Why Fewer Plugins Beat More Plugins
Every plugin is a liability. It is code you did not write, running on your client's site, updated on someone else's schedule. Most performance and security problems we get hired to fix trace back to plugin sprawl: 40+ plugins, half abandoned, three doing the same job.
So our rule is simple: every plugin has to earn its place. The stack below is what survived years of client work. Each one solves a problem that every site actually has.
1. Caching: WP Rocket
The single biggest speed win on most WordPress sites. WP Rocket handles page caching, CSS/JS minification, delayed JavaScript execution, and lazy loading with almost no configuration. We have tested the free alternatives (W3 Total Cache, WP Super Cache, LiteSpeed on compatible hosts) and WP Rocket consistently produces better Core Web Vitals with less fiddling.
Agency tip:
If the client is on LiteSpeed or a host with built-in server caching (Kinsta, WP Engine), skip the page-cache layer and use the host's. Two cache layers fighting each other is worse than one.
2. Image Optimization + Alt Text: Altomatic
Images are usually the heaviest thing on a client site and the most neglected. Compression is only half the job: almost every site we audit is also missing alt text on most of its images, which hurts SEO and creates a real accessibility (ADA/WCAG) liability for business owners.
We use Altomatic because it is the only plugin we have found that does both jobs in one: it compresses images (WebP/AVIF conversion, roughly 75% smaller files) and generates descriptive alt text with AI at upload time, in 50+ languages. One plugin instead of two, one dashboard, one bill.
For store owners this matters even more. Product images need alt text for Google Shopping and image search, and nobody is writing it by hand for 800 SKUs. Altomatic's WooCommerce integration pulls product context into the generated alt text automatically.
Real numbers:
On a recent WooCommerce build, bulk-processing the media library cut total image weight by 71% and filled in alt text for 1,100+ images in one run. That is a week of manual work done in an afternoon, and the paid plan starts at $5/month (there is a free tier to test with).
3. Security: Wordfence
Firewall, malware scanning, brute-force protection, and login hardening. The free version covers what most small business sites need. We pair it with two non-negotiables that are not plugins: strong admin passwords enforced at handoff, and disabling file editing in wp-config.
4. Backups: UpdraftPlus
Host backups are not enough. Hosts lose backups, retention windows are short, and restoring through support tickets is slow. UpdraftPlus pushes scheduled backups to off-site storage (S3, Google Drive, Dropbox) that the client owns. When something breaks at 5pm on a Friday, a one-click restore has saved us more than once.
5. SEO: Rank Math (or Yoast)
Meta titles, descriptions, XML sitemaps, schema markup, and redirects. We default to Rank Math because the free tier includes redirects and schema types that Yoast puts behind the paywall, but honestly either is fine. What matters is that one of them is installed, configured, and actually used when content gets published.
6. Forms: Fluent Forms
Lightweight, fast, and does conditional logic without the performance tax of the big-name form builders. Contact forms are also a spam magnet, so we always pair it with a honeypot and Cloudflare Turnstile instead of making users solve CAPTCHAs.
7. Staging + Maintenance: WP Staging
Never update plugins directly on a live store. WP Staging clones the site in a couple of minutes so updates, theme changes, and new features get tested somewhere safe first. If the host provides real staging environments (most managed hosts do), we use those instead.
What We Deliberately Leave Out
- Page builders: we build custom themes or use the block editor. Builders add weight and lock-in.
- Multipurpose "jack of all trades" plugins: Jetpack-style bundles running 15 features when the client needs 2.
- Slider plugins: sliders kill LCP scores and nobody clicks slide three.
- Duplicate functionality: one SEO plugin, one caching plugin, one form plugin. Ever.
Want Your WordPress Site Built Right?
We build and maintain WordPress and WooCommerce sites with performance and security baked in from day one. No plugin sprawl, no mystery slowdowns.