Knowledge · WordPress Web Design
Our WordPress Plugin Stack: 12 Plugins We Trust, 47 We Don’t
The WordPress plugin directory has 60,000+ plugins. Most are abandoned, broken, or actively harmful to your site. We’ve audited hundreds of mid-market WP sites and converged on a tight stack: 12 plugins we trust for production work, and a longer list of plugins we explicitly avoid. Here’s both lists with reasoning.
№ 01The 12 we trust
SEO:
- Rank Math (free + Pro $79/yr): our default. Cleaner UI than Yoast, schema implementation is better, faster admin.
- Yoast SEO (free + Premium $99/yr): the alternative. More established, larger user base, slightly heavier admin. Either works.
Forms:
- Gravity Forms ($59/yr): our default for B2B. Conditional logic, multi-step flows, CRM integrations all native.
- Fluent Forms ($79/yr): alternative for higher-volume use cases. Lighter footprint than Gravity.
Security:
- Wordfence Premium ($119/yr): our default. Real-time malware signatures, 2FA, IP blocking, live traffic view.
- Solid Security Pro ($99/yr): alternative. Lighter on resources than Wordfence, fewer features.
Backups:
- BlogVault ($89/yr): our default. Off-site, incremental, one-click restore, staging clone.
- UpdraftPlus Premium ($70/yr): alternative. More setup overhead but cheaper.
Performance:
- WP Rocket ($59/yr): page cache + critical CSS + defer JS, all in one. Cleanest config in the category.
- LiteSpeed Cache (free, requires LiteSpeed server): on Cloudways or Hostinger with LiteSpeed. Free, server-level, faster than WP Rocket on supported infrastructure.
Custom fields / blocks:
- Advanced Custom Fields Pro ($249/yr): we use it on ~40% of sites. Custom field groups, repeaters, flexible content.
- GenerateBlocks Pro ($69/yr): extra blocks for FSE. Light, well-coded, doesn’t bloat the editor.
That’s the 12. We’ll add 1-2 specialty plugins per project (WooCommerce, MemberPress, LearnDash) when scope demands. We won’t add more than 8 total on any standard build.
№ 02The plugins we explicitly avoid
Jetpack: bloated. Bundles 30+ features you don’t need. Use the specific tools (Akismet for spam, etc.) instead.
Elementor / Divi / WPBakery: page builders. The whole point of FSE is not using these.
All-in-One SEO Pack: Rank Math and Yoast are both better. AIOSEO is the third-place option that should retire.
WP Super Cache / W3 Total Cache: obsoleted by managed-host caching and WP Rocket. W3TC’s config UI is from another era.
Contact Form 7: works, but lacks conditional logic, CRM integration, spam protection without extension plugins. Always use Gravity Forms or Fluent Forms instead for any serious site.
WPML for new builds in 2026: Polylang Pro is cleaner. WPML is a legacy choice.
Slider Revolution / LayerSlider: if you need a slider in 2026, you don’t need a slider. Heroes work better static.
Anything with ‘Pro’ in the name but no developer listed in the last 18 months: abandonment risk.
Most ‘Booking’ / ‘Membership’ / ‘Course’ plugins under $50/yr: they’re cheap because they’re thin. Real category plugins (MemberPress, LearnDash, BookingPress) cost $200-$400/yr because they’re maintained.
№ 03Plugin evaluation framework
Before adding any plugin to a production site, we run 5 checks:
- Last update date. If it’s been more than 6 months, the plugin is on watch. 12+ months: probably abandoned. Don’t install.
- Active installation count. Under 10,000 is risk territory unless it’s a paid niche plugin from a known author.
- Support forum responsiveness. Look at the last 20 forum posts. Are author replies present? How recent?
- Code quality spot-check. Skim the plugin’s source via Plugin Editor or GitHub. Is it readable? Does it follow WP coding standards?
- Vulnerability history. Check WPScan database. A history of CVEs isn’t a deal-breaker (every plugin has bugs), but the response time matters.
№ 04The plugin sprawl trap
Sites we audit typically run 17-22 plugins. The sprawl is rarely intentional — each plugin solved a problem at the moment it was installed.
The audit pattern: 30-40% of installed plugins on most sites are either unused (activated but no settings configured), redundant (two plugins doing similar jobs), or replaceable (the function is now in core or a better plugin).
The cleanup process: list all active plugins, document what each does, identify duplicates and unused, test remove on staging, ship. Typical mid-market audit removes 8-12 plugins without losing any functionality.
№ 05Update discipline
Updates aren’t optional. They’re the difference between a maintained site and a hacked one. The cadence we apply on every Care Plan client:
- Security patches: within 24 hours of release, applied to staging then production same day
- Major plugin updates: applied 2×/month on staging, smoke-tested, then promoted
- WordPress core minor releases: within 72 hours of release
- WordPress core major releases: 2-3 weeks after release (let the plugin catalog catch up)
- PHP version updates: planned 30 days in advance, tested on staging first
⚠What to avoid
- Installing the ‘recommended plugins’ that come with a premium theme. Themes bundle 5-10 plugin recommendations as upsells, not as engineering recommendations. Audit each one independently.
- Trusting a 5-star rating with 12 ratings. The signal is rating count × recency. A plugin with 4.8 stars from 8,000 ratings beats one with 5.0 from 12.
- Activating a plugin to test it on production. Test on staging. Plugins can break the site. Production is not staging.
Related questions
Go deeper
Three Ways to Start · No Sales Pitch
Want this analyzed on your site?
$500 audit. 5-day delivery. Refundable on engagement.