Your site is missing a contact form, a cookie banner, or a better search function—and there’s a plugin for just about every need. You can install a WordPress plugin via Plugins > Add New Plugin, where you locate the plugin and click on Install Now and then Activate clicks. Managing them means regularly updating plugins after backing them up, and not only deactivating but also deleting plugins you no longer use.
Choosing a Good Plugin
You can recognize a good plugin by its recent updates, compatibility testing with the current version of WordPress, a large number of active installations, and a support forum where questions are still being answered. Anyone can publish in the official plugin library on wordpress.org, so quality isn’t guaranteed. All these indicators are listed on the plugin page, in the right-hand column with details. I skip any plugin that hasn’t been updated in over a year, no matter how good the description sounds. There’s a good chance the developer has stopped working on it, which means new security vulnerabilities won’t be patched anymore.
My second rule of thumb is one plugin per function. Having two SEO plugins or two caching plugins running side by side can cause them to conflict with each other, and that kind of duplication is a classic source of vague errors that don’t become apparent until weeks later. On Surver’s shared hosting plans, LiteSpeed Cache is already installed by default, so a second caching plugin is unnecessary there. You can read about why that’s the case in Caching in WordPress Explained.
Incidentally, the number of plugins isn’t as important as you might think. A site with twenty well-maintained plugins can be faster and more secure than a site with five poorly built ones. What matters is that each plugin has a clear purpose and that someone is keeping it up to date. The broader context—including how to choose a theme—is covered in the guide Choosing and Managing Plugins and Themes.
Installing and Activating a Plugin
You can install a plugin from the dashboard, from the library, or as a ZIP file. Here's how it works in practice.
- Go to Plugins > Add New Plugin.
- Search for the plugin by name and check the developer, because names often sound similar.
- Click on Install Now and then on Activate. If you have a paid plugin as a ZIP file, click at the top on Upload a plugin.
- Go through the plugin's settings. Most plugins add their own menu item.
- View the front end of your site and test the feature the plugin is supposed to provide.
That last step is most often skipped, even though that’s exactly where you’ll spot a conflict with your theme or another plugin early on. A paid plugin usually also requires a license key to receive updates. Enter it right away; otherwise, you’ll end up with a plugin that will never be updated again without even realizing it. If you prefer to work from the command line, you can install and activate a plugin in one step using wp plugin install contact-form-7 --activate. WP-CLI is included in all of Surver's shared hosting plans, just like SSH.
Updating Plugins Safely
The safest way to update plugins is to first create a backup, then update them one by one, and immediately check whether your site is still working. Outdated plugins are one of the main entry points for hackers, so putting it off isn’t an option. At the same time, an update can sometimes cause issues, usually due to a conflict with your theme, another plugin, or your PHP version. You can create a backup yourself in Installatron, and you can read about how to restore it in Restoring a WordPress Backup.
Whenever there's a major version update, I always take a moment to read the changelog—the list of changes on the plugin page. For an online store, a payment plugin, or a page builder, I prefer to test the update first in a staging environment, a copy of your site that you create in Installatron by cloning your installation. After the update, check the pages where the plugin is active, your forms, and—if you have an online store—the checkout process. It’s better to update a few plugins each week—including this check—than to update thirty at once every quarter. If something goes wrong with that large batch, it’s nearly impossible to figure out which plugin caused the issue.
You can enable automatic updates for each plugin via the link Enable automatic updates in the plugin overview. I only do that for small, stable plugins. I keep critical plugins for payments, forms, and caching set to manual, so I can choose the timing myself. To learn how plugin updates fit into core and theme maintenance, read Update WordPress.
Deactivate, Remove, and Clean Up
If you no longer use a plugin, you should deactivate it and then delete it, because a deactivated plugin still remains on your server as code. An inactive plugin no longer performs any functions in WordPress, but with some vulnerabilities, someone could still access the files directly. Only after Delete They’re really gone. If you’re not sure whether a plugin still serves a purpose, deactivate it for a week and see if you notice anything missing. Pay special attention to shortcodes—the snippets of text enclosed in square brackets that a plugin replaces on a page with a form or slider. After you remove the plugin, they’ll suddenly appear as plain text on your page.
Schedule a clean-up session twice a year. Go through the list below Plugins > Installed plugins Go through them, remove anything that’s inactive, and ask yourself whether each active plugin still deserves to be there. Many plugins leave settings in the database after they’re removed. This is usually harmless, but be careful with options like ‘delete all data upon uninstallation’ in form or online store plugins, as these can erase submissions or orders. You can find out how to identify and replace abandoned and outdated plugins in Clean up outdated plugins.
If a plugin breaks your site
If your site breaks after an installation or update, the first thing you should do is deactivate the plugin you last modified. WordPress will often send an email to the administrator’s address with a link to recovery mode, which allows you to access the dashboard despite the error. If you see the message ‘A critical error has occurred’ or a completely blank page, then the article about the white screen of death continue.
If you can't access the dashboard at all, open File Manager in cPanel and rename the plugin's folder to wp-content/plugins, for example, to plugin-name-off. WordPress will then disable the plugin on its own. With WP-CLI, you can do the same with wp plugin deactivate plugin-name. If you don't know which plugin is causing the problem, rename the entire folder plugins and then put them back one by one.
At Surver, we make sure you have all the tools you need—from File Manager to WP-CLI—with daily backups and malware scans running in the background via Imunify. The actual updating is still your responsibility, unless you outsource it. Within WordPress maintenance We update the core, themes, and plugins on a monthly basis, and for Enterprise, we test updates on the staging environment first. Are you running on Managed WordPress Hosting, then that foundation is already in place for you. You can read more about identifying conflicts in Site Down After an Update.
Frequently Asked Questions
What is the maximum number of plugins I can use?
There's no set number. It's about quality and maintenance, not quantity. Don't use more than you need—one per function—and get rid of what you don't use.
Are free plugins safe?
Free plugins from the official library are fine, as long as they’re actively maintained. Never download paid plugins for free from other sites. These ‘nulled’ plugins often contain malware, and if something does go wrong, we’ll help you through WordPress hacked.
Does Surver update my plugins?
With hosting only, you do that yourself. If you sign up for WordPress maintenance and management, Surver will update your plugins monthly—with a level of monitoring that varies by package—and, starting with the Business plan, will scan for vulnerabilities daily.
