Open your dashboard Plugins > Installed plugins and has thirty plugins. You don’t recognize five of them, and for two of them, you’re not sure if they still work. You can recognize good WordPress plugins and themes by their recent updates, compatibility with the current version of WordPress, a large number of active installations, and an active developer. Keep the number of plugins low, remove the ones you don’t use, and never install nulled versions.
In this guide, I'll walk you through how to choose, how to manage, and when to clean up, with a link to an article that goes into more detail on each topic.
Plugins and themes: What's the difference?
A WordPress plugin is software that adds functionality to your site, such as a contact form or an online store. You can think of them like apps on your phone, each of which you install for a specific task. A WordPress theme determines the design and layout of your site, from colors and fonts to the header and footer. In between is the page builder, a plugin that lets you build pages visually and therefore has a major impact on how your site looks. You can find out whether you need such a builder later in this article.
What plugins and themes have in common is that they are third-party code running on your server. So any error or vulnerability in that code becomes a problem for your site, even if you didn’t write it yourself. Outdated plugins are one of the most common causes you’ll see in How a WordPress Website Gets Hacked. A plugin determines what your site does, and a theme determines how it looks, but as the owner, you're responsible for both.
Do you really need a plugin for this?
For many tasks, you don’t need an additional plugin because WordPress, your theme, or your hosting provider already handles it. That’s why I always check what’s already available before installing anything. WordPress itself can do more than many people realize. The block editor builds pages with columns, buttons, and galleries, and WordPress automatically generates an XML sitemap. Many themes also have their own settings for colors, fonts, headers, and footers, so you don’t need a separate plugin for those.
The biggest savings are often found in hosting. With a good Managed WordPress Hosting run backups, malware scans, and a server-level firewall. On Surver’s shared hosting plans, these include automatic backups, Imunify for malware scans, and the ModSecurity firewall. Caching is handled by the LiteSpeed server in conjunction with a single caching plugin, and you can create a staging environment by cloning your installation in Installatron. Adding a backup plugin or a heavy-duty security plugin on top of that would largely duplicate the same work.
My rule is simple. Every plugin must perform a task that nothing else on your site already does. Having two caching plugins or a backup plugin in addition to the backups provided by your hosting provider won’t make your site any more secure—it’ll just slow it down—and yet we regularly come across these duplicates. What virtually every site does need, however, is an SEO plugin, a form plugin, and a cookie banner. You only need a spam filter if comments are enabled.
How to Evaluate a WordPress Plugin or Theme
You can evaluate a plugin or theme based on a handful of indicators from the WordPress plugin directory—the official repository at wordpress.org/plugins—or from the vendor’s website. The table lists, for each indicator, what constitutes a good sign and when you should look further.
| Signal | Where can you find it? | A good sign | Warning |
|---|---|---|---|
| Last update | Plugin page, “Last Updated” field” | Updates from the Past Few Months | No update for over a year (our rule of thumb) |
| “Tested up to” version | Plugin page, “Tested up to” field” | Current or previous version of WordPress | Note that the plugin has not been tested with recent versions of WordPress |
| Active Installations | Plugin Page | Thousands of active installations or more | Few installations and an unknown developer |
| Reviews | Reviews tab | Many reviews and positive recent reviews | Recent 1-star reviews regarding the same issue |
| Support Forum | Tab with support | Questions are answered and resolved | No response from the developer for months |
| Known vulnerabilities | WPScan or Patchstack | No open reports, or quickly closed | Unpatched Vulnerability |
| Source or developer | Plugin directory or the developer's website | Official plugin directory or well-known developer | Download from an unknown site |
No single indicator is proof on its own; it’s the combination that matters. A small plugin with few installations can be perfectly fine if the developer maintains it well. Conversely, popularity doesn’t automatically mean safety, because widely used plugins are particularly attractive targets for attackers. That’s why you should always read the recent reviews—not just the average rating. If I see a string of 1-star reviews about the same issue following the latest update, I’ll hold off on installing it.
Free or premium?
Premium isn’t automatically better than free. With a premium plugin, you pay for a license, which gives you access to updates and support. That’s also where the pitfall lies. If the license expires, you often stop receiving updates, and the plugin then behaves like an abandoned plugin, with the same risks. A “nulled” plugin is a cracked version of a paid plugin that often contains malware—and you should never install it. To find out why, read Why You Should Never Use Nulled Themes and Plugins.
Choosing a WordPress Theme
You choose a WordPress theme using the same criteria as for a plugin, plus a few points that apply specifically to themes. A lightweight theme loads only what you use, while an all-in-one theme sometimes comes with dozens of plugins that you’ll then have to maintain. Make sure the theme is responsive—meaning it works well on mobile devices—is accessible, and is compatible with your editor or page builder. If you want to customize the theme, do so in a child theme, which preserves your changes even when the parent theme is updated. You can find out how that works in Create a child theme and Install and customize a theme. If you'd rather not do that customization yourself, our webmaster service it for you.
How many WordPress plugins are too many?
There’s no magic number, because one bad plugin carries more weight than ten good ones. What does matter, however, is overlap between plugins, heavy plugins that load scripts on every page, and the number of plugins you can still keep track of yourself. A typical example is a form plugin that loads its scripts on every page, even though you only have one contact page. Moreover, every plugin is one more update to keep track of, so more plugins also mean more maintenance.
Measure it instead of guessing. Test the loading speed of a few pages before and after installing a plugin, and you'll immediately see the impact it has. You can read more about measuring and other causes of slow performance in Why Your WordPress Website Is Slow. My advice is to be strict. If you can't explain what a plugin does in a single sentence, it doesn't belong there. If you want to find out which plugin is slowing down your site, you can do so via WordPress Speed Optimization.
Keeping WordPress Plugins and Themes Secure
Maintaining a secure website means updating it promptly, monitoring vulnerabilities, and reviewing your site’s content every quarter. Most of the work lies in that regular routine, not in expensive tools. If you update your site every month and clean it up every quarter, you’ll prevent most of the problems we encounter on neglected sites.
Updates: When and How
Updates are your most important security measure because they patch known vulnerabilities. Before each update, a backup, even if it's just a small plugin. I always test major updates and updates to WooCommerce or your page builder first in a staging environment, a copy of your site where any errors won't affect visitors. For a WooCommerce online store, you'll also want to check the checkout and payment links after every update, and for that, there's WooCommerce maintenance.
You can Turn automatic updates on or off install per plugin. I only do that for developers I trust, and even then, I check after an update to make sure the site is still working. If something does go wrong, read what to do in the event of a Site Down After an Update.
Monitoring Vulnerabilities
A vulnerability is a flaw in the code that allows an attacker to do something they’re not supposed to, such as logging in or uploading files. Vulnerabilities in plugins and themes are published in databases like WPScan and Patchstack. A notification doesn’t necessarily mean your site has been hacked. Usually, an update is already available to fix the vulnerability, and in that case, updating is sufficient; however, if no update is available, you should replace the plugin. To learn how to keep track of these alerts, read Monitoring vulnerabilities in plugins. If a vulnerability has already been exploited and your site has been compromised, it becomes a recovery process, and for that, you can contact WordPress hacked.
The plugin audit: ten minutes every quarter
A plugin audit is a routine check of all the plugins and themes on your site. I compare it to the electrical panel, where you check once a quarter to see what’s still connected and what can be removed.
- Make a list of all plugins and themes via Plugins > Installed plugins and View > Themes.
- For each plugin, note what it does and whether you still use it.
- For each plugin, check the latest update and the “Tested up to” version.
- Search for known vulnerabilities by plugin in WPScan or Patchstack.
- Replace or remove unnecessary and abandoned plugins—after creating a backup, and if in doubt, test them on the staging environment first.
- Delete unused themes, except for one default theme to keep as a backup.
Cleanup: Outdated and Unused Plugins
If you don't use a plugin, delete it—because simply deactivating it isn't enough. The files from a deactivated plugin are still on your server and may still be vulnerable. You can recognize an abandoned plugin by a long period without updates and an inactive support forum. A premium plugin with an expired license falls into the same category, because it no longer receives updates. Also note that some plugins leave behind tables and settings in the database when you delete them. This is usually harmless, but after a major cleanup, it’s worth cleaning up the database as well.
Never delete anything without first backing it up, and if in doubt, test a replacement on the staging environment first. If your dashboard stops working after a plugin fails, disable it by renaming the folder using File Manager. The complete step-by-step guide, including how to replace a deprecated plugin, can be found in Clean up outdated and unused plugins.
Page Builders, Elementor, and Changing Themes
Page builders, Elementor, and theme changes each have their own article, because they have a greater impact on your site than the average plugin. A page builder affects every page, so any error in it will be immediately visible everywhere. If you’re unsure whether to use a visual page builder or the standard editor, read Page Builder or Block Editor. If you choose a page builder, stick to just one, because having two builders running side by side loads duplicate code and makes it difficult to switch later.
If you use Elementor, always update Elementor and Elementor Pro together; otherwise, you'll run into errors in the editor. You can find instructions on how to do this in Maintaining Elementor. You should never activate a new theme directly on your live site; always do so on the staging environment first, because menus, widgets, and layouts may shift. You can read the full guide in How to Switch WordPress Themes Without Breaking Your Site.
Where will you start today?
The best place to start is with the plugin audit above, beginning with the plugins you don't recognize. For each unknown plugin, find out what it does, and if no one knows what it's for, remove it after backing up your site. You can add new plugins via Plugins > New plugin, from the plugin folder or as a ZIP file. You can read step-by-step instructions on how to do this in Install, manage, and update plugins.
What we provide as standard at Surver saves you from having to install a few plugins. Backups, malware scans with Imunify, and the ModSecurity firewall are included in all shared hosting plans, so you don’t need a backup or security plugin. For a new WordPress installation, we install LiteSpeed Cache, Astra, and Elementor by default. You can add an SEO plugin (Rank Math) and a cookie banner (Complianz) as premium add-on purchase, and we'll set them up for you. If you don't want to manage plugins and themes yourself, we'll take care of that with WordPress maintenance. We update the core, themes, and plugins on a monthly basis; starting with the Business plan, a vulnerability scanner runs daily; and with the Enterprise plan, we test updates on the staging environment first.
Frequently Asked Questions
Are WordPress plugins safe?
Most of them do, as long as they come from a reliable source and are actively maintained. The main risk lies in outdated, abandoned, and compromised plugins. If you keep your plugins up to date and remove the ones you don't use, you'll significantly reduce that risk.
Are WordPress plugins free?
There are plenty, available through the official plugin directory on wordpress.org. Premium versions require a license, which you’ll need to continue receiving updates and support. So be sure to factor in the renewal cost when choosing a premium plugin.
How many themes can I have installed?
Your active theme, your child theme (if you have one), plus one default theme as a backup. You’ll need that backup theme in case your own theme ever fails. Delete all other themes, because even an inactive theme can be a security risk.
Do I need a cache or backup plugin for Surver?
Do not use a backup plugin, because Surver automatically creates server-level backups on shared hosting plans. For a cache plugin, use only LiteSpeed Cache, which works in conjunction with the LiteSpeed server and is automatically installed during a new installation. A second cache plugin is unnecessary.
