Most WordPress plugin advice on the internet is either sponsored, outdated, or written by someone who installed a plugin once and called it a review. This list is different. These are the plugins we actually install on client sites, have used for years, and trust enough to recommend without qualification.
We also cover the ones we avoid — and why. That section is just as useful as the recommendations.
Forms — Gravity Forms
Gravity Forms is the only form plugin we use on client sites. It handles everything from a simple contact form to multi-step lead capture forms, conditional logic, file uploads, payment integrations, and Gravity Forms-connected workflows with HubSpot, Mailchimp, and dozens of other services.
It’s not free — licenses start at $59 per year — but it’s worth every cent. The free alternatives (Contact Form 7, WPForms free) either lack the features growing businesses need or push you toward a paid tier that costs more than Gravity Forms anyway. We’ve never had a client outgrow it.
Custom Fields — Advanced Custom Fields Pro
ACF Pro is how we build flexible, manageable WordPress sites without page builders. Custom post types, repeater fields, flexible content layouts, relationship fields, options pages — ACF handles all of it cleanly and gives content editors a proper interface without exposing them to code.
The Pro version unlocks repeater fields, flexible content, and the options page, which are essential for any serious custom build. At $49 per year it’s one of the best value purchases in the WordPress ecosystem. The free version covers basic field needs for simpler sites.
Email Delivery — FluentSMTP
WordPress sends email through PHP mail by default. Most modern email providers treat PHP mail as spam or reject it outright, which is why contact form submissions disappear and password reset emails never arrive.
FluentSMTP connects WordPress to a real authenticated email account — Gmail, Microsoft 365, Amazon SES, Mailgun, SendGrid — and sends through that account’s verified infrastructure. It’s free, actively maintained, and handles every major provider. We install it on every WordPress site we manage, no exceptions. If your site sends any email at all, you need this.
SEO — Yoast SEO
Yoast is our default SEO plugin. It handles meta titles and descriptions, XML sitemaps, canonical URLs, schema markup, and the content analysis tools that help non-technical clients write better-optimized content. The free version covers everything most small business sites need. Yoast Premium adds redirect management and internal linking suggestions which are useful for content-heavy sites.
Rank Math is a capable alternative worth mentioning — it offers more features in the free tier than Yoast. We default to Yoast because of its stability and track record, but if you’re starting fresh and want more out of the free version, Rank Math is worth evaluating.
Security — WP 2FA
Two-factor authentication on all administrator accounts is non-negotiable for any site we manage. WP 2FA by Melapress handles the setup cleanly — connect an authenticator app, save your backup codes, and your login is protected even if your password is compromised.
The free version handles everything most sites need. The premium version adds enforcement policies for multi-user sites where you need to require 2FA for specific user roles.
Admin & Security Hardening — Admin and Site Enhancements (ASE)
ASE is one of those plugins that replaces five others. In a single well-built plugin it handles login security (attempt limiting, login URL customization), admin interface cleanup, performance tweaks, content management tools, and a range of hardening features that used to require separate plugins for each.
We moved to ASE from a combination of Limit Login Attempts Reloaded and WPS Hide Login because consolidating these into one actively maintained plugin reduces the overall plugin footprint and the surface area for conflicts. The free version is comprehensive. The Pro version adds white-labeling and more granular control which is useful for agency setups.
Backups — UpdraftPlus
UpdraftPlus handles automated backups to offsite storage — Google Drive, Dropbox, Amazon S3, and others. It’s reliable, the restore process is straightforward, and the free version covers the core use case: scheduled backups stored somewhere other than your hosting server.
One important note: if you’re on managed WordPress hosting like WP Engine or Kinsta, your host already takes daily backups. UpdraftPlus still adds value as an independent backup layer outside the host — if the hosting account itself has a problem, you have a separate copy you control. Don’t rely solely on your host’s backups.
Image Optimization — ShortPixel or EWWW
Unoptimized images are the most common cause of slow WordPress sites. Every image uploaded to your media library should be compressed before it gets served to visitors.
ShortPixel is our recommendation for clients with a budget. The compression quality is excellent, it handles WebP conversion automatically, and the paid plans are reasonably priced for the volume most small business sites need. It also processes your existing media library in bulk which is essential when taking over a site with years of unoptimized uploads.
EWWW Image Optimizer is our recommendation for clients who need a free solution. It compresses images on your server without sending them to an external API, which some clients prefer for privacy reasons. The free tier covers lossless compression. The paid version unlocks better compression ratios and WebP conversion.
Either plugin is significantly better than nothing. If you’re not running image optimization on your WordPress site, this is the highest-impact performance change you can make today.
The Plugins We Avoid
Page Builders for New Builds
We support existing Elementor and Divi sites for maintenance and fixes. For new builds, we don’t use page builders. They inject large amounts of CSS and JavaScript regardless of whether the current page needs it, create proprietary shortcode lock-in that makes migrating away painful, and produce markup that’s harder to maintain than clean PHP templates.
For clients who need to edit their own layouts without developer involvement, a well-configured page builder can be a legitimate choice. But it should be a deliberate decision based on your specific needs, not the default because it’s easier to sell.
Multiple Security Plugins
Installing Wordfence, iThemes Security, and a login protection plugin simultaneously doesn’t make your site three times more secure — it creates conflicts, slows your site down, and creates a false sense of coverage. Pick one comprehensive solution and configure it properly. ASE covers the hardening basics. WP 2FA handles authentication. That combination is more effective than three overlapping plugins fighting over the same functionality.
Plugins That Haven’t Been Updated in Over a Year
The WordPress plugin repository shows the last updated date and WordPress version compatibility on every plugin page. A plugin that hasn’t been updated in 12 months is a risk — it may not be compatible with current PHP versions, may have unpatched security vulnerabilities, and has likely been abandoned by its developer. Before installing any plugin, check the last updated date. Before keeping a plugin on a site you’re inheriting, check the same.
All-in-One Plugins That Do Too Much
Plugins that promise to handle SEO, caching, security, backups, and performance optimization in a single install are tempting but rarely deliver on all fronts. You end up with mediocre coverage across five functions instead of solid coverage across each. Use purpose-built plugins for critical functions — a dedicated caching plugin, a dedicated SEO plugin, a dedicated backup plugin.
The Right Number of Plugins
There’s no magic number, but the question to ask about every active plugin is: is this earning its place? Each plugin adds code that runs on every page load. A site with 10 well-chosen plugins will almost always outperform a site with 35 that have accumulated over time without anyone asking whether they’re still needed.
Every six months, go through your active plugins list. Deactivate and delete anything that isn’t actively solving a problem. Your site will be faster, more secure, and easier to maintain.
