Caching
WP Super Cache — free, simple, works
If your host doesn't have built-in caching (InterServer, Hostinger basic plans), install this. One click to enable, generates static HTML files, cuts load time by 40-60%. I tested it against W3 Total Cache and LiteSpeed Cache — WP Super Cache is the least likely to break your site, and that matters when you're troubleshooting at midnight.
Skip this if you're on SiteGround (SuperCacher), Kinsta (built-in), or Cloudways (Breeze plugin pre-installed). Stacking cache plugins causes more problems than it solves. The rule: one cache plugin, max.
LiteSpeed Cache — if your host supports it
Hostinger runs LiteSpeed servers, and this plugin takes full advantage. Server-level caching, image optimization, CSS/JS minification — all in one plugin, all free. On a LiteSpeed server, it outperforms every other caching solution. I measured an 800ms to 280ms improvement on a Hostinger account after enabling it. On Apache/Nginx, it still works but you lose the server-level integration.
More on caching impact: WordPress Speed Optimization
Security
Wordfence — the standard
Firewall, malware scanner, login security, brute force protection. The free version is solid — real-time firewall rules are delayed by 30 days compared to premium, but that's acceptable for most sites. I run it on every site that doesn't have host-level security.
One complaint: it's heavy. Wordfence adds noticeable overhead to admin page loads — around 80-120ms on slower shared hosting. If your site is on Kinsta or SiteGround, their built-in security makes Wordfence unnecessary. See my WordPress security guide for the full setup.
SEO
Yoast SEO vs Rank Math — the honest comparison
Both are excellent. The choice comes down to what you value. Here's how they differ in practice:
Bottom line: Rank Math gives you more for free. But Yoast is more stable across theme/plugin combinations. Both update frequently. If you're starting fresh, Rank Math is harder to break in ways that hurt your SEO. If you're migrating from Yoast, the Rank Math importer works reliably.
Don't install both. Pick one.
Backups
UpdraftPlus — backup to cloud storage
Free version backs up to Google Drive, Dropbox, or S3. Schedule daily database backups and weekly full backups. One-click restore. I've used it to recover from broken plugin updates more times than I'd like to admit.
The premium version ($70/yr) adds incremental backups and more cloud destinations. Worth it if you're managing multiple sites. For a single site, the free version is enough. Full setup walkthrough in my backup guide.
Forms
WPForms Lite — contact forms without the bloat
Drag-and-drop builder, spam protection, email notifications. The free version handles contact forms, simple surveys, and newsletter signups. Clean code — doesn't load scripts on pages without forms, which is the right way to do it.
Contact Form 7 is the other popular option — more flexible but requires HTML knowledge. If you just need a contact form, WPForms Lite is faster to set up. Contact Form 7 is better if you need complex conditional logic or multi-step forms without paying for WPForms Pro.
Performance
ShortPixel — image compression
Images are usually the biggest performance bottleneck on WordPress sites. ShortPixel compresses uploads automatically — lossy, glossy, or lossless. 100 free credits/month. I measured a 35% reduction in page weight on image-heavy posts with lossy compression and zero visible quality loss at normal viewing distance.
Imagify and Smush are alternatives. ShortPixel has the best balance of compression ratio and free credit limits in my testing.
Autoptimize — CSS/JS cleanup
Minifies and combines CSS and JavaScript files. Simple toggle switches, hard to break anything. Pairs well with WP Super Cache. Skip this on hosts with built-in optimization (Kinsta, SiteGround, Cloudways with Breeze).
Email & Analytics
WP Mail SMTP — fix broken WordPress email
WordPress uses PHP mail() by default. Most shared hosts either disable it or route it through servers that get flagged as spam by major email providers. Your contact form submissions, password reset emails, and WooCommerce order notifications may silently fail.
WP Mail SMTP (free) re-routes email through a real SMTP service. Setup options: Gmail/Google Workspace (free, requires OAuth), Mailgun ($0 for 5K emails/mo), SendGrid (free tier), Postmark (paid but excellent deliverability). Takes 10 minutes to set up. Install it before you need it — you'll know you needed it when a customer says they never got their order confirmation.
Google Site Kit vs adding GA4 directly
Google Site Kit connects Google Analytics, Search Console, AdSense, and PageSpeed Insights into your WP dashboard. Convenient, but adds overhead. If you check your analytics dashboard directly (which most people do), skip Site Kit and just add the GA4 tracking code via a lightweight plugin like GA Google Analytics, or paste it into your theme header.
MonsterInsights is the feature-rich option for WooCommerce stores — enhanced ecommerce tracking, affiliate link tracking, and event reporting inside WordPress. The free version is useful; the paid version is worth it for stores doing $50K+/mo where the enhanced data pays for itself.
E-commerce
WooCommerce — if you're selling on WordPress
Free, open-source, powers 40% of online stores. The plugin itself is solid. The ecosystem of extensions is where costs add up — payment gateways, shipping calculators, subscriptions, memberships. Budget $50-200/yr for essential extensions on a real store.
WooCommerce is resource-hungry — it adds significant database overhead. Shared hosting handles it for small catalogs (under 100 products, low traffic). Beyond that, Cloudways or Kinsta make a noticeable difference. I cover email marketing integration in my Shopify vs WooCommerce email guide.
Plugins I stopped using
Jetpack — tries to do everything, does nothing exceptionally. Adds bloat, phones home to WordPress.com constantly. Every feature it offers has a lighter standalone alternative: Akismet for spam, UpdraftPlus for backups, Wordfence for security, Yoast for SEO.
All in One WP Migration — great for one-time migrations, but most hosts now offer free migration. No reason to keep it installed permanently after you've moved.
Classic Editor — the block editor is good now. If you're still using Classic Editor out of habit, give Gutenberg another try. It's matured significantly since WordPress 6.0, and the full-site editing features in 6.4 are genuinely useful.
WP-Optimize — I used it for database cleanup, but most modern hosts handle this automatically. If your host doesn't, running it quarterly is fine; running it daily is overkill.
My actual plugin stack
Here's what I run on my test sites (SiteGround hosting):
- Yoast SEO
- UpdraftPlus (free daily DB backup to Google Drive)
- WPForms Lite
- ShortPixel
- WP Mail SMTP (fixes WordPress email delivery — essential)
That's it. Five plugins. SiteGround handles caching, security, and CDN at the server level. On InterServer, I'd add WP Super Cache and Wordfence — still only seven. The instinct to add more plugins is usually the problem, not the solution.