Every WordPress developer ends up with a default stack — the handful of plugins you install before you've written a single line of content, because you already know the site will need them. This is mine. It's not a "top 100" data dump and it isn't padded with affiliate bait. These are ten plugins that earn their place on a real, client-facing site, grouped by the job they do, with honest notes on where each one bites you.

One rule up front: this is a menu, not a shopping list. A brochure site doesn't need a membership plugin, and a static landing page doesn't need WooCommerce add-ons. Pick the three or four that match the problems you actually have. Every active plugin is code that runs on every request, a thing to keep updated, and a potential attack surface. Plugin bloat — not the wrong plugin — is the most common way WordPress sites get slow and insecure.

Security and spam

1. Wordfence Security

The first thing I install on a fresh site. Wordfence is an endpoint firewall plus malware scanner: it ships a managed rule set (the premium feed gets new rules in real time; the free feed runs about 30 days behind), brute-force protection, and two-factor auth that works without a separate plugin. The free tier is genuinely enough for most small sites. The honest caveat: the firewall runs as a PHP process, so on a heavily attacked site it adds load — if you're on managed hosting like Kinsta or WP Engine that already runs a server-level WAF, you may want Wordfence in scan-only mode to avoid doubling up. For lighter footprints, Solid Security (formerly iThemes Security) is a reasonable alternative.

2. Akismet Anti-Spam

Comment and form spam is a solved problem and Akismet solved it. It's bundled with core WordPress, maintained by Automattic, and catches the overwhelming majority of spam before it ever hits moderation. It's free for personal/non-commercial sites; commercial use requires a paid plan, which is cheap and worth it. If you'd rather not send content to a third-party API, Antispam Bee is a solid GDPR-friendly local alternative that does no external calls.

Performance

3. A caching plugin (WP Rocket, or a free alternative)

Caching is where you win or lose Core Web Vitals. The "good" Largest Contentful Paint threshold is under 2.5 seconds, and a slow TTFB on uncached PHP makes that almost impossible on shared hosting. WP Rocket is my default — it's premium-only (there is no free version), but page caching, lazy-loading, and a sensible set of optimizations are on with almost no configuration, which is exactly what you want for a client who will never touch settings. If the budget is zero, LiteSpeed Cache is excellent provided your host runs LiteSpeed/OpenLiteSpeed (or you point it at QUIC.cloud); otherwise reach for W3 Total Cache or WP Super Cache. Pick one — running two caching plugins is a classic way to white-screen a site.

4. ShortPixel Image Optimizer

Images are usually the single biggest chunk of page weight. A lean page lands somewhere around 500 KB to 1 MB; un-optimized hero images alone can blow past that. ShortPixel compresses on upload, converts to WebP and AVIF, and can resize oversized originals. WordPress core now generates WebP, but a dedicated optimizer gives you AVIF, bulk processing of your existing library, and finer control. Imagify (same company as WP Rocket) and EWWW are equivalent choices; EWWW can optimize locally without sending images to an external API if that matters to you.

SEO and content

5. Rank Math (or Yoast SEO)

You need exactly one SEO plugin to manage titles, meta descriptions, XML sitemaps, schema, and redirects. I default to Rank Math because its free tier includes things Yoast gates behind premium — multiple focus keywords, built-in redirections, schema templates, and 404 monitoring. Yoast SEO is the more conservative, battle-tested option and its content analysis is friendlier for non-technical editors. Either is fine; the mistake is installing both, which creates duplicate meta tags and conflicting sitemaps. Whichever you choose, connect Google Search Console on day one.

6. A custom fields engine: Secure Custom Fields or ACF

The moment a site needs structured content — team bios, properties, events, anything that isn't a blog post — you want custom fields done properly instead of stuffed into the post body. Note the 2024 fork: Automattic now ships Secure Custom Fields (SCF) in the WordPress.org repository, while Advanced Custom Fields (ACF) continues from WP Engine and is distributed from their own site. They're API-compatible today, but pick one source and stick with it so updates come from a single channel. Pair it with custom post types (register them in code, or with a UI plugin) and you've got a genuine content model rather than a pile of pages.

Forms, backups, and analytics

7. WPForms (or Fluent Forms)

Almost every site needs a contact form, and hand-rolling one with raw PHP and a mail() call is a deliverability and spam nightmare. WPForms Lite covers basic contact forms for free; the paid version adds conditional logic, multi-step forms, and payment fields. Fluent Forms is my pick when budget is tight and the site is form-heavy — its free tier is unusually generous and it's noticeably lighter on the front end than the big drag-and-drop builders. Whatever you choose, send transactional mail through a proper SMTP plugin (WP Mail SMTP) so form notifications don't land in spam.

8. UpdraftPlus

The plugin you hope you never need and will eventually be very glad you have. UpdraftPlus schedules full backups (files plus database) and pushes them off-server to Google Drive, Dropbox, S3, or wherever — which is the part that matters, because a backup sitting on the same disk as the site it's protecting is no backup at all. The free version does scheduled remote backups; premium adds incremental backups and one-click migration. If your host already takes automated off-site backups (most managed WordPress hosts do), verify they actually restore before you rely on them, and keep UpdraftPlus as your independent escape hatch.

9. Site Kit by Google

For analytics, Site Kit is the official Google plugin that wires up Analytics 4, Search Console, and PageSpeed Insights and surfaces the key numbers right inside the dashboard. It's free, first-party, and saves you from pasting tracking snippets by hand. If you're privacy-conscious or serving an EU audience and want to minimize consent-banner friction, a self-hosted, cookieless option like Independent Analytics or a hosted one like Plausible (via its plugin) is worth a look instead.

Migration

10. WP Migrate or All-in-One WP Migration

Sites move — staging to production, host to host, local to live. WP Migrate (the modern version of WP Migrate DB Pro) does proper push/pull of database and files with serialized-data-safe find-and-replace, which is the thing that breaks naive SQL exports. For simpler one-off moves, All-in-One WP Migration exports the whole site to a single file and imports it on the other end with almost no thought required — just mind the free version's upload-size limit on bigger sites. I install the migration tool last and remove it once the move is done; it doesn't need to live on the site permanently.

How to actually choose

Run down the list by job, not by hype. Security and a caching layer are near-universal. SEO is universal if the site wants traffic. Forms, custom fields, and analytics depend on what the site does. Backups are non-negotiable unless your host provably handles them. Migration is a tool you use and then uninstall.

If you take one thing away: fewer, well-maintained plugins beat a long list every time. Before adding anything, ask whether a few lines in your theme's functions.php or a snippet plugin would do the same job without dragging in a whole framework. Check each plugin's "last updated" date and active-install count before you commit — an abandoned plugin is a future security incident waiting to happen. The best WordPress stacks I've seen aren't the ones with the most plugins. They're the ones where every plugin installed is one someone can explain.

The 10 WordPress Plugins I Install on Every New Site