How many WordPress plugins is too many?

"Under ten plugins" is repeated everywhere and is not really true. A site with five badly written plugins is worse off than one with twenty good ones. The number is a proxy for a question nobody asks directly.

The real test

For each plugin: is it maintained, is it necessary, and does it do one thing? Check the last-updated date, the number of installs and whether it has been tested against the current WordPress version. Anything untouched for over a year is a liability, no matter how well it works today.

What most sites actually need

• SEO. One — Yoast or Rank Math or SEOPress. Not two.
• Caching. One, and ideally one that your host recommends.
• Backups. Off-site, automatic, tested. The one you never think about until the day you need it.
• Security. One firewall or login-hardening plugin.
• Forms. One. Configured to store submissions in the database, not only email them.
• Custom fields. ACF or similar, if the site has structured content.
• Image optimisation. One, if the host does not handle it.
• Consent management. Mandatory in the EU if you load anything third-party.

That is eight, and it covers a great many sites.

The plugins that cause the most trouble

Page builders that leave shortcodes behind when disabled. "All-in-one" suites that do SEO, security, caching and social sharing badly at once. Slider plugins. Anything whose main feature could be four lines of CSS. Analytics plugins that inject a script you could add once in the theme.

How to audit yours in twenty minutes

1. List every active plugin with its last-updated date.
2. Mark anything not updated in twelve months.
3. Mark anything you cannot explain the purpose of.
4. Deactivate one at a time on a staging copy and see what breaks. If nothing breaks, delete it — deactivated plugins still receive vulnerability reports and still get exploited.

The part people skip

Deleting, not deactivating. A deactivated plugin's files are still on the server and still reachable. Several of the largest WordPress compromises of recent years were through plugins the owner believed were switched off.