WordPress plugins I actually use in 2026 (and the ones I avoid)
Plugins I use, plugins I avoid. Only what works in production, not what sells well.
After 7 years of WordPress every day, my plugin list has stabilised. Not because there aren't other good ones, but because I've tried enough to know which ones break after six months and which ones hold up. Here you'll find what I install on client sites, what I don't install, and why.
SEO: Slim SEO (preferred) and Yoast
Today I install Slim SEO. It's free, does meta tags, schema, sitemap, breadcrumbs, Open Graph and 301 redirects with a reduced but sufficient set of options. If the site already has Yoast SEO installed, I leave it: I know it well from years, but it's heavy and invasive. It adds fields everywhere, fills the post editor with warnings, and often loads useless CSS and JS on frontend pages. On a new site I start with Slim SEO. On one that arrives with Yoast already configured and working, I don't touch it.
Forms: Contact Form 7
It's the most used in the world, I know it inside out from years. Tag-based syntax (old school), but once you understand the mechanism you configure any field in minutes. Doesn't save data to database by default (for that I use an add-on like Flamingo), doesn't have native conditional logic. For a standard contact form, a quote request form or a two-step form, it's still the right choice. If you need complex conditional logic or heavy CRM integrations, I move to Fluent Forms (paid). But for 90% of my clients' sites, CF7 holds up.
Anti-spam: WP Armour or Cloudflare Turnstile
reCAPTCHA has become slow. Each form load downloads three Google scripts from external domains, which slows TTFB and weighs on LCP. WP Armour is the direct replacement: free, does honeypot, JavaScript challenge and browser check without blocking the user. Cloudflare Turnstile is the alternative for sites already on Cloudflare: zero performance impact, simple integration via site key/secret key. On sites with high traffic or forms with many bots, Turnstile. On small, fast sites, WP Armour.
Cache: WP Fastest Cache
Lightweight and free. Does page cache, CSS and JS minification, lazy load, file combination, expires headers. Configuration in 10 minutes. Doesn't have the hundreds of options of W3 Total Cache (which is valid but requires attention), and doesn't cost like WP Rocket. For most WordPress sites I work on, WP Fastest Cache is the right compromise: visible speed, zero cost, minimal maintenance. If the client already has a WP Rocket license, I use it gladly, not worth migrating.
Cookies: Complianz and alternatives
The best today is Complianz. It has GDPR-compliant cookie banner and cookie consent, geo-IP (banner only for EU visitors), automatic integration with most tracking plugins (Google Analytics, Facebook Pixel, Hotjar) and blocks cookies before consent without manual configuration. CookieYes is a solid free alternative. More recently I've started evaluating FAZ and DigiConsent, both newer but already well-positioned for GDPR compliance. Rule: never a handmade cookie banner. Complianz costs configuration time (half a day), not the legal risks.
Security: Really Simple Security, WordFence, Solid Security
Three options depending on context. Really Simple Security (ex Really Simple SSL) is what I install most often: does SSL, mixed content fix, security headers, force login redirect. Light, does what it says. WordFence is the complete firewall: malware scanning, login limiter, 2FA, IP blacklist. I use it when the site is already under attack or when it runs on low-cost shared hosting. Solid Security (ex iThemes Security) is the middle ground: has more features than Really Simple Security without being as heavy as WordFence. The choice depends on the site, not the most famous plugin.
Backup and migration: 4 plugins, different uses
UpdraftPlus for regular backups of small sites: complete free version, storage on Google Drive and S3, one-click restore. WPvivid for medium-large sites: full backups + internal staging, clear interface. Migrate Guru I use almost exclusively for heavy migrations (>5GB) between different hosts: it moves the site via their server, doesn't consume resources on yours, zero timeout. WP Staging (paid, from €69/year) when I need to test updates on business sites: backup + staging + push to production with one click. The plugin that has saved me from the most post-update disasters.
Redirects: Redirection or .htaccess
On Apache hosts, for 1-2 redirects I write directly in .htaccess. For sites with dozens of redirects, migration in progress or 404 errors to monitor, I use the Redirection plugin: simple interface, 404 log, redirect export/import, regex support. Doesn't make sense to install a plugin for three static redirects, doesn't make sense to write fifty redirects by hand from the command line.
Admin: Admin Site Enhancement
Few people know it, it's free, and it replaces 5 or 6 plugins you'd usually install for different things. Cleans the dashboard of useless elements (Gutenberg block, WordPress news, welcome meta box), manages user roles and permissions, improves the editor with custom columns and field visibility, manages post revisions, and optimises Gutenberg loading. Just one, free, frequently updated. If you manage 10 WordPress sites, this saves you an hour a month per site.
Page builder: Elementor (preferred)
Between Elementor and Gutenberg, I prefer Elementor. More control over layout, clear visual structure, end client understands what they're modifying, no need to touch code to align a button or change padding. Yes, it generates a bit more CSS than Gutenberg, but with WP Rocket or WP Fastest Cache the weight is controlled. On new sites I start with Elementor, not Gutenberg. On an existing site made with BricksBuilder or a custom theme, I don't touch it: migration isn't worth it.
The plugin I always uninstall
Jetpack. Too many useless features (internal stats inferior to GA4, security below WordFence, redundant block editor), slows the site, requires WordPress.com account. Jetpack is the plugin I most often uninstall when I take over an existing site.
If the article made you realize your site has the same problem, email me. Written estimate within 48 hours, €45/h fixed.