The default advice about the plugin repository seems to be to take everything on offer, and it shows up in the load times. I still open production sites running 40+ active plugins that could get by on a fraction of that. Choosing essential WordPress plugins in 2026 is mostly a subtraction problem.
Fourteen years of untangling messy WooCommerce builds taught me one rule of thumb: a site’s stability drops with every extra developer whose code you are running. There is still a baseline worth installing. The list below is what I keep, and each one is on it because writing that piece myself would be worse.
1. Jetpack, the controversial baseline
Jetpack gets dragged on Reddit for being bloated, and some of that is fair. It wins on one point anyway: if you look after fifty client sites, you do not want fifty different backup and security setups to keep straight. Jetpack gives you one WP-CLI friendly baseline for both. The real-time backup has pulled me out of more botched migrations than I want to admit.
2. Akismet, spam filtering you can forget about
Writing your own spam filter is a losing game, and Akismet already did it. The matching happens off-site, so bot submissions never pile up as wp_comments rows in your database. That alone earns it a slot on the backend side of the stack.
3. WooCommerce, if you are actually selling
WooCommerce is the most extensible e-commerce development platform WordPress has, and that is usually reason enough. One client decided otherwise and wired a payment button into a blog post with custom PHP transients. It worked for a while, then it stopped, and they lost three days of revenue. The standard plugin handles the race conditions a one-off script never will.
If you plan to extend any of these, When Good Plugins Go Bad: A Guide to WordPress Hooks covers the safe way to do it.
The performance gotcha: dequeuing what you do not use
The recurring problem with the beginner-friendly end of the plugin list is that assets load everywhere. A form plugin queues its CSS and JS on every page whether or not that page has a form, and your Core Web Vitals pay for it. Contact form plugins and WPForms are the usual offenders.
This is the snippet I drop into most builds so plugin assets only load on the pages that need them:
<?php
/**
* Optimization: Dequeue plugin scripts on pages where they aren't needed.
*/
function bbioon_optimize_plugin_assets() {
// Check if we are NOT on the contact page
if ( ! is_page( 'contact' ) ) {
// Dequeue common form scripts as an example
wp_dequeue_script( 'contact-form-7' );
wp_dequeue_style( 'contact-form-7' );
// Dequeue WPForms scripts
wp_dequeue_script( 'wpforms-elementor' );
wp_dequeue_style( 'wpforms-full' );
}
}
add_action( 'wp_enqueue_scripts', 'bbioon_optimize_plugin_assets', 99 );
?>4. Yoast SEO & Google Site Kit
Yoast writes the schema markup so you are not hand-rolling JSON-LD. Site Kit pulls the Search Console and Analytics APIs into the dashboard, which saves you bolting three separate tracking scripts onto your <head>. Two plugins, and the reporting side is done.
5. All-in-One WP Migration, for moving sites
Staging to production, or one host to another, this is what I reach for. It replaces serialized data properly, which is exactly where hand-rolled migrations fall apart. I have watched people burn an afternoon on broken image paths after a raw SQL search and replace mangled the serialized arrays. Let the tool do it, the way WordPress Developer Resources recommends.
On the ecosystem side, there is also Why the WordPress Plugins Team Name Change Matters.
6. Imagify & Page Optimize
Serving WebP is table stakes at this point, and Imagify handles the conversion through its APIs. Page Optimize, or a self-hosted equivalent like Autoptimize, concatenates your CSS and JS. Test both on staging first, because minification has a habit of breaking older code.
If auditing a plugin stack is eating your dev hours, I take that work on. I have been wrestling with WordPress since the 4.x days.
Stability over shiny objects
The point of a plugin audit is not a better feature list. It is a site that does not wake you up at 3:00 AM. Install things that are actively maintained and that do not fight your theme’s hooks, then read the code before it reaches production. Everything past that is optional.
