On almost every business site we build, we install Elementor Pro, an SEO plugin (usually Yoast SEO), an offsite backup tool, a security layer, an SMTP plugin for email delivery and caching that suits the host, then very little else. Most “best plugins” lists are written to earn affiliate commissions, which is why they recommend 25 things and every one has a discount link. This isn’t that. Our list is short on purpose.
What follows are the jobs nearly every site needs a plugin to do, what we look for when choosing one, and where we’ve learned the hard way. We name products where we have a firm view. Elsewhere, the right choice depends on your hosting, so we describe the criteria rather than pretend one product suits everyone.
The page builder (the one we don’t debate)
We build every WordPress site in Elementor Pro, so that’s always on the list. It also covers jobs that would otherwise need separate plugins: forms, popups, headers and footers, and most layout work. That’s a big part of why our lists stay short. If you’re tempted to add a slider plugin or a form plugin on an Elementor site, check first whether Elementor already does it.
SEO: usually Yoast SEO
Yoast SEO is the plugin we reach for most often. The free version handles the basics every site needs: editable title tags and meta descriptions per page, an XML sitemap, schema markup for your business name, logo and social profiles, breadcrumbs, and control over what Google should and shouldn’t index (thin archive pages, tag pages, attachment pages). Rank Math does a similar job, and some sites use it instead.
What we like is that Yoast is the best-known option, so whoever looks after the site next will recognise it. The gap worth knowing about is redirects, which are a Premium feature, so on the free version the usual pairing is the free Redirection plugin. What we turn off is just as important. The traffic-light scores are useful as a prompt, but chasing all green leads to keyword-stuffed headings that read badly. We set Yoast up properly once (business details, social profiles, which content types appear in search) and then ignore most of the nagging. We’ve written up our settings in Yoast SEO setup for small business sites.
One rule: one SEO plugin per site. Two will both try to write your title tags and sitemaps, and the results are a mess.
Backups
Every site needs automated backups that are stored away from the web server. That second part is where most setups fail. A backup sitting in a folder on the same hosting account is gone if the account is compromised, deleted or the server fails.
What we look for:
- Scheduled backups of both the files and the database
- Storage offsite, in a cloud bucket or a separate backup service
- Several copies kept, not just last night’s
- A restore process that’s been tested, not just a “download zip” button
Sometimes this is a plugin. On hosting that already takes reliable offsite backups, such as our own managed hosting and care plans, we may lean on the host’s system and add a plugin only as a second layer. Either way, someone has to know where the backups live and how to restore one.
Security
A security plugin is a layer, not a force field. Most of the real protection comes from updates, strong logins and decent hosting, which we cover in WordPress security for business owners.
What we want from the plugin side is fairly specific. Two-factor login for administrator accounts. Limits on repeated failed login attempts. Alerts when core files change unexpectedly. A way to see who’s logged in and what changed.
What we avoid is a security plugin that duplicates the host’s firewall, or one that’s so aggressive it locks out the client every second week. If your host runs a server-level firewall and malware scanning, the plugin’s job is mainly login protection.
Email delivery (SMTP)
This is the one people don’t know they need until enquiries go missing. Out of the box, WordPress sends email (contact form notifications, password resets, WooCommerce orders) using the server’s basic mail function, and a lot of that mail lands in spam or never arrives.
An SMTP plugin routes your site’s email through a proper sending service, authenticated against your domain with SPF and DKIM records (the DNS side is part of our business email and IT setup work). We check that it supports the sending service we’re using, that it logs every email sent (so we can prove whether a message left the site), and that it can alert us when sending fails. The full story is in why emails from your WordPress site go missing.
Forms and spam protection
On our builds, Elementor Forms does the form work. What we add is spam protection that doesn’t make customers solve puzzles. A hidden honeypot field catches a lot of the low-effort bots, and an invisible check such as reCAPTCHA v3 or Cloudflare Turnstile handles most of the rest.
If a site needs complex forms (multi-step quotes with calculations, conditional payments, file uploads into a CRM), we’ll sometimes use a dedicated form plugin. That’s a deliberate exception, not a default.
Caching and performance
Caching saves a ready-made copy of each page so the server doesn’t rebuild it from scratch for every visitor. On a builder site, it makes a noticeable difference.
The right caching plugin depends almost entirely on your hosting. If the server runs LiteSpeed, the LiteSpeed Cache plugin works hand in hand with it. Some managed hosts have caching built in and tell you not to add a plugin at all. Installing a generic caching plugin on top of a host’s own caching is a classic way to get pages that don’t update when you edit them.
We also want image handling sorted: images resized and served in a modern format like WebP, and lazy loading for anything below the first screen. Sometimes that’s the caching plugin, sometimes a separate image tool, occasionally the host.
The extras that depend on the business
After those six jobs, the list varies by business. A shop gets WooCommerce and a payment gateway. A practice might get a booking integration. A site with Google Analytics or ads tracking and a European audience might need a consent tool. A builder might get a projects post type.
Each one gets the same checks we use on everything, which we’ve written up in how many WordPress plugins is too many.
What we deliberately leave off
Plenty of common plugins never make it onto our sites:
- Second page builders or Elementor add-on packs with dozens of widgets when we’d use two
- Social feed plugins that load slow third-party scripts on every page
- Statistics plugins that store every visit in your own database, when Google Analytics does the job without the load
- “All-in-one” toolkits that bundle 40 features, of which you need three
- Anything nulled (pirated premium plugins), which often come with malware included
Check your own site against this
Log into your dashboard, open the plugin list, and see whether each of the six jobs above is covered exactly once. Then look at what’s left and ask whether you could explain each one to a stranger. Gaps in the six are worth fixing this month. Doubles and mysteries are worth cleaning up before the next update round.
Our web design builds start from this short list, with SEO foundations, Google Analytics, Search Console and Bing set up before launch. Found three backup plugins and no SEO plugin? We can sort that list out with you.