Every plugin is code written by someone else that runs on your website. Some are necessary, many are extra, and a few are dangerous. This guide doesn't recommend specific products: it tells you what types of plugins you need, what you don't need on NBT Host hosting and how to tell whether a plugin is trustworthy.
What you'll achieve
- know which types of plugins your website needs and what you can delete;
- choose a plugin by criteria you can check, not by advertising;
- install, test and delete plugins without breaking your website.
What you usually need
| Type | What it's for | Good to know |
|---|---|---|
| Contact form | visitors' messages reach you by email | choose one with spam protection (a hidden field or a verification) and set an address on your own domain as the sender (see Why my emails go to spam: SPF, DKIM, DMARC) |
| Cookie consent | the banner with categories, and blocking analytics scripts until consent is given | required if you use Google Analytics, pixels or embedded maps (see GDPR for a small website: cookies and privacy) |
| SEO | the title and description of each page, the sitemap | WordPress already has a sitemap; the SEO plugin can replace it (see Sitemap.xml and robots.txt: what they are and how to check them) |
| Cache | pages are served ready-made, faster | only one; two caching plugins conflict (see WordPress caching: what it is and how to use it) |
| Two-factor authentication | a code from your phone in addition to the password | especially for administrators (see WordPress users: roles, access and cleanup) |
For a store, add WooCommerce and the payment and shipping methods you need (see Basic settings for a WooCommerce store).
What you don't need on NBT Host hosting
- A backup plugin, just to have backups. We make daily backups of your entire website, and restoring from the last 7 days is free (see Backup and restore from Enhance). A backup plugin only makes sense if you also want backups kept somewhere else, for example in your own cloud storage.
- A plugin for the SSL certificate. The Let's Encrypt certificate is issued and renewed automatically, and you turn on the switch to
https://from Enhance (see Redirect to HTTPS and www). Plugins that “force SSL” can cause redirect loops. - A plugin that limits login attempts, if you have turned on “Restrict admin access” in Enhance and have a fixed IP address (see WordPress updates and security in Enhance).
- Plugins that “optimize” the database or “clean up” the server every hour. On a small website, the gain is zero and the risk is real.
- A plugin for a single small feature, such as a button or a tracking code. Often your theme or a plugin you already have does it.
How to choose a safe plugin
Before you install it, open the plugin's page on WordPress.org and check:
- The last update (the Last updated field): ideally within the last few months. A plugin that hasn't been updated for over a year may have vulnerabilities that nobody fixes anymore.
- Compatibility (Tested up to): the WordPress version it was tested with. If it's far behind, the plugin is probably abandoned.
- Active installs (Active installations): a plugin used on many websites is checked by many people.
- The support forum: whether the author answers questions and whether recent problems get resolved.
- Recent reviews, not just the rating: the 1-star reviews from the last month tell you what broke in the latest version.
Never install a paid plugin or theme downloaded for free from other websites (nulled). It almost always contains hidden code: a backdoor, spam links or a script that sends emails. It's one of the most common causes of hacked websites (see Your WordPress website was hacked: what to do, step by step).
The steps
Install a plugin without breaking your website
- First, back up the website: in Enhance, on the website's page, go to the “Backups” tab » “Create backup” (with the language set to “English (US)”, “Backup now”).
- In WordPress, go to Plugins » Add New Plugin (wp-admin/plugin-install.php), search for the plugin, click Install Now and then Activate.
- Check the home page, the contact form and, if you have a store, the cart and checkout.
- If the website breaks, deactivate the plugin. If you can no longer log in to WordPress, deactivate it from Enhance: the “Apps” tab, the WordPress page, “Plugins” » “Deactivate”.
Clean up every few months
- Under Plugins (wp-admin/plugins.php), look at each deactivated plugin. If you no longer use it, delete it: a deactivated plugin doesn't run, but its files stay on the server and can be attacked.
- For each active plugin, ask yourself what it does. If you don't know, deactivate them one at a time and check the website.
- Do the same with themes, under Appearance » Themes (wp-admin/themes.php): keep the theme you use and, optionally, a default WordPress theme as a backup.
If something doesn't work
- After you activate a plugin, the website shows a critical error or a blank page. Deactivate it from Enhance, as described in step 4. Details in Error 500 Internal Server Error and the blank page.
- A paid plugin doesn't update. The license must be active in its settings. Without a license, you don't get security updates.
- The website became slow after a new plugin. Deactivate it and measure again (see Slow website: what to check, in order).
- You're not sure whether a plugin is still safe. Send us its name and version and we'll look into it together.