There are roughly 60,000 plugins in the WordPress directory.
For a trades business in New Zealand — a plumber, a flooring installer, a welding shop — the relevant number from that directory is somewhere between three and five. Possibly four. Probably not more.
Same for a hospitality business. A professional services firm. A local e-commerce operation. In every case, the number of plugins that genuinely move the needle for that business is a single-digit figure. The rest are irrelevant to that business at best, and a maintenance liability at worst.
That is not a simplification for the sake of a neat number. It is the pattern that emerges when you manage around 200 WordPress sites across multiple verticals for years and compare which plugins recur in the sites that run quietly against which ones recur in the support queue.
The answer is usually the same shape: four or five matter for any given type of business. A hosting provider who can name them for your vertical, and say why, has done work that a longer list does not require.
The Paradox of 60,000 Choices
The plugin directory is a genuine achievement. Twenty-odd years of open-source development since WordPress launched in 2003, tens of thousands of contributors, and a working market of free and commercial products covering most WordPress use cases.
For a specific business with a specific website, almost none of it is relevant. Consider what “60,000 plugins” means in practice.
First: the distribution is radically skewed. The top 100 plugins account for a disproportionate share of all active installs across the ecosystem. Plugin usage is not a bell curve — it’s a power law with a very long tail. The tail is mostly: plugins that were built for a specific use case in 2015, received security patches until 2018, and are now technically present on the directory but functionally abandoned.
Second: Patchstack’s 2024 vulnerability research found that 97% of reported WordPress vulnerabilities came from plugins, not WordPress core. Core is maintained by hundreds of developers under intense scrutiny. Each plugin is maintained by someone else — sometimes a team, often a solo developer, sometimes nobody anymore. Each plugin you install is a dependency on someone’s continued motivation and available time.
Third, and this is the part the comparison posts skip: the choice between Plugin A and Plugin B in most categories changes very little for most businesses. Both Yoast and Rank Math will do what a professional services firm needs from an SEO plugin. Both Gravity Forms and WPForms will handle a tradie’s enquiry form. The ten-article debate about which one is marginally better in edge cases a small business will not reach is not a useful debate for a site that needs to take enquiries.
The choice question — “which plugin should I use?” — is almost always the wrong question. The right question is: “how many of these do I actually need?”
What “Essential Plugins” Lists Get Wrong
The term “essential WordPress plugins” has been used to justify some of the worst advice in the WordPress content space.
I’ve read these lists for years. “The 30 Must-Have Plugins.” “50 Essential Plugins for Every WordPress Site.” “The Ultimate Plugin Stack.” They are generally structured as: SEO plugin, security plugin, caching plugin, forms plugin, page builder, backup plugin, image optimisation plugin, social sharing plugin, related posts plugin, table of contents plugin, cookie consent plugin, login security plugin, analytics plugin, spam protection plugin, broken link checker, database optimiser, maintenance mode plugin…
Each of these is described as “essential.” None of them actually are — not in the sense that most businesses will notice their absence.
Many of these lists carry affiliate links, and the incentive that creates points one way: more recommendations, not fewer, weighted towards the products with the better affiliate terms rather than the ones that suit the site. The bigger problem is that they are written for a generic “WordPress site”, so a restaurant, an e-commerce store and a builder’s portfolio get the same list as though they had the same job to do.
They don’t.
The plugin that matters for a restaurant is a reservation or booking plugin — something the typical “essential plugins” list either doesn’t mention or buries at position 23. The plugin that matters for a builder is a portfolio gallery that loads fast on mobile, because tradies’ customers browse on phones. The plugin that matters for a law firm is a GDPR-compliant contact form with file upload capability, because they’re collecting sensitive documents.
The one-size-fits-all essential list is not just unhelpful. It actively creates plugin bloat, because it teaches people that a “complete” WordPress setup requires thirty plugins, and any site running fewer than thirty must be incomplete somehow.
What Actually Recurs
We manage around 200 WordPress sites. Rather than argue from impression, we queried the fleet directly — reading the active plugin list out of every site database we host. The figures below come from 186 live sites where that data was readable.
Six categories account for almost everything:
- SEO — 86% of sites, overwhelmingly Yoast
- Forms — 77%, mostly Formidable and Contact Form 7
- Page builder or block suite — 68%, mostly Kadence, then Elementor
- Security — 56%, mostly Wordfence
- Caching — 31% as a plugin, because most of our caching happens at the server layer
- E-commerce — 28%, always WooCommerce
That’s six plugin categories. Not sixty. Not thirty. Six.
Now the uncomfortable half of the same query. We measured our own fleet rather than guess, and the median site runs 18 active plugins. The mean is 21. Seventeen percent run more than thirty.
We did not build most of those sites — they arrived with their plugin stacks already assembled, which is exactly how this problem propagates. But the gap between eighteen and five is the entire argument of this post, and we are not exempt from it. Closing that gap, site by site, is a large part of what the work actually consists of.
And critically: not all six appear on every site. A trades business with no e-commerce doesn’t need WooCommerce. A hospitality business without active content marketing doesn’t need a heavy SEO plugin. A professional services firm on a managed hosting platform with server-side security doesn’t necessarily need a security plugin running real-time traffic scans.
The six categories are a ceiling, not a floor.
The Vertical Breakdown
If “3-5 plugins per vertical” is the argument, the argument requires specificity. Here’s what it looks like in practice.
Trades Businesses
Plumbers, builders, electricians, flooring installers, welders, fabricators, painters, earthmoving contractors. The portfolio includes thirty-seven such businesses.
These sites exist to answer one question: are these people qualified and can I trust them? The answer is delivered through: a clear presentation of past work, a straightforward way to make contact, and a site that loads fast on mobile — because trades customers are browsing on their phones between jobs.
The plugin stack that serves this:
- A page builder (Elementor) — project gallery, service descriptions, about page
- A contact/quote form (Gravity Forms or WPForms) — the primary conversion point
- Caching (WP Rocket) — mobile performance is the job
Three plugins. Note what is deliberately absent: a backup plugin.
Backups are not on that list because on our platform they are not a plugin at all. File snapshots run every six hours, the database has point-in-time recovery to any second, and both are retained for thirty-five days — all at the infrastructure layer, underneath WordPress. A backup plugin would duplicate that work, consume the site’s own PHP workers and disk to do it, and store the result inside the very site it is meant to protect. Backups that live where an attacker with WordPress admin can reach them are not really backups. This is the clearest case of a category that belongs to the hosting platform rather than the plugin list, and one of the reasons a well-run platform lets you delete plugins rather than add them.
Possibly a fourth plugin if the business does consultations or inspections and needs a booking system. The SEO plugin is optional — a trades business in a specific geography is often served by a well-configured Google Business Profile and schema markup in the page builder, not a full SEO plugin running on every page load.
The worst-performing trades sites I’ve seen run twenty-five to thirty plugins, including social sharing buttons (trades customers don’t share websites on social media), a popup builder (alienates mobile visitors), a review aggregator that imports from Google (breaks when the API changes), and a maintenance notification plugin that hasn’t been deactivated since the site launched. None of these change the business outcome. They just add overhead.
Hospitality
Restaurants, cafes, catering operations, bars, lodges and tour operators. Sixteen sites in the portfolio.
The job is different here. The customer is asking: what’s the atmosphere, what do they serve, when are they open, how do I book? The plugin stack that answers this:
- A page builder — ambiance photography, menu presentation, location pages
- A booking or reservation plugin — the vertical-specific requirement; when the alternative is a phone number that rings during service, the bookings that do not get made are invisible
- WooCommerce — if the business sells products (wine, merchandise, gift vouchers, catering packages); otherwise not needed
- Caching — especially important for businesses with Google Business Profile traffic (peaks around lunchtime on mobile)
Three to four plugins depending on whether they sell products. The hospitality sites that run badly tend to have an events plugin, a social proof plugin pulling Instagram embeds, a popup for email list building, and a separate plugin for each of their delivery partner integrations — all things that could be handled either by the page builder, the booking plugin, or simply by linking to external platforms.
Professional Services
Marketing agencies, consultants, immigration lawyers, capital firms, accountants, HR documentation services. Forty-eight sites — the largest single vertical we host.
These businesses live and die by perceived credibility. The website’s job is: do they know what they’re doing, and would I trust them with my problem? The stack:
- A page builder — case study presentation, team profiles, service pages
- A contact or intake form — often with file upload for documents (Gravity Forms handles this; a generic form plugin often doesn’t)
- An SEO plugin — content marketing is typically the primary acquisition channel for professional services, so organic search matters in a way it doesn’t for a tradie
- Caching
Four plugins. The optional fifth is typically an email marketing integration if list-building is a primary growth activity. The sixth, seventh, and eighth are where the problems start: a chat widget that degrades Core Web Vitals, a social feed plugin that breaks when the API changes, a testimonials plugin that duplicates functionality already in the page builder.
E-Commerce
Florists, art galleries, specialty food, homeware, yarn and clothing. Sixteen sites.
WooCommerce is non-negotiable. Everything else is chosen for WooCommerce compatibility:
- WooCommerce — the stack
- A page builder with WooCommerce integration (Elementor has good WooCommerce support)
- Caching — with WooCommerce-aware exclusions (cart, checkout, account pages must not be cached)
- Security — slightly more important than average given payment data proximity, even with a third-party gateway
Four plugins — and again, no backup plugin. For e-commerce the platform-level backup matters more than anywhere else, because the database is the business: orders, customers and stock move continuously, and a nightly plugin-driven dump loses a day of trading. Point-in-time recovery to any second, taken below WordPress and stored outside the site, is the only backup posture that makes sense for a shop. No plugin can offer that, because a plugin can only run when the site is running. The WooCommerce extension ecosystem is where the danger lies: each extension that adds to WooCommerce is its own codebase with its own update cycle. A spa site in the portfolio was running seven WooCommerce-related plugins — core WooCommerce plus six extensions — and a single update lag in one extension cascaded into a broken product comparison feature that took multiple weeks to diagnose and fix. For most small e-commerce operations, the right number of WooCommerce extensions is zero to two.
The Caldera Problem (A Case Study in Plugin Dependency Risk)
Several professional services and trades sites in the portfolio were still running Caldera Forms when the issue was raised.
Caldera Forms was a respected, widely recommended forms plugin — it appeared on dozens of “essential plugins” lists. In 2019, Sandhills Development (the company behind Restrict Content Pro and Easy Digital Downloads) acquired Caldera. By 2021, Caldera had been sunset. Security updates ended. The plugin remained in the WordPress directory for a time but received no further development.
Sites that had been built with Caldera as their primary contact form mechanism — on the basis of a recommendation from an “essential plugins” list, or a developer’s personal preference, or a tutorial they’d followed years earlier — were left running a plugin with published end-of-life status, handling business-critical enquiries, until someone actively audited the situation.
This is not a hypothetical risk. This is what plugin obsolescence looks like in practice: a well-regarded plugin, recommended everywhere, becomes a liability over a three-to-five year window. Not through dramatic failure. Through a quiet process of abandonment that only becomes visible when you go looking.
The managed hosting provider who catches this, who tracks which plugins in their client base have reached end-of-life, who migrates those sites to supported alternatives before the vulnerability disclosure happens — that provider is delivering something genuinely valuable. Not more plugins. Better choices, fewer dependencies, and the operational vigilance to notice when those dependencies expire.
The Caldera situation is not unusual. It’s the expected outcome of a plugin ecosystem where any individual plugin is dependent on the sustained motivation of its authors, and that motivation has a half-life.
The postscript is the part worth measuring. The same fleet-wide query that produced the numbers above returns exactly zero sites running Caldera Forms today. Every one of them was migrated to a supported alternative. That migration was invisible to the site owners, produced no incident, and appears in no report — which is precisely the point. The work that prevents an outage never looks like anything.
“Which Plugin?” Is the Wrong Question
The WordPress community spends enormous energy on Yoast vs Rank Math, Gravity Forms vs WPForms, Elementor vs Divi. These comparisons are mostly noise. Within each category, the top two or three options all do the job for a typical SME.
The right question is: how many categories does this site need, and which single well-maintained plugin covers each one?
From managing around 200 sites, here is what we actually run, not what an affiliate table recommends: Kadence or Elementor for page building, Yoast for SEO, Formidable or Gravity Forms for forms, WooCommerce where there is a shop. Caching sits at the server layer for most sites rather than in a plugin. Security favours server-side protection over plugin-based scanning wherever possible — less overhead, same result. Backups are not a plugin at all.
Four to six plugins across four to five categories, chosen for longevity and ecosystem compatibility. Not thirty plugins chosen for affiliate revenue.
The Illusion of Choice
Of the 60,000 plugins in the directory, perhaps 10,000 are actively maintained with meaningful install counts, and something like 30 to 50 of those cover what most serious WordPress operations actually run. Choosing feels like research because the directory is large. The shortlist is not.
The rest, for a typical business site, are noise. Not all of them. There are plugins with small install counts that do specific things brilliantly for the use case they were designed for. There are niche vertical plugins — booking systems for specific industries, integrations with New Zealand-specific payment gateways, plugins built to solve problems that don’t exist outside a particular region — that have small footprints but genuine utility.
But the general-purpose tail — the hundreds of plugins offering marginal variations on capabilities already covered by the top 30, the SEO plugins that are worse than Yoast and Rank Math, the form plugins that can’t do what Gravity Forms does, the caching plugins that can’t match WP Rocket’s WooCommerce handling — these add noise to the decision without adding value.
The illusion of choice is this: because there are 60,000 options, choosing feels like it requires extensive research. Every “best plugins” article confirms this — here are thirty things to consider, here are the comparison charts, here is the matrix of features. The research takes time. The decision feels important.
But the actual decision, for most businesses, is: which of the five categories do I need, and which single well-maintained plugin covers that category? It’s a thirty-second conversation, not a three-hour research session.
The managed hosting provider who can have that thirty-second conversation with a client — who can say, here’s what you need and here’s why, with specificity and confidence — is delivering something the generic hosting platform and the “essential plugins” content farm cannot.
What This Means for How You Choose a Hosting Provider
The plugin question is, ultimately, a proxy for the hosting provider question.
A provider who says “we support all 60,000 plugins” is saying nothing useful. A provider who says “here are the five plugins that matter for your type of business, here’s why, and here’s how we manage their updates and monitor their dependencies” — that provider has done the thinking you haven’t had time to do.
The economics of this are clear. A managed hosting client who is regularly misled by “essential plugins” lists into running thirty-plus plugins is a client who will generate more support tickets, more conflict incidents, more upgrade failures, and more emergency recovery requests. For the provider, that’s more margin-eating support work. For the client, it’s more downtime, more frustration, more money.
Getting the plugin stack right is not a nice-to-have. It’s foundational. Five well-chosen, well-maintained plugins covering the actual needs of the specific business type — with a custom mu-plugin handling the small customisations that don’t need plugins at all, as covered in Truth #1: Fewer Plugins, More Custom Code — is a site that is maintainable, auditable, performant, and defensible when something goes wrong.
Thirty plugins covering the general-purpose recommendations of an affiliate blog is a site that is none of those things.
The Practical Question
If you’re running a WordPress site right now, the question is: which of these categories are actually present?
- Page builder (required for almost all business sites)
- SEO (required if content marketing is part of your acquisition strategy; optional otherwise)
- Forms (required if leads or enquiries are a business objective — which they usually are)
- E-commerce (WooCommerce, only if you’re selling)
- Caching (required; at the hosting layer or as a plugin)
- Security (required; at the hosting layer or as a plugin)
- Backups (non-negotiable — and if your host does this properly, not a plugin at all)
For most business sites, three to five of these are relevant. The rest — the social sharing plugins, the popup builders, the review aggregators, the dead Caldera forms, the slider plugins nobody’s actively using — are candidates for removal.
We run a free site audit that covers exactly this: plugin health, performance, security, and backup configuration. It takes about twenty minutes and there is no obligation attached. Most site owners are surprised by how much is running that nobody chose, and by how straightforward the cleanup usually is.
This is part six of The 11 Truths About Web Hosting. Read Truth #1 — Fewer Plugins, More Custom Code for the argument about replacing disposable plugins with a custom mu-plugin.
Free site audit: managedhosting.partners
