What Are WordPress Plugins? (And How Many Is Too Many)
A WordPress plugin is an add-on that gives your website a new feature without custom code: a contact form, backups, security, an online store, SEO settings. You install it from your dashboard, and it can be switched off or removed at any time. Every plugin also has to be kept updated, because most WordPress security problems start in plugins. See how we keep plugins updated and checked.
Your website does a dozen jobs: it takes enquiries, shows up in Google, backs itself up, and keeps hackers out. Almost none of that comes from WordPress itself. It comes from plugins, and most site owners never see how many are running.
We look after 105+ WordPress sites for small businesses, so we see plugins at their best and at their worst. This guide explains what plugins do, what the sites we maintain actually run, how many is too many, and how to keep them from breaking your site.
What does a WordPress plugin do?
A plugin adds one feature or fixes one job. WordPress gives you pages and posts; plugins turn that into a business website. Here is what the plugins on the sites we maintain actually do:
| Job | Plugin we use most |
|---|---|
| Backups | UpdraftPlus |
| Security and firewall | Wordfence |
| Speed and caching | WP Rocket |
| Redirects for moved pages | 301 Redirects |
| Contact and quote forms | Gravity Forms |
| SEO settings | Yoast SEO |
| Page design | Beaver Builder |
From the daily plugin inventory of the client sites we maintain, October 2026.
A plugin is different from a theme. The theme controls how the site looks; plugins control what it can do. You can change your theme and keep your plugins, and the other way around.
Free vs paid plugins
The official WordPress plugin directory lists more than 76,000 free plugins. Many free plugins also sell a paid version with extra features and direct support.
- Free plugins are fine for many jobs. Check that the plugin is updated often and that the developer answers support questions.
- Paid plugins usually come with a license you renew every year. The license is what delivers updates. When it lapses, the plugin keeps working but stops getting security fixes, which is how a site quietly falls behind.
We build a few plugins ourselves for WooCommerce and Beaver Builder sites, listed on our plugins page.
How many plugins is too many?
There is no magic number. A site with 30 well-kept plugins can run better than one with 10 neglected ones. What matters is whether each plugin is needed, updated and not doing another plugin’s job.
Most small business sites need a plugin for each job in the table above, plus a few for features their business depends on, such as bookings or an online store. The count matters less than these warning signs:
- Two plugins doing one job, such as two caching or two email plugins. They fight each other.
- Plugins that are switched off but still installed. Switched-off code can still be attacked, so delete what you do not use.
- Plugins nobody updates anymore. More on that in our guide to abandoned WordPress plugins.
Are WordPress plugins safe?
Most are, when they are kept updated. But plugins are where WordPress security problems start. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, and 91% of them were in plugins. WordPress core had only 6.
The harder number: 46% of those vulnerabilities had no fix from the developer by the time they were made public. That is why we watch for vulnerability reports, not just updates.
Before you install a plugin, check:
- Last updated. Within the last few months is a good sign; over a year is a warning.
- Active installs and reviews. Popular is not proof of quality, but it means problems get noticed and fixed.
- Compatibility. It should be tested with your version of WordPress.
- One job. If you already have a plugin for that job, you do not need another.
How to add and update plugins safely
To add a plugin, go to Plugins > Add New Plugin, search, click Install, then Activate. Paid plugins are uploaded as a zip file from the same screen.
Updating is where sites break. Plugin updates are constant: across the client sites we look after, we applied 1,403 plugin updates in the last 30 days. To keep that safe:
- Back up first, and make sure the backup lives off the server.
- Update, then check the site: the home page, your forms, and checkout if you sell online.
- Roll back from the backup if something breaks, then fix the conflict before trying again.
Our step-by-step guide covers the full process: how to update WordPress safely.
Rather not babysit your plugins?
Our plans update your plugins every day, check the site afterward, and fix anything an update breaks.
- Talk to a WordPress expertWe look at what your site runs and what it really needs.
- We clean up and set upBackups, monitoring and security are in place within 24 hours.
- You stop worrying about updatesWe handle them and send a plain-English report each month.
A real example: two plugins, one job, zero emails
A consultancy we look after called because customers could not get into their accounts. They clicked “forgot password,” the site said an email was on its way, and nothing ever arrived. 11 accounts were locked out when we looked.
The email service was fine. Two different mail plugins were installed and both switched on, each grabbing the site’s outgoing email and cancelling the other out. We switched one off, set up proper email delivery for the domain, and password resets started arriving the same session.
Curious what your site is running? Our free Uh Oh Score checks your site and shows what to fix first, with no sales call required.
Get my Uh Oh ScoreQuestions people ask
What are WordPress plugins used for?
Adding features without custom code: contact forms, backups, security, SEO settings, speed, online stores, booking calendars and much more. Each plugin usually handles one job.
Are WordPress plugins free?
Many are. The official directory lists more than 76,000 free plugins. Paid plugins usually cost a yearly license fee, and the license is what keeps the updates coming.
What is the difference between a plugin and a theme?
The theme controls how your site looks. Plugins control what your site can do. You can switch one without replacing the other.
Do too many plugins slow down a website?
They can, but quality matters more than count. One heavy or badly built plugin can slow a site more than ten small ones. Remove plugins you do not use and avoid two plugins doing the same job.
How often should plugins be updated?
As soon as updates are out and tested. Security fixes should go on within a day or two. On the sites we maintain, that means checking for updates every day.
How do I see which plugins my site uses?
Log in and go to Plugins > Installed Plugins. It lists every plugin, whether it is active, and whether an update is waiting.
Sources
- WordPress.org, Plugin Directory.
- Learn WordPress, What is a plugin?
- Patchstack, State of WordPress Security in 2026.
Keep your plugins working for you, not against you
We update, check and clean up the plugins on your WordPress site every day, and fix anything an update breaks.
Jonathan Wofford is the founder of Your WP Guy, a WordPress care and maintenance service supporting 105+ active client sites. He and his team keep WordPress sites fast, secure, and running, so business owners can stay focused on their business instead of their website.
