Best WordPress plugins: the essentials for each job

The essential WordPress plugins cover eight jobs, one plugin per job: an SEO plugin (Yoast SEO or Rank Math), a backup plugin (UpdraftPlus), a security plugin (Wordfence), a form plugin (WPForms Lite or Contact Form 7), a caching plugin if your host does not cache for you (WP Super Cache, or LiteSpeed Cache on a LiteSpeed server), an SMTP plugin (WP Mail SMTP), an image optimizer (EWWW Image Optimizer) and an anti-spam plugin (Akismet or Antispam Bee). Most blogs need six to eight plugins from this list, not all twelve.

Below: what each job is for, which plugin to pick and when you can skip a job entirely, with every plugin checked on the official directory on the same day.

Last updated: 7 November 2026

How were these WordPress plugins chosen?

A plugin list is only useful if the plugins on it are still maintained. Abandoned plugins stop getting security fixes and can break when WordPress updates. So every plugin in this guide had to pass four checks:

Open in the official directory. Every plugin is listed in the WordPress plugin directory. Plugins that are closed or removed from wordpress.org were left out.
Updated within the last 12 months. Every plugin below was updated between August and November 2026.
Tested with the current WordPress. Every plugin below lists “tested up to 7.1.4”, the version this site runs.
A clear job. Each plugin solves one real problem a blog has. No “nice to have” extras.

The figures come from the WordPress.org plugins API, checked on 7 November 2026. Active installs are rounded by wordpress.org (for example “5+ million”), and they change over time, so treat them as a sign of how established a plugin is, not as an exact count.

The list is capped at twelve plugins on purpose. Where two plugins are listed for one job, they are alternatives. Pick one, not both.

Which WordPress plugins are essential, at a glance?

Job	Plugin	Active installs	Last updated
SEO	Yoast SEO	10+ million	27 October 2026
SEO (alternative)	Rank Math SEO	4+ million	3 November 2026
Backups	UpdraftPlus	4+ million	26 October 2026
Security	Wordfence Security	5+ million	30 September 2026
Forms	WPForms Lite	5+ million	5 November 2026
Forms (alternative)	Contact Form 7	10+ million	29 October 2026
Caching	WP Super Cache	1+ million	2 November 2026
Caching (LiteSpeed servers)	LiteSpeed Cache	7+ million	3 November 2026
Email (SMTP)	WP Mail SMTP	4+ million	20 October 2026
Images	EWWW Image Optimizer	1+ million	29 October 2026
Spam	Akismet Anti-spam	5+ million	18 August 2026
Spam (alternative)	Antispam Bee	700,000+	23 August 2026

All figures: WordPress.org plugins API, checked on 7 November 2026.

If you have not installed a plugin before, read how to install a WordPress plugin first. If your site is brand new, the WordPress blog setup guide covers the settings to change before you add any of these.

Which SEO plugin should you use on WordPress?

Use Yoast SEO or Rank Math SEO. Both do the core jobs a blog needs: they let you write a custom title and meta description for each post, add canonical URLs, build an XML sitemap and add structured data (schema) so search engines understand what a page is about.

WordPress has created a basic sitemap on its own since version 5.5, at /wp-sitemap.xml. An SEO plugin usually replaces it with its own, so after installing one, submit the sitemap URL the plugin shows you in Google Search Console, not the old one.

Yoast SEO or Rank Math: how do you choose?

Yoast SEO (10+ million active installs, updated 27 October 2026) is the most widely used. Its listing describes automated meta tags, canonical URLs, XML sitemaps and Schema.org markup out of the box. It is a safe default if you want something that works with few decisions.
Rank Math SEO (4+ million active installs, updated 3 November 2026) uses modules you switch on and off, has a Google Search Console integration in the dashboard and offers one-click import from Yoast, All in One SEO and SEOPress. It suits you if you like to see more settings in one place.

Both work well for a blog. What matters is that you run only one, because two SEO plugins print duplicate title tags and sitemaps. If you switch later, use the import tool, then delete the old plugin.

An SEO plugin does not rank your posts for you. It handles the technical basics so you can spend your time on the writing. For what actually moves rankings, see these SEO tips for bloggers and the list of common SEO mistakes.

Which plugin should you use for WordPress backups?

UpdraftPlus (4+ million active installs, updated 26 October 2026) is the standard free choice. It backs up your files and database on a schedule or on demand, and it restores from the dashboard.

The free version sends backups to Dropbox, Google Drive, Amazon S3 (or compatible storage), Rackspace Cloud, FTP, DreamObjects, OpenStack Swift or email. The paid version adds more destinations, such as Microsoft OneDrive and Google Cloud Storage.

Three settings matter more than the plugin itself:

Store backups off the server. A backup that lives on the same server as the site is lost if the server is lost. Connect a remote destination.
Match the schedule to how often you publish. A blog that posts weekly could back up the database daily and files weekly.
Test a restore once. A backup you have never restored is a guess. Restore to a staging copy if your host offers one.

If your host already makes daily backups, keep the plugin anyway as a second copy you control. Some managed hosts are the exception: they block certain backup plugins because they put a heavy load on the server, so check your host’s rules first. The full comparison is in the guide to WordPress backup plugins.

Do you need a security plugin on WordPress?

For most self-hosted blogs, yes. Wordfence Security (5+ million active installs, updated 30 September 2026) is the most common pick. According to its listing, it includes an endpoint web application firewall, a malware scanner, two-factor authentication through any TOTP authenticator app, passkey login, a CAPTCHA for the login page and a live traffic view.

Turn on these features first:

Two-factor authentication for every administrator account.
The firewall, with the optimization step it suggests during setup.
Scheduled scans, with email alerts sent to an address you actually read.
Login limits, so repeated wrong passwords get blocked.

A plugin is one layer, not the whole job. Keeping WordPress, themes and plugins updated, using strong unique passwords and deleting what you do not use matter just as much. The setup guide lists the non-plugin hardening steps, such as turning off the dashboard file editor.

If your host or a service in front of your site already runs a firewall, you may not need every Wordfence feature. Do not stack two security plugins that both run a firewall. They slow the site down and can block each other.

Which contact form plugin should you use?

Every blog needs at least a contact form. Two plugins cover almost everyone:

WPForms Lite

WPForms Lite (5+ million active installs, updated 5 November 2026) is a drag-and-drop form builder with ready-made templates. Its listing says spam protection is built in, with optional hCaptcha, Google reCAPTCHA and Cloudflare Turnstile integrations. It is the easier option if you have never built a form.

The free version is the Lite edition of WPForms Pro. Features such as multi-page forms, file uploads and conditional logic are part of the paid Pro version, so check the plugin page if you need any of them.

Contact Form 7

Contact Form 7 (10+ million active installs, updated 29 October 2026) is free and open source, with forms written in a simple markup in a text box rather than dragged together. It is light and flexible once you learn the syntax, and its documentation lives on contactform7.com.

One thing to check before you install it: the current version (6.2.4.1) lists WordPress 7.1 and PHP 8.3 as its minimum requirements (checked on 7 November 2026). On an older WordPress or PHP version, the dashboard will not let you install it.

Whichever you pick, send yourself a test message right after setup. A contact form that silently fails to deliver email is worse than none. That is why the SMTP plugin below matters.

Do you need a caching plugin on WordPress?

Only if your host does not already cache pages for you. Caching saves a ready-made copy of each page so the server does not rebuild it with PHP and database queries for every visitor. It is one of the biggest speed gains for a blog.

Check three things before installing one:

Does your host include page caching? Many managed hosts do, and some block caching plugins because they conflict with the server’s own cache. WordPress.com, for example, lists WP Super Cache and W3 Total Cache on its list of incompatible plugins.
Which web server does your host use? This decides which plugin makes sense.
Do you already have one? Never run two caching plugins.

LiteSpeed Cache: only on LiteSpeed servers

LiteSpeed Cache (7+ million active installs, updated 3 November 2026) talks to the cache built into the LiteSpeed web server. Its own FAQ explains that the page cache features require OpenLiteSpeed, a commercial LiteSpeed product, LiteSpeed-powered hosting or the QUIC.cloud CDN. Its general features, such as CSS and JavaScript minification and image optimization, work on any server. If your host runs LiteSpeed, this is the plugin to use.

WP Super Cache: for other servers

WP Super Cache (1+ million active installs, updated 2 November 2026) is made by Automattic and turns your posts into static HTML files. Visitors who are not logged in and have not left a comment get the static file instead of a page built by PHP. The plugin offers an “Expert” mode that uses web server rewrite rules and a “Simple” mode served by PHP. Its own documentation recommends Simple mode, because Expert mode edits your .htaccess file and can take the site down if that goes wrong.

After turning on any cache, check in a private browser window that new posts appear. If something looks stale, clear the cache.

Why do you need an SMTP plugin on WordPress?

Because WordPress email often goes to spam or never arrives. Password resets, comment notifications and contact form messages all go through the WordPress wp_mail() function, which by default uses the server’s basic mail setup. Mail providers such as Gmail check whether an email really comes from the domain it claims to come from, and server mail often fails that check.

WP Mail SMTP (4+ million active installs, updated 20 October 2026) changes wp_mail() to send through a real mail service, either over SMTP or through a provider’s direct API (its listing names Gmail, Outlook, Amazon SES, Brevo and SendGrid among others). Setup takes three steps:

Pick a mail service and verify your domain with it (it will ask you to add DNS records).
Connect the plugin to that service with an API key or SMTP login.
Send the test email from the plugin’s settings and confirm it lands in the inbox, not spam.

If your site sends email at all, and nearly every site does, this plugin is not optional.

Which image optimization plugin should you use?

Large images are a common reason a blog loads slowly. EWWW Image Optimizer (1+ million active installs, updated 29 October 2026) compresses images as you upload them and can work through the ones already in your media library. Its free features, according to its listing, include unlimited optimization in a local mode that works on most hosts, lossless compression for JPG, PNG, GIF and SVG, and conversion to WebP.

Before adding any image plugin, know what WordPress already does on its own:

Lazy loading. Since WordPress 5.5, images get the loading="lazy" attribute so off-screen images load later.
WebP uploads. Supported since WordPress 5.8.
AVIF uploads. Supported since WordPress 6.5.

So you do not need a separate lazy-loading plugin. What core does not do is compress the photos you upload. The simplest habit is to resize images before uploading, to roughly the largest width your theme actually displays, and let the optimizer handle compression.

How do you stop comment spam in WordPress?

With an anti-spam plugin, as soon as comments are open. Two good options take different approaches:

Akismet Anti-spam (5+ million active installs, updated 18 August 2026) is made by Automattic and checks comments and form submissions against its service. After activation it asks for an Akismet API key. Its listing says keys are free for personal blogs, with paid subscriptions for businesses and commercial sites, so a blog that sells products or services needs a paid plan.
Antispam Bee (700,000+ active installs, updated 23 August 2026) blocks spam comments and trackbacks without captchas and, according to its listing, without sending personal information to third-party services. It is free and suits you if you want to keep commenter data on your own server.

If you do not want comments at all, you do not need either plugin for comments. Turn them off in Settings, then Discussion, and close comments on existing posts. You may still want spam protection for your contact form, which WPForms has built in.

Which WordPress plugins can most new blogs skip?

Every plugin is more code to update and one more thing that can break or be attacked. Skip a plugin when:

WordPress already does it. Sitemaps, lazy loading, WebP uploads and site health checks (Tools, then Site Health) are built in.
Your host already does it. Page caching, backups, a firewall and a CDN are often part of the hosting plan. Check before you duplicate.
Your theme already does it. Many block themes handle layouts that used to need a page builder.
It does the same job as a plugin you have. Two SEO, caching or security plugins cause more problems than they solve.

How many plugins should a WordPress blog have?

There is no magic number. Fifteen well-maintained plugins can be faster and safer than five abandoned ones.

A useful rule: you should be able to say in one sentence why each plugin is installed. If you cannot, deactivate it, check the site still works, then delete it. Deactivated plugins still sit on the server, so do not leave them there “just in case”.

Before adding any plugin that is not on this list, run the checks in the section on how to judge a plugin before installing it: last updated date, active installs, compatibility with your WordPress version and how the developer answers support questions.

In what order should you set up these plugins?

Order matters, because some plugins protect the work you do with the others. On a new blog, go in this order:

Backups. Install UpdraftPlus, connect remote storage and run a first backup. Now every later change is reversible.
Security. Install Wordfence and turn on two-factor login for your admin account.
SMTP. Install WP Mail SMTP and confirm the test email arrives. Security alerts and form messages depend on it.
SEO. Install one SEO plugin, run its setup wizard and submit its sitemap in Search Console.
Forms. Build your contact form and send a test message.
Spam. Install Akismet or Antispam Bee if comments are open.
Images. Install EWWW and optimize existing images.
Caching last. Turn it on only after everything else works, so you are not testing changes against a cached page.

After each plugin, load a few pages and check nothing broke. If something does, you know exactly which plugin caused it.

What mistakes should you avoid with WordPress plugins?

Installing pirated copies of paid plugins. The official WordPress hardening guide says to get plugins only from the WordPress.org repository or well-known companies, because plugins from untrusted sources can cause problems. A “free” copy of a paid plugin from a random download site is exactly that kind of untrusted source.
Running two plugins for the same job. Two SEO, caching or security plugins conflict.
Never updating. Turn on auto-updates for plugins you trust, or set a weekly reminder to update, with a backup first.
Skipping the test. Forms, email and backups all fail silently. Test each once.
Keeping a plugin because it was popular years ago. Check the last updated date again every few months. Plugins get abandoned.

Frequently asked questions

What are the must-have WordPress plugins for a new blog?

An SEO plugin, a backup plugin, a security plugin and an SMTP plugin cover the basics for almost every blog. Add a form plugin for your contact page, an anti-spam plugin if comments are open, and caching and image optimization if your host does not handle them.

Are free WordPress plugins safe?

Free plugins from the official WordPress.org directory that are actively maintained are generally a safe choice, and many of the most used plugins are free. Check the last updated date and active installs before installing, and avoid “free” copies of paid plugins from other sites.

Can I use Yoast SEO and Rank Math together?

No. Two SEO plugins create duplicate title tags, meta descriptions and sitemaps. Pick one. If you switch, Rank Math can import your Yoast settings, and then you delete Yoast.

Do plugins slow down WordPress?

Some do, depending on what they load and how they are built, not simply how many there are. Keep only plugins you need, avoid running two for the same job, and test your page speed after adding a new one.

How often should I update WordPress plugins?

As soon as practical after an update is released, especially security fixes. Turn on auto-updates for trusted plugins, or update weekly, and always keep a recent backup so you can roll back if an update breaks something.