A fresh WordPress install does the basics: posts, pages, media, users, comments. Almost everything else a real site needs, from search engine sitemaps to contact forms to backups, comes from plugins. The wordpress.org directory holds tens of thousands of them, which makes the first question for a new site owner less “what is available” and more “which handful do I actually need”. This list covers the thirteen we install on nearly every site we build or support.
Last updated: 2026. Plugin names, ownership and free-tier features checked against current wordpress.org listings.
What is a plugin?
A WordPress plugin is a package of PHP (and often JavaScript and CSS) that hooks into WordPress core to add or change behaviour without editing core files. When you update WordPress, your plugins stay in place; when you switch themes, they keep working. That separation is the whole point: features that belong to the site live in plugins, presentation lives in the theme.
Plugins from the official directory are reviewed on submission, show their last-updated date and tested-up-to version, and update through Dashboard > Updates. Premium plugins are usually uploaded as a zip and update via a licence key. Either way, the install process is covered in our guide to installing a plugin on WordPress.
Why should I use plugins?
Because rebuilding a contact form, an XML sitemap or a backup routine yourself is slower and less reliable than using code that thousands of other sites already run and report bugs against. So the rule is: install what solves a real need, delete what you stop using, and prefer one well-maintained plugin over three overlapping ones. With that in mind, here are the thirteen.
1. Yoast SEO
Whether the site is a hobby blog or a company storefront, it needs to be readable by search engines. Yoast SEO handles the plumbing: XML sitemaps, title and meta description templates, canonical URLs, Open Graph tags for social sharing, schema markup and a redirect manager in the premium tier. Its content analysis gives a readability and keyword check while you write in the block editor. Rank Math is the main alternative and includes redirects and schema in its free version; pick one, never run both.
2. Smush Image Optimization, Compression, and Lazy Load
Images are usually the heaviest part of a page. WordPress now generates WebP versions and lazy-loads images by default, but it does not compress what you upload. Smush compresses on upload, bulk-optimises the existing library, resizes oversized originals and can convert to WebP. ShortPixel and Imagify do the same job if you prefer a credit-based model.
3. Site Kit by Google
You need to know whether anyone is visiting and where they came from. Site Kit by Google connects Google Analytics 4, Search Console, PageSpeed Insights and AdSense to the WordPress dashboard with a guided setup, and inserts the tracking snippet correctly so you do not have to paste code. It replaces the old visitor-counter style plugins that stored hits in your own database and inflated it over time. If you want a lighter, cookie-free alternative, self-hosted or hosted tools such as Plausible and Matomo also have official WordPress plugins.
4. WPCode (formerly Insert Headers and Footers)
Sooner or later a service asks you to add a snippet to the site head: a verification tag, a Meta pixel, a chat widget. Editing the theme’s header.php is the wrong place, because the change is lost on the next theme update and block themes do not even have that file. WPCode, the renamed Insert Headers and Footers, stores header, body and footer snippets in the database, lets you add PHP snippets with a safe-mode fallback if one breaks, and keeps everything in one screen. For many sites it removes the need for a child theme entirely.
5. UpdraftPlus WordPress Backup Plugin
Hosting backups are a safety net you do not control and often cannot restore selectively. UpdraftPlus schedules full backups of files and database to remote storage (Google Drive, Dropbox, S3, and others) and restores from the dashboard with a few clicks. The free version is enough for most sites; the paid version adds incremental backups and migration. Whatever you choose, test a restore once so you know it works before you need it. Our backup plugin comparison covers the alternatives.
6. WPForms
A contact form is still the standard way for visitors to reach you without exposing an email address to scrapers. WPForms Lite builds forms by drag and drop, ships a block for the editor, includes spam protection and stores entries in the paid tier. Ninja Forms and Gravity Forms remain solid choices if you need conditional logic or payment fields, and Contact Form 7 is fine if you are comfortable with markup. Pair any of them with an SMTP plugin such as WP Mail SMTP so form notifications actually reach your inbox.
7. Redirection
URLs change: you rename a post, merge two pages, retire a category. Every unhandled change is a 404 that loses the visitor and the ranking. Redirection manages 301 redirects from the dashboard, logs 404s so you can see what people are hitting, supports regular expressions and can automatically redirect when a post slug changes. If you already run Rank Math or Yoast Premium, their redirect modules cover the same ground.
8. A block library: Spectra, Kadence Blocks or GenerateBlocks
The block editor covers text, media and simple layout, but pricing tables, tabs, accordions, icon lists and advanced grids need extra blocks. Spectra, Kadence Blocks and GenerateBlocks each add a well-built set that works with any theme and stays inside the native editor rather than replacing it. Choose one based on the blocks you actually need; installing two libraries loads duplicate CSS for no gain. A FAQ or accordion block from any of these also replaces the standalone FAQ plugins that used to be common.
9. Wordfence Security – Firewall & Malware Scan
WordPress core is patched quickly; the risk sits in outdated plugins, weak passwords and exposed login pages. Wordfence adds a web application firewall, a malware scanner that compares your files against wordpress.org originals, login rate limiting and two-factor authentication. Solid Security (formerly iThemes Security) is the usual alternative with a stronger focus on hardening and 2FA. Run one, and if you ever suspect an infection, follow our guide on scanning for hidden malware.
10. Advanced Custom Fields
Once a site needs structured data beyond title and body, such as an event date, a product spec sheet or a team member’s role, Advanced Custom Fields is the standard way to add it. You define field groups in the admin, attach them to post types or options pages, and output the values in templates or, since ACF 6, bind them to blocks in the editor. It also registers custom post types and taxonomies without code. It is aimed at site builders more than casual bloggers.
11. SeedProd
While a site is being built, or during a migration, you need visitors to see a tidy holding page instead of a half-finished layout. SeedProd puts up a coming-soon or maintenance page that only logged-in users bypass, and its free tier is enough for that job. The paid version grows into a landing page builder, which you may or may not want. We walk through the setup in our coming soon page guide.
12. WooCommerce
If you sell anything, WooCommerce is the default choice on WordPress. Products, variations, cart and checkout, tax and shipping rules, Stripe and PayPal payments and order management are all in the core plugin, with the cart and checkout now built from blocks you can edit in the Site Editor. It is heavier than any other plugin on this list, so only install it when you have a shop to run, and expect to pair it with a caching plugin and a decent hosting plan.
13. LiteSpeed Cache or WP Rocket
Page caching turns each request from “run PHP and query the database” into “serve a stored HTML file”, which is the single largest speed gain available on shared hosting. If your host runs the LiteSpeed web server (many do), LiteSpeed Cache is free and integrates with the server directly. Otherwise WP Rocket is the paid option with the least configuration, and it also handles CSS/JS minification, delayed script loading and database cleanup. W3 Total Cache and WP Super Cache still work but need more tuning to match. More on this in our post on boosting WordPress performance.
Which Canyon theme fits
All of the plugins above are theme-independent, and our themes are built to stay out of their way: no bundled plugins that go stale, standard hooks, and full block editor support. For a content site, Bloge pairs well with Yoast, Smush and a block library. For a company site running WPForms, ACF and possibly WooCommerce, start with Business Way or browse the business theme category.
Further reading from our partners: Ayaka Casinos, Get Plugin, Get Plugin, Onlinegokkengids.com.