Which WordPress plugins does a business website need?
Fewer than most people install. A business site needs one plugin for each job it actually does, such as search visibility, enquiry forms, backups, security and speed, and nothing that repeats a job already covered. The best plugin is the maintained one that does that job well, not the one with the longest feature list.
- Start with five jobs: an SEO plugin, a form plugin, backups, security, and caching unless your host already caches at the server
- Add a plugin only when a new job appears, such as a shop, a second language, a cookie banner or redirects after a URL change
- Skip anything that duplicates a job you have already covered, or that has not been updated on wordpress.org in a year or more
What changed since this was first written
This post began in 2022 as a ranked list of ten popular plugins, each with a paragraph of praise. Two of those ten are no longer available: wordpress.org shows All in One Webmaster as closed since 15 December 2021 at its author's request, and Special Recent Posts as closed since 28 November 2017. A list that recommends a closed plugin is worse than no list.
The bigger change is in how to choose. A ranked top ten tells you what is popular; it does not tell you what your site needs. So this version is organised by job, with one plugin to start with for each and an alternative, and it tells you when you can skip the job entirely.
The best WordPress plugins, by job
| Job | Start with | Alternative | When you can skip it |
|---|---|---|---|
| SEO | Yoast SEO, 10,000,000+ | Rank Math SEO, 4,000,000+ | Never, but install only one of them |
| Enquiry forms | WPForms, 5,000,000+ | Contact Form 7, 10,000,000+, or Fluent Forms, 800,000+ | If your CRM's own form is embedded on the page instead |
| Backups | UpdraftPlus, 3,000,000+ | Your host's own backups | Only if the host keeps off-site copies and you have tested a restore |
| Security | Wordfence Security, 5,000,000+ | Kadence Security, 700,000+ | Check first if your host already runs a firewall and malware scans |
| Caching | LiteSpeed Cache, 7,000,000+, on LiteSpeed servers | WP Super Cache, 1,000,000+, or W3 Total Cache, 900,000+ | If your host caches at the server |
| Comment and form spam | Akismet, 5,000,000+ | Your form plugin's own spam protection | If comments are off and the form already filters spam |
| Image compression | Smush, 1,000,000+ | Compressing images before upload | If whoever uploads images always resizes them first |
| Redirects | Redirection, 2,000,000+ | Your SEO plugin's redirect feature, where it has one | Until a URL changes, then it is essential |
| Analytics | Site Kit by Google, 5,000,000+ | Adding the analytics tag directly | If the tag is already added another way |
| Cookie consent | Complianz, 1,000,000+ | A consent tool from your analytics provider | If the site sets no non-essential cookies |
| Online shop | WooCommerce, 7,000,000+ | A hosted shop platform linked from the site | If you do not sell online |
| More than one language | Polylang, 900,000+ | WPML, a paid plugin sold outside wordpress.org | If the site is in one language |
| Photo galleries | NextGEN Gallery, 300,000+ | The gallery block built into WordPress | For most business sites, which the built-in block covers |
The numbers are the active installs wordpress.org displays for each plugin, rounded down by wordpress.org itself, and each name links to that page. Every plugin in the table had been updated between 18 August and 26 October 2026 when it was checked. A big number tells you many sites trust a plugin, not that yours needs it.
Prices are left out on purpose. Several of these have paid versions or plans that change often, and Akismet, for example, lists a paid plan for commercial sites, so check each vendor's own pricing page. Property sites have their own set of plugins, compared in building a real estate website on WordPress.
Why fewer plugins is the point
Every plugin is code written by a different team, updated on its own schedule, and able to break the site on its own. Two plugins doing the same job, such as two SEO plugins or two caching plugins, are a common cause of slow pages and odd errors, because both try to control the same output.
Plugins are also where the running costs of a WordPress site collect: premium licences renew every year, and someone has to apply the updates. What a WordPress website really costs breaks those lines down, and what breaks when your host upgrades PHP shows why an old plugin is usually the first thing to fail. That upkeep is the main trade-off set out in the pros and cons of WordPress for a business website.
When no plugin does the whole job, whether a feature needs custom WordPress code walks through the alternatives before anyone writes any.
How to check a plugin before you install it
- When was it last updated? The plugin's wordpress.org page shows it. Months is normal; years is a warning.
- Is it tested with your WordPress version? The same page lists the latest version it has been tested with.
- Does it duplicate something you already have? If your theme or another plugin already does the job, do not add a second one.
- Are support questions answered? The support forum linked from the plugin page shows whether the authors reply.
- Whose name is the licence in? If a developer buys a premium plugin for you, the licence should belong to your business, not to them.
A plugin that disappears from wordpress.org is not always a warning about its code, since authors close plugins for many reasons. But the wordpress.org plugin guidelines say a plugin found to have security issues is closed until the issue is resolved, so a closed plugin still on your site needs looking at either way.
Once a plugin is installed, WordPress can update it automatically: the plugin and theme auto-updates guide (both sources checked 27 October 2026) explains how to turn it on per plugin. Pair that with backups you have tested restoring. If someone else is building the site, how to vet a WordPress developer covers the questions to ask about who applies updates afterwards.
The plugin job that matters most: what happens to an enquiry
A form plugin collects the enquiry. It does not reply to it, assign it, or remind anyone to follow up, and on most sites the submission ends in an email inbox where it waits. For a business site, that gap costs more than any missing plugin.
The fix is to send each submission into a CRM that replies straight away and tracks it to a booked call. How to connect WordPress to your CRM compares the three ways to do it, and replying to every enquiry within five minutes shows what that first response looks like.
GoHighLevel is the CRM we recommend for most small and mid-sized businesses, with HubSpot, Keap or ActiveCampaign where a team already uses them. Our CRM setup and management work covers that wiring, including a test submission through every form on the site.
Where AI helps, and where it does not
AI features are now built into several of the plugins above. Yoast SEO and Rank Math both describe built-in AI tools on their wordpress.org pages, and WPForms calls itself an AI form builder. Drafting a meta description or a first version of a form is a reasonable use, as long as a person checks what gets published.
What AI does not do is choose your plugins or keep them updated. The bigger gains come from automating the work around the site: an assistant that answers visitors' questions out of hours and books calls, which is what our AI automation service builds. When a site needs features no plugin offers, we build them as an application through our AI web and app development service.
Common questions
How many plugins should a WordPress site have?
There is no safe number, so count jobs instead of plugins. Most business sites need five to ten: SEO, forms, backups, security, caching where the host does not provide it, and a few more for jobs the site actually does. Twenty plugins doing twenty different jobs is fine; two plugins doing the same job is not.
Should I use Yoast SEO or Rank Math?
Either works. Both are widely used and actively maintained, with 10,000,000+ and 4,000,000+ active installs on wordpress.org respectively. Pick the one whose settings you find clearer, and never run both at once, because they control the same page titles and descriptions.
Do I need a caching plugin?
Only if your host does not cache pages at the server. Many managed WordPress hosts do, and adding a caching plugin on top can cause conflicts. Ask your host first; if it runs LiteSpeed servers, the LiteSpeed Cache plugin is the natural choice.
Are free WordPress plugins safe?
A maintained free plugin from wordpress.org is generally a reasonable choice, and the wordpress.org guidelines say a plugin found to have security issues is closed until they are resolved. Check when it was last updated and which WordPress version it is tested with, and remove any plugin you no longer use.
Can you set up the plugins and connect the forms to a CRM?
Yes. We build or tidy up the WordPress site, keep the plugin list short, and route every form into a CRM, usually GoHighLevel, that replies to each enquiry straight away. Work is quoted per project once the scope is clear (how our projects are priced explains why), so tell us about your site and we will plan it with you.
