There is no right number of plugins for a WordPress website. What matters is that each plugin does a job your website needs and is still maintained by its developer. A website with 30 well-maintained plugins is at less risk than a website with ten plugins, two of which have not been updated for years.
Every plugin is code from another developer that runs on your website. Each plugin has to be kept up to date, and each one can contain a vulnerability. In 2025, 91% of the vulnerabilities found in WordPress software were in plugins.
Read Keeping a WordPress website secure.
Which plugin functions are already built into WordPress?
Many websites have plugins for functions that WordPress itself already provides. WordPress gains new blocks and settings with every major version, and a plugin installed years ago often stays on a website long after WordPress has added the same function. Collapsible sections for frequently asked questions, for example, required a plugin until WordPress 6.9 introduced the ‘Accordion’ block.
Before you install a plugin, check carefully whether WordPress already offers the function. Click the plus icon in the editor and search the list of blocks, or ask your web developer. The same check applies to the plugins already on your website, as a plugin that WordPress has replaced can be removed.
How do you choose a WordPress plugin?
Before you install a plugin, open its page in the plugin directory on wordpress.org and look at the details next to the description. ‘Last updated’ shows when the developer last released a new version, and ‘Tested up to’ shows the newest version of WordPress the developer has tested the plugin with. A plugin that was last updated more than a year ago, or that has not been tested with the current version of WordPress, is a risk. ‘Active installations’ shows how many websites use the plugin, and ‘Issues resolved in last two months’ shows whether the developer answers questions in the support forum.
Choose one plugin for each job. Two plugins that do the same job, such as two caching plugins or two form plugins, can interfere with each other and double the number of updates.
When should a WordPress plugin be removed?
Remove a plugin when your website no longer uses it, when another plugin or WordPress itself now does the same job, or when the developer has stopped updating it. Deactivating the plugin is not enough. The files of a deactivated plugin stay on the server, and some vulnerabilities can be used even when the plugin is not active.
Before removing a plugin, check which pages depend on it. A form plugin removed by mistake also removes the forms on your website, including a membership sign-up form. Make a backup first, then remove the plugin:
- Open the ‘Installed Plugins’ screen.
- Click ‘Deactivate’ under the name of the plugin.
- Click ‘Delete’ under the name of the plugin.
Would you like us to go through the plugins on your website with you? Send us an email at hello@fourteenrockets.com.
