Which WordPress plugins does a small business site actually need?

Think in jobs, not in plugins

The plugin directory makes it tempting to install something for every idea you have. A better approach is to list the jobs your site has to do, then check whether WordPress, your theme or your host already does each one. Only the gaps need a plugin. Every plugin you add is extra code to update, another possible conflict, and one more thing an attacker might probe, so a short list is a feature in itself.

For a typical brochure site for a trade, consultancy, café or local service, the jobs are usually the same: let people contact you, help search engines understand your pages, keep spam out, make sure email arrives, and be able to recover if something goes wrong. Everything else is optional.

The core list for most business sites

1. A form plugin

WordPress has no contact form built in, and the free version of Elementor does not include its form widget. You need one form plugin. Choose one that stores submissions in the database as well as emailing them, so a lost email does not mean a lost enquiry. Our guide to WordPress contact forms covers the options and spam protection in detail.

2. An SEO plugin

WordPress handles the basics, but an SEO plugin gives you control over page titles, meta descriptions, social sharing previews and which pages appear in your sitemap. Pick one of the established options and stick with it. Running two SEO plugins at once creates duplicate tags and confusing settings. The WordPress SEO basics guide explains which settings matter.

3. An SMTP or mail plugin

By default WordPress sends email through the server it runs on, and many messages from that route end up in spam or vanish. A mail plugin sends through a proper mail account or sending service instead. If your form notifications ever go missing, this is usually the fix.

4. Spam protection

If you allow blog comments, an anti-spam plugin saves a lot of clearing up. For forms, most good form plugins include a honeypot field or support a challenge service, so you may not need a separate plugin at all. If you do not want comments, switch them off in Settings, Discussion and the problem largely disappears.

5. Backups, unless your host does them

Backups are not optional, but a backup plugin might be. If your hosting already takes regular backups and you know how to restore one, a plugin duplicates that work. If it does not, install one and send copies somewhere other than the same server. See WordPress backups explained for what a sensible routine looks like.

Plugins you can often skip

Many plugins solve problems you may not have. Before installing any of these, check whether the job is already covered.

• Caching plugins. Some hosts cache at server level. A second layer of caching can cause stale pages or broken layouts. Test speed first and add caching only if it helps.
• Heavy security suites. Strong passwords, two-factor login, timely updates and a host that patches the server do most of the work. A large security plugin can slow the admin area and overlap with protection you already have.
• Page builder add-on packs. Bundles of extra widgets are often installed for one feature and then forgotten. Each pack loads its own code across the site.
• Social feed and share plugins. A simple link to your profiles usually does the job without loading third-party scripts on every page.
• "Coming soon" and duplicate post tools. Useful during a build, then forgotten. Remove them when the site is live.
• Analytics plugins that only paste a tracking code. Your SEO plugin, theme or a tag field may already let you add a script without a dedicated plugin.

How to choose a plugin for each job

When two plugins do the same thing, the deciding factors are rarely the feature list. Look at these instead:

1. Last updated. The plugin page shows when it was last updated and which WordPress version it was tested with. A plugin untouched for a long time is a risk.
2. Active installations and support threads. A widely used plugin with replies in its support forum is less likely to be abandoned.
3. Who is behind it. A plugin from an established developer with a paid version has a business reason to keep it maintained.
4. What it loads. Some plugins add scripts and styles to every page even when they are only used on one. Your speed test will show it.
5. How you leave. Can you export your data or settings? If you remove it, does it leave shortcodes or tables behind?

Avoid "nulled" copies of paid plugins from unofficial sites. They are a common way malware gets onto WordPress sites, and they never receive updates.

A simple plugin audit you can run today

Open Plugins in your dashboard and go through the list with these questions:

• Is it active? Deactivated plugins still sit on the server and can still be exploited. Delete anything you are not using.
• Do I know what it does? If not, deactivate it on a quiet day, check the site, and delete it if nothing breaks. Take a backup first.
• Do two plugins do the same job? Keep the better one.
• Is it up to date, and is it still maintained by its developer?
• Did someone install it for a one-off task during the build? Remove it.

Write the final list down somewhere, with a line on why each plugin is there. The next person to work on the site, including you in a year, will thank you.

Keeping the list healthy over time

Plugins are only as safe as their last update. Set a regular slot to review updates, read the changelog for anything major, and test key pages afterwards. The guide on how to update WordPress safely walks through the order and the checks.

If you would rather not do this yourself, the WP Managed plan at WP Web Hosting takes care of WordPress, theme and plugin updates and monitors uptime, and every plan comes with Elementor pre-installed, so you start with a builder and add only the few plugins you actually need.

Frequently asked