Plugins add features: a store, a form, a gallery, security. There are more than sixty thousand free ones.
And they are the most common reason for a hacked or slow website.
Installing
Plugins → Add New Plugin → search → Install Now → Activate.
If you have a .zip from somewhere: the “Upload Plugin” button at the top.
Three questions before every installation
1. When was it last updated?
It says so in the description. If it is more than a year ago — skip it. That is abandoned code that won’t get security fixes.
2. How many active installations?
Fifty thousand means many people use it and the bugs have been found. Two hundred means you are among the first who will find them.
3. Do I really need it?
Every plugin adds code that has to load. If it solves a real problem — it is worth it. If it is “nice to have” — it isn’t.
Where to install from
Only from the official directory (the search in the admin) or directly from the author’s website if it is a paid one.
Never “nulled” or “free download of premium” versions. They almost always contain planted code. Saving fifty euros gets you a hacked website.
How many are too many
The number isn’t the problem — which ones they are is.
Twenty-five small plugins slow nothing down. Three heavy ones can.
The heaviest are usually: page builders, sliders, and anything that writes to the database on every visit (counters, “who’s online”).
Deactivated isn’t deleted
A deactivated plugin doesn’t run, but it stays on the server. If it has a security hole, that hole can still be reached.
Rule: a deactivated plugin gets deleted. If you need it again, it reinstalls in a minute.
If something breaks after an installation
If the website is white and you can’t get into the admin:
Over FTP or File Manager, in wp-content/plugins, rename the folder of the last plugin you installed. It is deactivated automatically.
If you don’t know which one it is — rename the whole plugins folder. They are all deactivated, you log in, and then you switch them back on one at a time.
Plugins worth having on almost every website
- Security — Wordfence or Solid Security
- SEO — Yoast or Rank Math
- Cache — if your hosting doesn’t have its own
- Backup — UpdraftPlus, with a copy stored off the server
- SMTP — for emails that actually arrive
Five plugins that solve real problems. Anything beyond that needs a reason.
The Plugin File Editor
The same story as with themes — editing code in the browser, with no undo.
Switch it off with define('DISALLOW_FILE_EDIT', true); in wp-config.php.
Don’t want to maintain WordPress yourself — updates, backups and security? We take care of it.
WordPress maintenance →