: in the event of a serious error, WordPress sends an email to the administrator containing a link that allows them to log in and disable the faulty plugin.
4. Backup: if nothing else works, restore the backup taken before the update.
5. The cause of the error: you can find out using WordPress debug mode or the server error log; our troubleshooting guide and the knowledge base article on the white screen of death cover this.

Plugins and hosting

On shared hosting, every account has CPU and memory limits. A resource-intensive plugin (such as a poorly configured security plugin that scans files with every request, or an e-commerce plugin that calculates related products) will reach this limit, causing the site to slow down or return an error. In such cases, cPanel’s resource usage statistics will show when the site reaches the limit; in WordPress, the Query Monitor plugin (temporarily enabled) will show which plugin is causing the slowdown.

If your plan is still too limited even after optimising your plugins, you can switch to a larger plan or WordPress hosting.

Summary

Use a small number of well-chosen, actively maintained plugins – one per category. Before installing, check for updates, reviews and support; never use cracked premium plugins; update regularly; delete any plugins you no longer use; and test any major changes in a test environment first.

Frequently Asked Questions

How many plugins can I install?

There’s no magic number. On an average website, 10–20 well-written plugins will run without any problems; quality matters far more than quantity. For each one, ask yourself whether you really need it.

Are plugins slowing down your website?

Yes, every active plugin uses some resources, but the difference is huge: a well-written plugin has a negligible impact, whilst a poorly written one can add seconds to the loading time.

Are free plugins safe?

Free plugins available in the official repository that are actively developed and widely used are generally safe, provided you keep them up to date. The greatest risk comes from outdated plugins and those from unofficial sources.

How do I permanently delete a plugin?

Disable it, then delete it from the Plugins page. If your data remains in the database, you can remove it using the plugin’s own ‘delete data’ setting or a database cleaner tool.

What should I do if my website isn’t working after an update?

Disable the updated plugin (if the admin panel is unavailable, rename its folder via FTP or in File Manager), and if necessary, restore the backup from before the update.

Can I use two similar plugins at the same time?

Not recommended: having two SEO tools, two caches or two security plugins may cause conflicts and result in duplicate code or errors.

• wordpress
• website security
• website speed
• seo
• guides