There’s no safe number of WordPress plugins. Ten poorly built or abandoned plugins can do more harm than forty well-maintained ones. What matters is whether each plugin earns its place, whether two plugins do the same job, and whether someone is still looking after the code. This guide gives you a 20-minute audit to find out.
Key takeaways
- Plugin count is a rough warning sign, not the problem itself. Quality, overlap and upkeep matter more.
- Every plugin is code you’re trusting with your site. Plugins carried 91% of new WordPress vulnerabilities in 2025.
- Deactivated plugins still sit on your server. If you don’t need one, delete it.
- A heavy plugin that loads scripts on every page slows a site more than several light ones.
- Audit your plugins every few months, and always back up before removing anything.
Is there a magic number of plugins?
No. Rules like “keep it under 20” don’t come from testing. A plugin can be a few lines of code that adds a setting, or a full shop system like WooCommerce. Counting them treats both the same.
A high count is still worth noticing, though. In our experience, sites with 40 or 50 plugins rarely need them all. Usually a few were installed for a one-off job, a few duplicate each other, and a few haven’t been updated in years. The count tells you to look. The audit below tells you what to cut.
What actually makes plugins a problem?
Security: every plugin is someone else’s code
Patchstack found 11,334 new vulnerabilities in the WordPress ecosystem in 2025. Plugins carried 91% of them, and only six were in WordPress core (Patchstack). Each plugin you add is another door that needs to stay locked. That’s why the honest answer to is WordPress secure depends so much on what’s installed on top of it.
Deactivating a plugin doesn’t close that door. WordPress’s own guide notes that deactivating a plugin and deleting it are separate steps (WordPress.org). The files stay on your server until you delete them, and a known flaw in old files can still be targeted.
Speed: what each plugin loads
Some plugins add scripts and styles to every page, even pages that don’t use them. A slider plugin might load its code on your contact page. Google’s Lighthouse tool flags this as unused JavaScript, and for WordPress sites it suggests reducing or switching the plugins that load it (Chrome for Developers).
Others slow the server side instead: slow database queries, or calls to outside services on every page load. Good WordPress hosting in Australia helps, but no server can fully hide a plugin that does too much work.
Upkeep: more plugins, more updates, more clashes
Every plugin needs updating, and every update can clash with another plugin or your theme. The fewer you run, the easier it is to test each update properly.
How do I audit my plugins in 20 minutes?
Take a full backup first, or check that your host’s latest backup can be restored. Then open Plugins in your dashboard and work through this list.
- Delete what’s already switched off (3 minutes). Look at the Inactive tab. If you haven’t used a plugin in months, delete it. You can reinstall it later if you really need it.
- Name the job each active plugin does (5 minutes). Write one line per plugin: “contact form”, “SEO”, “backups”. If you can’t say what one does, mark it for a closer look.
- Look for doubles (3 minutes). Two SEO plugins, two caching plugins or two security plugins can fight each other. Your theme or page builder may already do what a plugin does, such as sliders, icons or custom fonts.
- Check who’s still maintaining it (5 minutes). Click “View details” on each plugin. Note the last update date and whether it says it’s compatible with your WordPress version. WordPress.org warns that a plugin not updated since the latest core release may be incompatible.
- Flag the heavy ones (4 minutes). Run a speed test on your homepage and a key landing page. Note any plugin names that appear in the warnings about unused JavaScript or CSS. A developer can dig deeper with Query Monitor, which groups database queries by plugin.
You’ll end up with three lists: keep, replace and remove. Abandoned plugins go straight onto the replace list, and our guide to abandoned WordPress plugins explains how to spot them and choose a safer alternative.
How do I remove a plugin safely?
Remove one plugin at a time, so you know which change caused any problem. Deactivate it, then check your homepage, a contact form and, if you sell online, your checkout. If all is well, delete it.
Some plugins leave settings or database tables behind. That’s usually harmless. Be careful with plugins that create content, such as page builders, form builders or shortcodes. Removing them can leave broken layouts or raw code on your pages, so check those pages first.
How do I keep plugin bloat from coming back?
- Ask before you install. Can the theme or an existing plugin do this? Will we still need it in six months?
- Prefer well-maintained plugins. Look for recent updates, active support replies and a clear developer behind it.
- Avoid “free” copies of paid plugins. Our guide to nulled plugins explains why they’re a common way in for malware.
- Make the audit routine. Add it to your WordPress maintenance checklist every quarter.
Keeping a site lean is one of the quiet jobs in our WordPress maintenance services. We update plugins, scan for known flaws and point out ones that are no longer maintained. You can compare what each level covers on our website maintenance plans page.
Frequently asked questions
Do inactive plugins slow down WordPress?
Barely, because WordPress doesn’t run their code. The bigger concern is security: the files are still on your server, and an old version with a known flaw can still be a target. If you don’t need a plugin, delete it rather than just deactivating it.
Is 30 plugins too many?
Not necessarily. A busy WooCommerce shop can run 30 well-maintained plugins and stay fast and secure. A brochure site with 30 plugins is worth auditing, because some will be doubles or leftovers. Judge each plugin by its job, its upkeep and its weight, not the total.
How do I know which plugin is slowing my site?
Start with a speed test such as PageSpeed Insights and look for plugin names in the unused JavaScript and CSS warnings. A developer can go further with a tool like Query Monitor, which groups database queries by plugin. Test on a staging copy where possible.
Is it safe to delete a plugin?
Usually, if you back up first and remove one at a time. Deactivate it, check key pages, forms and checkout, then delete it. Take extra care with page builders, form builders and plugins that add shortcodes, because pages built with them may break.
Should I replace plugins with custom code?
Sometimes. A small tweak, such as a tracking code or a minor layout change, often belongs in a child theme rather than its own plugin. Larger features are usually better in a well-maintained plugin, because someone else is keeping that code secure and up to date.
Sources
- State of WordPress Security in 2026, Patchstack, 2026
- Manage Plugins, WordPress.org Documentation, updated January 2026
- Reduce unused JavaScript, Chrome for Developers (Lighthouse)
- Query Monitor, WordPress.org plugin directory, version 4.1.1, October 2026