Most “best WordPress plugins” lists are written by people who have never had to maintain the site afterwards. They run to forty entries, every one described as essential, and none of them mention what happens two years later when the plugin is sold, abandoned, or starts injecting upsell notices into your dashboard.
This list is shorter and more honest: these are the ten third-party plugins running on this website right now. Not a wishlist — the actual stack. If you view the source of the page you are reading, you are looking at their output.
How we decide whether a plugin earns its place
Every plugin is a permanent liability. It is code you did not write, running with full database access, that you have to keep updated for as long as the site exists. Before anything goes on a client build it has to clear four tests.
- Is it actively maintained? Check the last update date and whether it has been tested against the current WordPress release. A plugin that has not been touched in a year is a security incident waiting to happen.
- What does it cost on the front end? Many plugins load CSS and JavaScript on every page whether or not the page uses them. A contact form plugin has no business loading its assets on your blog archive.
- Does it do one job? All-in-one suites that promise SEO, security, caching, backups and analytics in a single package are the hardest things to remove later, because everything gets tangled together.
- Is there a way out? If you deactivate it tomorrow, do you get your content back as normal WordPress data, or is it locked in a proprietary format?
The ten plugins we actually install
1. Rank Math SEO
Handles titles, meta descriptions, canonical tags, XML sitemaps, schema markup and redirects. We use it because the schema support is genuinely good — you can output Service, FAQPage and BreadcrumbList markup without hand-writing JSON-LD, and it does not put the useful parts behind a paywall the way some competitors do.
The thing most people get wrong: installing an SEO plugin does not give you SEO. It gives you a place to put the titles and descriptions you still have to write yourself. A default install with empty fields does almost nothing.
2. Advanced Custom Fields
The single biggest quality difference between a site a client can maintain and one they cannot. ACF lets you define exactly the fields a page needs — a service page gets a price, a set of features and a FAQ list, and nothing else.
The alternative is handing the client a blank editor and hoping they never paste in styled text from Word. They always paste in styled text from Word.
3. Custom Post Type UI
Registers custom post types and taxonomies through the admin instead of in code. Pairs with ACF: CPT UI creates the content type, ACF defines the fields on it.
One caveat worth knowing: post types registered this way live in the database, not in your theme. If you move to a new host and forget to migrate the option, the post type disappears and the content becomes invisible. For anything mission-critical we register the post type in code and use CPT UI for the rest.
4. Contact Form 7
Unfashionable, and we keep choosing it anyway. It is free with no entry limits, it has no upsell nagging, and its markup is plain HTML you can style properly instead of fighting a builder’s opinions.
It has two real weaknesses. It does not store submissions anywhere by default, and it has no spam protection worth the name — which is what the next two entries are for.
5. Contact Form CFDB7
Saves every Contact Form 7 submission to the database. This matters more than it sounds. If your form only emails you and the email silently fails — wrong SPF record, full mailbox, an overzealous spam filter — the enquiry is gone and you will never know it existed.
Storing submissions means you can go back and check. We have found genuine leads sitting in a database that never reached anyone’s inbox.
6. WP Mail SMTP
The most boring plugin here and the one that prevents the most lost business. By default WordPress sends mail with PHP’s mail() function, which sends from your web server with no authentication. Gmail and Outlook increasingly treat that as spam, or drop it outright.
WP Mail SMTP routes your site’s email through a real authenticated mail service. If your contact form “works” but enquiries stopped arriving, this is almost always the reason. It is worth setting up on day one rather than after you have lost a month of leads.
7. All-in-One WP Migration and Backup
Moves an entire site — files, database, uploads — between hosts without touching phpMyAdmin. It handles the URL rewriting that breaks most manual migrations.
Be aware of the free version’s upload size limit on restore; it is the reason many people think the plugin is broken. Exporting is unrestricted, so it is still a perfectly good way to take a snapshot before a risky change.
8. Better Search Replace
Runs a find-and-replace across the whole database, safely. WordPress stores some data as serialised PHP arrays, where each string is prefixed with its own length — a naive SQL REPLACE corrupts those silently, and you often do not find out until a widget or a theme setting stops working weeks later. Better Search Replace unserialises properly.
Essential after a domain change or a move from HTTP to HTTPS. Always run it in dry-run mode first; it tells you how many rows it would change before it changes them.
9. Microsoft Clarity
Session recordings and heatmaps, free and unlimited. Analytics tells you that people leave the pricing page; Clarity shows you the person scrolling past your call-to-action three times without seeing it.
Its “rage click” detection — repeated clicking on something that is not actually a link — has found more real usability bugs for us than any amount of guessing. One caution: it records real visitor sessions, so make sure your privacy policy says so and check what your jurisdiction requires.
10. Classic Editor
A deliberate choice, not a refusal to move on. On a site where the page layouts are built in the theme and the content comes from ACF fields, the block editor adds an editing model that does not match how the site is actually built. Classic Editor keeps the writing experience simple.
If you are starting a new content-heavy site today, learn the block editor instead — it is where WordPress is going. This entry is about matching the tool to an existing build, not a recommendation to freeze in place.
What we deliberately do not install
The plugins missing from a stack say as much as the ones in it.
Caching plugins
Not because caching does not matter — it matters enormously — but because this site caches at the CDN, in front of WordPress entirely. A page served from the edge never wakes PHP up at all, which is faster than any plugin can be. Adding a caching plugin on top gives you two caches to purge and a new way for visitors to see stale content.
If you are not on a CDN, then yes, install a caching plugin. Just do not run one behind a CDN without a good reason.
All-in-one security suites
Most of what they do — firewall rules, rate limiting, blocking bad bots — belongs in front of your server, not inside it. A plugin firewall only runs after WordPress has already booted, which means the attack has already cost you resources. The genuinely useful parts, like file integrity monitoring, do not need a suite.
Page builders on top of a custom theme
If a theme has been built for the site, a page builder fights it. You end up with two systems that both want to control layout and a client who cannot tell which one to edit.
Anything that adds a dashboard widget you did not ask for
A plugin that installs upsell banners, notification bars and a “connect your account” nag is telling you what its priorities are. That behaviour rarely improves after you pay.
The plugin count nobody talks about
People ask how many plugins are too many. The number itself is not the problem — thirty well-built plugins can outperform five badly built ones. What matters is what they load and how well they are maintained.
A more useful question: for each plugin on your site, can you say what it does and when it was last updated? If you cannot, that is where to start. Sites we take over for maintenance routinely have plugins nobody remembers installing, several of them abandoned by their authors years ago.
Keeping the stack healthy
- Update on a schedule, not on a whim. Take a backup, update, check the front end and the forms. Never update straight into a live site on a Friday afternoon.
- Delete, do not deactivate. A deactivated plugin’s files are still on the server and can still be exploited. If you are not using it, remove it.
- Watch for ownership changes. Popular free plugins get acquired. The new owner sometimes adds tracking or aggressive upsells in the next release. If a plugin suddenly changes character after an update, that is usually why.
- Test your contact form monthly. Email delivery breaks quietly. A form that has silently stopped sending is the most expensive plugin failure there is.
Frequently asked questions
How many WordPress plugins is too many?
There is no fixed number. A site with thirty lightweight, well-maintained plugins can be faster than one with five bloated ones. Judge each plugin by what it loads on the front end and how actively it is maintained, not by the total count.
Do plugins slow down a WordPress site?
Some do. The usual cause is a plugin loading its CSS and JavaScript on every page rather than only where it is used. Check your site with a waterfall tool and look for assets loading on pages that do not need them.
Are free WordPress plugins safe to use?
Free is not the risk factor — abandonment is. A free plugin updated last month by an active developer is safer than a paid one last touched two years ago. Check the last update date and the WordPress version it has been tested against before installing anything.
Should I use a page builder or custom development?
A page builder makes sense when you need to launch quickly and will maintain the site yourself. Custom development makes sense when performance, a specific design, or a content structure your team can actually manage matters more. The two do not combine well on the same site.
Getting the stack right for your site
The right plugin list depends on what your site does. An ecommerce store, a lead-generation site and a publisher all need different things, and copying someone else’s stack rarely fits.
We build and maintain WordPress sites from our office in Jaipur, and plugin choices like these are part of every build. If you want a second opinion on what is running on your site — or you have inherited one and are not sure what half of it does — get in touch. You can also read more about our WordPress development work and ongoing maintenance.