Quick answer: Most business WordPress sites need plugins for SEO metadata, security hardening, backups, contact forms, caching or a host-level equivalent, and spam protection. Add ecommerce, membership or booking tools only when the business model requires them. Keep the list short, remove abandoned plugins, and prefer well-maintained options with clear support over stacks of overlapping tools.
WordPress is flexible because plugins extend it. That same flexibility creates slow, fragile sites when every “must have” list gets installed at once. A business site should run on a lean set of plugins that each earn their place.
This article is a practical shortlist for typical company sites in mid-2018: brochure sites, lead-gen sites and content-led businesses. It is not a catalogue of every popular plugin.
Principles before the shortlist
- One job per plugin when you can. Two SEO suites fighting over titles help nobody.
- Maintenance matters more than features. Check recent updates, support threads and compatibility with your WordPress version.
- Hosting can replace plugins. Many managed hosts include backups and caching. Do not duplicate them blindly.
- Measure after install. If a plugin adds front-end scripts you do not need, find a lighter option.
- Gutenberg is arriving. WordPress 5.0 and the block editor are on the horizon. Classic editor is still common in May 2018. Prefer plugins that follow core direction, and keep a recovery plan if you rely heavily on page builders.
SEO and metadata
You need control over titles, meta descriptions, XML sitemaps and social previews. Yoast SEO and All in One SEO Pack are the usual choices. Pick one. Configure templates for posts and pages, submit the sitemap in Google Search Console, and write real titles rather than stuffing keywords.
SEO plugins do not replace good content or technical fixes. They make on-page fields manageable.
Security
At minimum:
- Limit login attempts or add two-factor authentication for admin users.
- Keep WordPress, themes and plugins updated.
- Use strong passwords and unique admin usernames (avoid “admin”).
- Consider a security plugin such as Wordfence, Sucuri or iThemes Security for firewall rules, malware scanning and login protection, or rely on a host security stack if it is genuinely active.
Do not install three security plugins at once. They overlap and can conflict. Pair security with a process: updates, least-privilege users, and a response plan if something goes wrong. See also hacked WordPress recovery.
Backups
If your host does not provide automated offsite backups you can restore yourself, install a backup plugin (UpdraftPlus, BackupBuddy, or similar) and send copies to remote storage. Test a restore once. A backup you have never restored is a hope, not a plan.
Schedule daily backups for sites that change often (stores, busy blogs) and at least weekly for quieter brochure sites. Keep more than one restore point.
Forms and lead capture
Contact Form 7, Gravity Forms, WPForms and Ninja Forms all appear on business sites. Choose based on complexity:
- Simple contact and quote forms: lightweight form plugins are enough.
- Multi-page applications, file uploads, conditional logic: Gravity Forms or similar paid tools save time.
Connect forms to email that actually arrives (SPF/DKIM on your domain) and, when useful, to a CRM. For syncing signups to email tools, see Mailchimp API integration. Add honeypot or reCAPTCHA sparingly so real customers are not blocked.
Caching and performance
Page caching dramatically improves response times for anonymous visitors. Popular options include WP Super Cache, W3 Total Cache and WP Rocket. Some hosts (including LiteSpeed-based setups) provide caching at the server layer. Prefer one caching approach, configure exclusions for carts and account pages, and test.
Complement caching with image compression and sensible image sizes. WebP support is growing in 2018 but is not universal in every browser, so use it with fallbacks when you adopt it. Lazy loading helps long pages.
Object caching (Redis or Memcached) helps dynamic sites. That is often a hosting feature plus a small drop-in plugin, not something every brochure site needs on day one.
Spam and comments
If you allow comments, use Akismet or an equivalent. If you do not need comments on product and service pages, turn them off. Less spam surface means less moderation work.
Analytics and tag management
Putting Google Analytics in a plugin is fine for simple setups. As marketing tags grow, a tag manager container becomes cleaner than five plugins each injecting scripts. Respect consent requirements that apply to your audience; cookie consent and GDPR-related Analytics settings are live issues in 2018 for many businesses.
When you need more than the basics
Add plugins only when there is a clear requirement:
- WooCommerce for a real store (plus only the extensions you use)
- Membership or LMS plugins for paid content communities
- Booking plugins for appointments and classes
- Multilingual plugins (WPML, Polylang) when you genuinely publish in more than one language
- Custom fields (ACF) when the editor needs structured content beyond the main editor
Page builders (Elementor, Beaver Builder, Visual Composer and others) can speed layout work. They also add weight and lock-in. For a long-lived business site, decide deliberately whether a builder is worth the trade-off, especially with the block editor approaching in core.
Plugins you can usually skip
- Duplicate SEO, security or caching plugins
- Sliders that load on every page “for atmosphere”
- Hit counters and dated social share bars that inject heavy scripts
- “Related posts” widgets that query the database poorly on every load
- Anything not updated in a year or more
Run a plugin audit quarterly. Remove what you do not use. Our WordPress site audit checklist covers this alongside broader health checks.
A lean starter stack (example)
For a typical lead-generation business site on decent hosting:
| Need | Approach |
|---|---|
| SEO metadata | One SEO plugin |
| Forms | One form plugin |
| Backups | Host backups or one backup plugin |
| Security | Host tools or one security plugin |
| Cache | Host cache or one cache plugin |
| Spam | Akismet or comments disabled |
| Analytics | GA via plugin or tag manager |
That is enough to launch. Everything else should justify itself.
FAQ
How many plugins is too many?
There is no magic number. Thirty well-chosen, maintained plugins can be healthier than twelve abandoned ones. Watch for overlap, front-end weight and update failures.
Should I use a plugin for everything?
No. Small features can be theme code or a tiny custom plugin you control. Large features (ecommerce, memberships) are usually better as established plugins than home-grown systems.
Will Gutenberg replace these plugins?
The block editor changes content editing. It does not replace backups, security, forms or SEO metadata. Expect some page-builder and shortcode workflows to need review when you upgrade to WordPress 5.0.
Keep the list short and maintained
Essential WordPress plugins are the ones that protect the site, help people contact you, keep pages fast and make search listings readable. Install those, configure them properly, and resist the rest until a real business need appears.
If you want a business WordPress stack set up cleanly (or an existing plugin pile trimmed and hardened), our site and conversion work includes WordPress builds and tidy-ups aimed at reliability, not plugin sprawl.
