There isn’t a number. We look after sites running 35 plugins that are quick and stable, and we’ve taken over sites with nine that fell over every time something updated. The count tells you very little. What each plugin does, how well it’s built and whether anyone is still maintaining it tells you nearly everything.
That said, a long plugin list is often a symptom. It usually means several people have worked on the site over the years, each solving a problem by adding something, and nobody ever took anything away.
What makes a plugin a problem
It loads code on every page when it’s only needed on one. A booking calendar that loads its scripts and styles on your homepage, your blog and your contact page is costing you speed everywhere for a feature that lives on one page. Well-built plugins load only where they’re used. Plenty don’t.
It does a lot of work behind the scenes. Some plugins run heavy database queries, scan files, or phone home to an external service on every page load. Statistics plugins that store every visit in your own database, broken link checkers that crawl constantly, and “related posts” tools that calculate matches live are common culprits.
It’s abandoned. A plugin that hasn’t been updated in two years may still work, but nobody will fix it when the next PHP version or WordPress release breaks it, and nobody will patch it if a security hole turns up. When we trace how a compromised site was broken into, an unmaintained plugin is a regular finding.
It overlaps with something else. Two SEO plugins, two caching plugins, or a security plugin fighting with your host’s own firewall is a reliable way to get strange errors. Each one assumes it’s in charge.
It’s a nulled or pirated copy. Paid plugins downloaded free from dodgy sites very often come with malware baked in. Never, ever install these.
The checklist we run before installing anything
This is the list we use. It takes about five minutes per plugin, which is far less time than undoing a bad one.
- Do we need a plugin at all? Elementor Pro already handles forms, popups, headers and footers, and a lot of layout tasks people install separate plugins for. A small tweak might be three lines of code in a child theme or a snippet rather than a whole plugin.
- Is it from the official directory or a reputable developer? The WordPress.org plugin directory reviews plugins on submission and closes ones with unresolved security problems. Premium plugins should come straight from the developer’s own site.
- When was it last updated? We want to see an update within the last few months. Anything over a year gets a hard look.
- Has it been tested with a recent WordPress version? The directory listing shows this. A large gap is a warning sign.
- How many active installations? Popular isn’t always good, but a plugin with a large user base gets problems reported and fixed quickly. Something with 200 installs is a bigger gamble.
- Do the support forums show responses? Open the support tab and check whether the developer answers questions and fixes reported bugs, or whether threads sit unanswered for months.
- Does it have a known security history? One fixed vulnerability isn’t a deal breaker (big plugins all have them eventually). Repeated serious issues, or slow fixes, are.
- What does it load, and where? After installing on a staging copy, we check page speed and look at which scripts it adds to pages that don’t use it.
- What happens if we remove it later? Some plugins leave shortcodes scattered through your content, or tables in your database, when you uninstall them. Better to know before you’re locked in.
- Who’s going to update it? If it’s a paid plugin, whose account holds the licence? If the licence lapses, updates stop, and that plugin quietly becomes a security risk.
If a plugin fails two or three of these, we look for another way.
Auditing the plugins you already have
If you’ve inherited a site with a long list, thin it out in this order. Do this on a staging copy, or at minimum straight after a full backup.
Go to Plugins in your dashboard and sort them into three piles. First, deactivated plugins. These still sit on your server and can still be exploited in some cases. If they’re not in use, delete them.
Second, plugins nobody can explain. Search the plugin name and work out what it does. Then check whether that job is still needed, or whether another plugin or Elementor now does it. Deactivate one at a time and check the site after each, paying attention to forms, menus and any shop or booking pages.
Third, keepers. For each of these, check it against points 3, 4 and 10 above. Plugins that are abandoned should be replaced, even if they still seem to work.
It’s not unusual for an audit like this to remove a third of a site’s plugins without anyone noticing a difference, except that the site is faster and updates stop causing surprises.
A word on page builders
People sometimes count Elementor as “one more heavy plugin” and assume a site without it would be lighter. A builder does add weight, but it also replaces a pile of separate tools (sliders, form builders, header plugins, layout add-ons) that would otherwise each add their own. We’ve set out why we build in it in why we build every WordPress site in Elementor. The thing to avoid is stacking several Elementor add-on packs on top, each with 80 widgets when you’re using two.
So what should your list look like?
A typical small business site of ours has a page builder, an SEO plugin, a backup tool, email delivery, a security layer and caching, plus one to five plugins specific to what that business does. You’ll find the reasoning behind each category in the WordPress plugins we install on almost every site.
If your list is far longer than that and you can’t explain half of it, it’s time for a clean-out rather than one more install.
A plugin audit is our standard first step when we take over an existing site, and it’s covered by the free review on our website ownership page. The clean-up that follows is a routine WordPress fix for us, and new builds on our web design service start from the short list.