Almost every slow, broken, or hacked WordPress site I’ve been asked to rescue had the same backstory. Not one big mistake — just years of plugins installed casually and never removed. Forty-plus active plugins, three of them doing the same job, five abandoned by their developers.
So I have rules now. They’re not complicated, but I actually follow them, which is the part that matters.
First: can I do this without a plugin?
A surprising amount of the time, the answer is yes. A few lines of CSS instead of a styling plugin. A built-in WordPress feature people didn’t know existed. The theme already does it. Every plugin is a permanent tenant — it needs updates, it can conflict, it can be abandoned. The best plugin is the one I didn’t install.
The checks, in order
- When was it last updated? Over a year of silence and I’m out.
- Is it tested with the current WordPress version?
- How many active installs? Small can be fine, but small plus stale is a no.
- Read the worst recent reviews — not the stars, the actual one-star text.
- Who makes it? A company with a paid tier usually sticks around longer.
The one-star reviews are the most honest documentation a plugin has. That’s where you find “broke my checkout after the update” and “support stopped answering.” Two minutes of reading has saved me from plenty of bad decisions.
The trial happens off the live site
New plugins get tried on a staging copy first. Not because every plugin is dangerous, but because the one that is never announces itself. I check the site speed before and after, too — some innocent-looking plugins load their scripts on every single page whether they’re used there or not.
And once a year, the purge
Every site I manage gets an annual plugin review. Anything deactivated gets deleted. Anything unused gets deactivated, then deleted a month later if nobody noticed. The plugin list should describe what the site does today, not its whole history.
