Every WordPress site runs plugins. The question isn’t whether to use them — it’s which ones actually earn their place. This list is built from day-to-day development work: the plugins that appear on every new build, the ones worth paying for, and the combinations that cause more problems than they solve.
The 2026 landscape has shifted significantly from three years ago. Rank Math has displaced Yoast as the developer default. Bricks Builder has become a serious Elementor alternative. The ACF acquisition by WP Engine spawned a community fork. And AI-assisted plugins have gone from novelty to a category of their own. This list reflects that.
SEO Plugins
Rank Math is the developer recommendation for new builds. The free tier includes built-in schema markup, keyword position tracking in the dashboard, a redirect manager, and a 404 monitor — features that require Yoast Premium (£99/yr) on that side of the fence. Rank Math Pro starts at $6.99/month and adds unlimited keyword tracking, analytics integration, and schema templates. One setup rule: if you’re migrating from Yoast, run Rank Math’s import tool first and verify all redirects transferred before deactivating Yoast. Running both simultaneously produces duplicate schema in <head>, which confuses Google’s structured data parser.
Yoast SEO remains the right call if you’ve inherited a site with years of Yoast configuration — redirects, schema overrides, breadcrumb settings. Migrating carries risk that isn’t worth it on a mature site. The free tier covers the basics; Premium ($99/yr) adds a redirect manager that’s genuinely useful after domain migrations or permalink structure changes. For SEO plugin comparisons and setup guidance, see the full WordPress SEO plugins breakdown.
Security Plugins
Wordfence is the standard: a web application firewall (WAF), malware scanner, login protection, and real-time traffic monitor in one plugin. The critical caveat on the free tier is the 30-day intelligence delay — threat definitions reach free users a month after Premium subscribers, which matters for zero-day exploits. For most informational sites this is acceptable. For any WooCommerce store handling payment data, Wordfence Premium ($119/yr) or a DNS-level firewall like Sucuri is the right call. Never run Wordfence simultaneously with Solid Security — you get two WAFs competing for the same hooks, inconsistent firewall rule application, and a login-lockout nightmare when they disagree on a request. For a full rundown of security plugin options, see the top WordPress security plugins comparison.
Solid Security (formerly iThemes Security, acquired by StellarWP) is useful specifically for its security audit wizard, which walks non-technical site owners through brute-force limits, 2FA enrollment, and database table prefix changes in one guided flow. It’s the better choice when the person managing the site isn’t a developer and needs hand-holding through hardening steps. Avoid stacking it with Wordfence — pick one security plugin, not two. For the full picture on securing WordPress, the WordPress security best practices guide covers config beyond what any plugin does automatically.
Performance and Caching
WP Rocket ($59/yr) is the caching plugin I recommend to clients who don’t want to think about caching. Page caching, GZIP compression, lazy load, link prefetch, database cleanup, and WooCommerce-aware cache exclusions are all pre-configured sensibly out of the box. The WooCommerce rules alone (excluding cart, checkout, and account pages from cache, clearing cache on order status change) save hours of manual configuration that W3 Total Cache requires. Clear cache after every content or settings change. For a head-to-head breakdown of caching options, WP Rocket vs W3 Total Cache vs LiteSpeed Cache covers the trade-offs in detail.
LiteSpeed Cache (free) is the right choice on LiteSpeed Web Server hosts — Cloudways, NameHero, and some Kinsta/WP Engine tiers. On Apache or Nginx, the server-level optimisations that make LiteSpeed Cache outstanding simply don’t apply. If you’re on Apache/Nginx and want a free solution, W3 Total Cache is the next option, though its configuration depth is intimidating — the defaults are not safe to use as-is.
Autoptimize (free) handles JS/CSS minification and combination. Pair it with LiteSpeed Cache for a solid free performance stack. Do not combine it with WP Rocket — they both rewrite asset URLs and the conflict produces broken stylesheets in roughly half of tested configurations.
Backup
UpdraftPlus is the standard. The free tier supports scheduled backups to Google Drive, Dropbox, Amazon S3, or Backblaze B2, with configurable retention (set 30 daily + 3 monthly as a baseline). The Premium version ($70/yr) adds incremental backups — important for large databases where a full backup on every run takes too long — and in-dashboard restore without FTP access. The most important rule with any backup plugin: test a restore quarterly. Configuration drift and database permission changes are the two things that make a backup exist but fail when you actually need it. For a complete backup and disaster recovery plan, see the WordPress backup guide.
Contact Forms
WPForms is the right choice for most sites. Clean drag-and-drop builder, accessible markup, and native addons for Mailchimp, HubSpot, Zoho CRM, and Stripe. The free version (Lite) handles basic contact forms. The Elite tier ($299/yr) unlocks conditional logic, multi-page forms, and CRM integrations — which sounds expensive until you price out alternatives. For spam protection on any WPForms installation, add hCaptcha or enable WPForms’ built-in anti-spam token — the honeypot alone isn’t enough on high-traffic pages.
Gravity Forms ($59/yr) is the developer-first choice. The gform_after_submission hook, Entry add-ons, conditional logic routing, and native REST API integration make it the standard for complex multi-step forms and custom CRM pipelines. Not the right tool for a simple contact form — overkill and the interface reflects it. For a full plugin-by-plugin comparison, the best WordPress contact form plugins guide covers WPForms, Gravity Forms, and CF7 head to head.
Contact Form 7 (free): still running on millions of sites and still a valid choice for a single contact form on a low-traffic page. Two things are required alongside it: anti-spam protection (hCaptcha, CleanTalk, or Akismet — CF7’s built-in honeypot isn’t enough) and Flamingo for entry storage. CF7 alone stores no submissions — if your email delivery has a problem, you lose every form entry silently.
Custom Fields
Secure Custom Fields (free) is the community-maintained fork of ACF Free, now under WordPress.org’s stewardship following the WP Engine acquisition controversy in late 2023. The get_field() and the_field() API is identical to ACF Free — it’s a drop-in replacement for any site that was on ACF Free. If you’re starting fresh and only need basic key-value meta fields, use SCF. It will remain actively maintained as long as WordPress.org has skin in the game.
ACF Pro ($49/yr, now under Delicious Brains) remains the developer standard for Repeater fields, Flexible Content layouts, and Options Pages — none of which are available in the free fork. If you’re building a site where editors manage complex structured content (repeating rows of team members, configurable page sections, site-wide global settings), ACF Pro’s field types have no real free-tier equivalent. For a detailed comparison of ACF Pro against Pods and MetaBox, see ACF Pro vs MetaBox vs Pods.
Page Builders
Elementor Pro ($59/yr) has the largest install base, the widest template library, and the deepest WooCommerce integration of any page builder. The honest trade-off: it loads 300–500 KB of CSS and JavaScript per page regardless of which widgets you use. Enable the “Improved Asset Loading” experiment in Elementor → Settings → Experiments to load only the CSS for widgets actually on that page — this alone drops per-page CSS by 60–70% on typical builds.
Bricks Builder ($149 one-time) is the performance-focused alternative. It generates cleaner HTML with fewer wrapper divs, produces scoped CSS per element, and consistently outperforms Elementor on Lighthouse scores. The trade-off is a steeper learning curve — it’s built for developers, not designers who want to click-and-drag. For any client build where LCP is a hard requirement, Bricks is worth the switch. For a full Elementor vs Divi vs Bricks breakdown, see the page builder comparison.
One principle worth stating clearly: for any site where Core Web Vitals matter, custom Gutenberg blocks backed by ACF fields produce better Lighthouse scores than any page builder. Page builders are a client editing concession — they exist so non-developers can manage layout. If the person maintaining content is a developer, skip the builder entirely.
E-commerce
WooCommerce (free) powers roughly 28% of all online stores worldwide. For physical products, mixed digital/physical catalogues, subscriptions (with the Subscriptions extension), and any store that needs a mature extension ecosystem, WooCommerce is the only serious choice. The REST API, order hooks, and product schema are the foundation almost every WooCommerce plugin in the ecosystem builds on. For performance-specific WooCommerce setup — database query optimisation, fragment caching, product search tuning — see the best WooCommerce extensions for boosting sales.
Easy Digital Downloads (free + Pro addons) is the right choice when you sell only digital files: software, ebooks, audio, or video. Its data model is lighter than WooCommerce (no physical product fields, no shipping tables, no stock management), and the Software Licensing add-on ($199/yr as part of the Pass) is the standard for WordPress plugin and theme authors selling licences with automatic update delivery. Switch to WooCommerce if physical products ever enter the catalogue — EDD’s product model doesn’t extend cleanly to physical goods.
AI Plugins
AI writing and content assistance plugins have matured enough to earn a section, though the category is still consolidating. Bertha AI and WP Content Pilot handle AI-assisted drafting directly in Gutenberg. AI Engine by Meow Apps offers a local GPT-powered chatbot and image generation via DALL-E. The performance overhead of AI plugins varies significantly — those making real-time API calls on the front end can spike TTFB under load. For a category breakdown of which AI plugins are worth it and which add bloat, see the best AI plugins for WordPress in 2026.
The Plugin Conflict Rule
The most damaging plugin mistake isn’t choosing the wrong plugin — it’s running two plugins that do the same job simultaneously. The three conflicts that appear most often in client audits:
- Dual SEO plugins (Yoast + Rank Math): duplicate schema output in
<head>, conflicting meta robots tags, and sitemap duplication. Google surfaces warnings in Search Console within days. - Dual caching plugins (WP Rocket + LiteSpeed Cache): competing page caching produces stale cache that bypasses both plugins’ invalidation logic. Symptoms are inconsistent: the cache clears correctly some of the time and silently serves stale pages the rest.
- Dual security plugins (Wordfence + Solid Security): two WAFs hooking into the same WordPress request lifecycle. Login lockouts that neither plugin’s admin panel can release are the most common emergency outcome.
Run one plugin per function. If you’re auditing a site you’ve inherited and find duplicates, deactivate and delete one before testing the other — don’t just deactivate both and reactivate one. The database options left behind by a deactivated plugin can still affect behaviour. For a systematic method for diagnosing plugin conflicts, see identifying and fixing WordPress plugin conflicts.
Summary: The Recommended Stack
For a typical WordPress site in 2026, this is the starting stack:
- SEO: Rank Math (new build) or Yoast SEO Premium (inherited site)
- Security: Wordfence (free for most, Premium for e-commerce)
- Caching: WP Rocket or LiteSpeed Cache (host-dependent)
- Backups: UpdraftPlus (free tier, offsite storage configured)
- Forms: WPForms or Gravity Forms (complexity-dependent)
- Custom fields: Secure Custom Fields (free) or ACF Pro (Repeater/Flexible/Options)
- E-commerce: WooCommerce or Easy Digital Downloads (product type-dependent)
Every plugin on this list should be tested on a staging environment before being activated on a live site. Plugin updates are the leading cause of site breakages — staging isn’t optional, it’s how you find out a WooCommerce update conflicts with your payment gateway before your customers do. Need help configuring this stack for your specific build? WordPress care plans cover plugin management, updates, and security monitoring as an ongoing service.
