There are over 60,000 plugins in the official WordPress directory. An average site I audit has 32 of them installed — and needs roughly 12. Every superfluous plugin lengthens the loading time, enlarges the attack surface and increases the likelihood of a conflict. In this pillar article I give you my annotated list for 2026 — structured by function, with a first recommendation and an alternative for each, plus my honest verdict on plugin categories you mostly do not need at all.
The rule of thumb: less is more
Before we get into individual plugins — a principle that nobody has disproved to me in ten years of WordPress training:
Every plugin has to justify its place in the back end. If you cannot explain in 10 seconds what it does and why you need it, out it goes.
In practice: a plugin audit once a quarter. I use a simple table for it (plugin, function, last used, keep/delete). Anyone who does this has a considerably leaner site after 12 months.
At a glance — my 12 categories
| # | Category | First recommendation | Alternative |
|---|---|---|---|
| 1 | SEO | Rank Math | Yoast SEO |
| 2 | Caching | WP Rocket | LiteSpeed Cache |
| 3 | Backup | UpdraftPlus | BackWPup |
| 4 | Security | Solid Security (Pro) | Wordfence |
| 5 | Spam protection | Akismet | Antispam Bee |
| 6 | Cookie banner | Real Cookie Banner | Borlabs Cookie |
| 7 | Forms | Fluent Forms | Gravity Forms |
| 8 | Newsletter | FluentCRM | MailPoet |
| 9 | Image optimisation | ShortPixel | Imagify |
| 10 | Duplicating posts | Yoast Duplicate Post | — |
| 11 | Page builder (optional) | Elementor / Bricks | Gutenberg + Kadence Blocks |
| 12 | WooCommerce extensions | depends on the shop | depends on the shop |
1. SEO plugin — a mandatory tool
First recommendation for 2026: Rank Math. More features in the free tier, a leaner implementation. A detailed comparison in my article Yoast SEO vs. Rank Math.
Alternative: Yoast SEO. If your site or agency already has it — no reason to switch.
2. Caching — you cannot do without it
First recommendation: WP Rocket. Paid (around €60/year), but the default settings work without configuration. Three clicks and the site is measurably faster.
Alternative: LiteSpeed Cache (free). Only sensible if your host runs LiteSpeed servers. Otherwise you get half the effect.
Deeper performance context: WordPress Page Speed 2026.
3. Backup — the insurance policy
First recommendation: UpdraftPlus. Free for local backups, the Pro tier for cloud targets (Google Drive, Dropbox, S3 and so on) at around €70/year.
Alternative: BackWPup. Open source, with a paid Pro version. Solid.
The full backup strategy is in my article WordPress backup strategy 2026.
4. Security — a plugin as the second line of defence
First recommendation: Solid Security. Formerly iThemes Security, renamed in 2024. The Pro version (around €99/year) offers 2FA, IP lockouts and file change detection. The free version is enough for many sites.
Alternative: Wordfence. Well known and powerful, but tends to be resource-hungry. Noticeable on slow hosts.
Important: a security plugin is the second line of defence. The first line is up-to-date WordPress, up-to-date plugins, a secure password and 2FA. More in WordPress security measures.
5. Spam protection — Akismet is enough
First recommendation: Akismet. An Automattic plugin that shares the comment spam database with all WordPress sites. Free in the hobby/solopreneur tier.
Alternative: Antispam Bee. Open source, more GDPR-friendly (no external servers). Slightly fewer catches, but sufficient for most sites.
6. Cookie banner — mandatory in German-speaking countries
First recommendation: Real Cookie Banner. Developed in Germany, very precise on GDPR, with a setup wizard. Paid from around €49/year.
Alternative: Borlabs Cookie. Likewise made in Germany, similarly precise, similar price.
What you do not need: free JavaScript banners without server logic that do not actually block cookies. More on the legal background in GDPR compliance Austria and GDPR compliance Germany.
Would you rather not test 32 plugins to find the right 12? In my online course I show you the plugin setup I install as standard on new client sites. → To the online course
7. Forms — Fluent Forms is the first choice in 2026
First recommendation: Fluent Forms. Fast, with conditional logic in the free tier and good mail routing. Pro from around €89/year.
Alternative: Gravity Forms. The industry standard for complex applications, but more expensive (from $59/year) and heavier.
Dispensable (or at least no longer the default in 2026): Contact Form 7. Functional, yes, but less comfortable and without a modern drag-and-drop approach.
8. Newsletter & marketing automation
First recommendation: FluentCRM. Newsletters, segments, automations — all within WordPress, with no SaaS subscription. Pro from around €129/year.
Alternative: MailPoet. Also integrated into WordPress, with its own mail sending service (paid at higher volumes).
If you already use Mailchimp or ActiveCampaign, you do not need an additional WP plugin — one is enough.
9. Image optimisation
First recommendation: ShortPixel. WebP conversion, AVIF, lazy loading. Paid per image credit, very cheap ($5 for 10,000 images).
Alternative: Imagify. From the WP Rocket makers, similar quality, slightly higher price.
A detailed comparison in ShortPixel vs. Optimole.
10. Duplicating posts
First recommendation: Yoast Duplicate Post. Free, works with the block editor, Elementor and WooCommerce. More in my how-to Duplicating WordPress pages.
11. Page builder — optional
If you need a page builder: Elementor or Bricks Builder.
- Elementor: market-leading, a huge add-on ecosystem, a good learning curve. The free version is enough for most; Pro (around $59/year) is worth it on commercial sites.
- Bricks Builder: released in 2022, very performant, a one-off purchase instead of a subscription. The professional choice for performance-obsessed sites.
If you do not need one: Gutenberg + Kadence Blocks or block themes. Modern WordPress gets very far with the block editor and FSE (Full Site Editing) — and is considerably faster.
A separate comparison can be found under Elementor versus other page builders.
12. WooCommerce extensions — depends on the shop
WooCommerce is a plugin itself, but I do not treat it here as a standard recommendation — either you have a shop, in which case you need it, or you do not, in which case you do not.
If you do, the most commonly used extensions are:
- Germanized for WooCommerce (German-speaking legal requirements)
- WooCommerce Subscriptions (subscriptions)
- WooCommerce Mollie / Stripe (payment — background in Stripe vs. Mollie)
More in the existing article WooCommerce for beginners.
Plugins almost everyone has and nobody needs
A list from my last 20 site audits:
- Jetpack (unless you use Akismet or VaultPress from Jetpack) — too much at once, many modules for functions you are better off solving individually.
- Hello Dolly — the classic. A fun plugin that ships with every installation. Deactivate or delete it.
- Sliders with a 50 MB library — if you do not need a slider, you do not need a slider. If you do: Swiper.js via a block or the Elementor carousel.
- Classic gallery plugins — the block editor plus the WordPress standard gallery are almost always sufficient today.
- "All-in-one" optimisers with 30 functions — they overlap with caching/SEO/security plugins → a risk of conflicts.
How to spot and avoid plugin conflicts
Symptoms: the back end hangs, the front end renders broken, a white screen ("WSOD"), the editor does not load.
Quick diagnosis:
- Deactivate all plugins except SEO and caching.
- Problem gone? Reactivate plugins one by one until the conflict returns.
- For the plugin causing the conflict: a) look for an alternative, b) contact the maker, c) in an emergency, patch it with a snippet.
A deeper introduction in my article Resolving WordPress plugin conflicts.
Plugins I do not recommend (even though they are popular)
- TablePress — good for data tables, but the block editor now has its own table blocks. Save the resources.
- WP Statistics or Slimstat — analytics inside WordPress is a bad idea: the database grows, and there is no automatic cookie consent. Better to use Matomo externally or GA4. More in the existing article Exporting Matomo data to Google Sheets.
- Click-to-tweet plugins — mostly superfluous JavaScript load.
- A plugin for every pixel tracker (Facebook, TikTok, LinkedIn) — better consolidated through GTM.
Frequently asked questions
How many plugins are "too many"?
There is no hard number. A site with 50 well-maintained, lean plugins can be faster than one with 10 resource-hungry ones. Even so: more than 30 active plugins is a signal to tidy up.
Are free plugins worse?
No. Many top plugins have an excellent free tier (Rank Math, UpdraftPlus, Akismet). Caution is only needed with small plugins that are no longer actively maintained — those become a security hole.
Should I buy premium plugins directly from the maker or via GPL marketplaces?
From the maker. GPL marketplaces are legally grey and often carry malware risks in the downloaded files. The plugin licence is your insurance against trouble.
Should I let plugins update automatically?
Security updates: yes, automatically. Major updates: no, manually and with a backup beforehand. More in the existing article WordPress maintenance checklist.
Do AI plugins for WordPress work?
Yes, the 2026 generation is usable. An overview in the existing article AI plugins for WordPress 2026.
Conclusion
Plugins are tools, not collectibles. With 10–15 carefully chosen plugins a WordPress site runs better than with 40 assorted tools. The 12 categories presented here cover a standard site solidly — anything beyond that should have a clear business reason.
If you want to set up a plugin architecture cleanly or clear out an existing one, my online course is the right route: together we analyse your specific installation and reduce it to what is genuinely necessary. → To the online course
Image source, featured & inline: illustrations created specifically in the pletzenauer design (no stock photos).
Tags