Plugins: What to Install and What to Avoid

Back in the first lesson, you learned that WordPress core does relatively little on its own, and that plugins add almost all the extra features you associate with real WordPress sites. This lesson is about choosing plugins wisely, because this is where most beginner WordPress sites go wrong.

What A Plugin Actually Is

A plugin is a package of PHP code that "hooks into" WordPress at specific points to add or change behavior, without you needing to edit WordPress's own files. This hook system is one of WordPress's most important ideas: plugin authors don't modify core files, they attach their own code to events WordPress already fires, like "a post was just saved" or "the page footer is about to be printed." That's why you can install and remove plugins without breaking WordPress itself, at least in theory.

Choosing Plugins Wisely

Before installing any plugin, ask what specific problem it solves. A beginner mistake is browsing the Plugins > Add New screen and installing anything that looks interesting: a slider plugin, three different SEO plugins "just in case," a random "speed up my site" plugin, a security plugin, another security plugin because the first one felt incomplete. Each plugin adds its own code that runs on every single page load, its own database queries, and its own potential security surface. More plugins is not automatically better; it is almost always worse past a certain point.

A good filter for picking plugins: does it have a recent update (within the last several months, ideally)? Does it have a reasonably large number of active installs and decent reviews? Is its specific job clear, or does it claim to do fifteen unrelated things at once ("all in one SEO, security, speed, and backup" plugins are often weaker at each individual job than focused alternatives)?

Also check for overlap. Running two SEO plugins at once, or two caching plugins at once, often causes conflicts rather than double the benefit, because they can both try to control the same behavior (like generating sitemap files or managing cached page output) and step on each other.

Avoiding Risky Plugin Sources

A category of plugin to be especially careful with: anything offering "unlimited everything for free" when similar tools charge money, especially from unknown sources outside the official WordPress.org plugin directory or a reputable premium marketplace. Downloading plugin ZIP files from random websites is one of the most common ways WordPress sites get compromised, because that code runs with full access to your site and database.

Here's a simple starter set many real sites use, without over-installing: one SEO plugin, one caching/performance plugin, one security/firewall plugin, one backup plugin, and then whatever specific-purpose plugins your site actually needs (a form plugin if you need contact forms, a gallery plugin only if you actually need a complex gallery). That's it for most small business sites; you do not need twenty plugins to run a solid site for someone like Tony Stark's consulting business.

Installing And Troubleshooting Plugins

When installing a plugin from the dashboard, the flow is: Plugins > Add New, search, Install Now, then Activate. For plugins outside the directory, you instead upload a ZIP file through Plugins > Add New > Upload Plugin. Either way, right after activating any new plugin, check your site's front end immediately to make sure nothing visibly broke; some plugin conflicts show up instantly.

A quick, safe way to find out which plugin is causing a problem later on, if your site starts behaving oddly: deactivate all plugins except one, check the site, then reactivate one at a time until the problem reappears. This "elimination" approach is slower than guessing but far more reliable, and it avoids the common beginner trap of blaming the wrong plugin.

It's also worth separating "must-have" plugins from "nice-to-have" plugins in your own head before you ever open the Add New screen. A contact form plugin, for a business site, is usually a genuine must-have, because without it visitors have no way to reach you at all. A fancy animated testimonial slider, on the other hand, is a nice-to-have at best, and often actively hurts the speed and simplicity of a page without adding much real value for the visitor.

Try This Challenge

A small challenge: open Plugins > Installed Plugins on your site right now (even a fresh install usually has a couple of default plugins), and for each one active, write down in your own words what job it does. If you can't explain why a plugin is active, that's a strong signal to research it, or deactivate it and see if anything breaks.