The WordPress plugins worth installing, and the ones that are not

This picks up from a working WordPress site you can log in to as an administrator on Hostworld cPanel hosting. If you have not installed WordPress yet, do that first.

You need four plugins for most business sites: Wordfence Security for protection, Yoast SEO for metadata and sitemaps, a forms plugin that stores entries, and UpdraftPlus for backups. Stop there. Installing dozens of plugins is how WordPress sites get slow and break.

Before you start

• Have admin access to your WordPress dashboard. You will install and manage plugins in WordPress itself, not in cPanel.
• Plan for one security plugin and one SEO plugin only. Stacking similar plugins causes conflicts, duplicate rules and lockouts. Keep it singular for each role.
• Know your rollback. WordPress 6.6 adds automatic rollback for plugin auto‑updates if an update causes a fatal error. That helps, but you still need a current off‑site backup you can restore yourself.
• Forms data is business data. Contact Form 7 on its own does not store submissions. If email fails, messages are lost. Either add Flamingo to store entries in your database, or use a forms plugin that stores entries in WordPress such as Gravity Forms.
• Backups must leave the server. Local‑only backups can vanish with the server. Configure UpdraftPlus to send backups to remote storage and schedule both files and the database.
• Deleting a plugin may remove its data. Many plugins run an uninstall routine that deletes stored settings or entries. Export what you need before you hit Delete.
• If anything here leaves you unable to log in to wp‑admin, open a support ticket. Say what changed last.

Step 1: Keep your plugin list short

WordPress itself warns that plugin conflicts are a common cause of errors and white screens. Troubleshooting usually starts by deactivating plugins one by one. Performance guidance from WordPress and WordPress.com also calls out too many plugins, heavyweight add‑ons and excessive autoloaded options as speed risks. Fewer, better chosen plugins give you a faster, calmer site.

Do

1. In WordPress, go to Plugins. Review each plugin and write the purpose next to it. Keep only one plugin per job.
2. Deactivate anything you no longer use or that overlaps with the plugins below: extra security suites, duplicate SEO tools, duplicate sitemap providers, analytics injectors you do not use.
3. After deactivating, browse your homepage, a blog post, the contact page and wp‑admin. If all looks normal, select the inactive plugin and Delete it.

Undo

• If deactivation breaks a feature, go back to Plugins and Activate it again. Then reassess whether a different plugin should be removed instead.
• If you deleted a plugin and find you need its data, reinstall it. If its uninstall routine removed data, restore from your last backup.

Step 2: Install one security plugin: Wordfence Security

Wordfence gives you an endpoint firewall and malware scanner. The firewall can be optimised to load before WordPress, which helps block malicious traffic earlier. You only need one security plugin. Running more can cause duplicate rules and false positives, which is how admins lock themselves out.

Do

1. In WordPress, go to Plugins, Add New. Search for Wordfence Security. Click Install, then Activate.
2. Open Wordfence in the dashboard. Work through its setup prompts. Use the option to optimise the firewall so it loads before WordPress when offered. Follow the on‑screen instructions for your environment.
3. Run a scan to establish a clean baseline. Schedule regular scans.
4. Review the live traffic and blocking features. If you see legitimate requests blocked, add the safe path or IP to the allowlist using Wordfence’s controls.

Undo

• If you experience lockouts or conflicts after enabling Wordfence, go to Plugins and Deactivate Wordfence to regain access. Do not stack it with another firewall. If you cannot access wp‑admin at all, open a support ticket and tell us when the lockout started.
• Do not try a second security plugin to fix the first. Remove the one you do not plan to keep and retest.

Step 3: Install one SEO plugin: Yoast SEO

Yoast SEO adds structured data (Schema) and an XML sitemap index. It should be the only all‑in‑one SEO plugin active. Running multiple SEO plugins creates duplicate meta tags, canonicals and sitemaps, which sends mixed signals to search engines.

Do

1. In WordPress, go to Plugins, Add New. Search for Yoast SEO. Click Install, then Activate.
2. In SEO settings, confirm that the features you want are on. Yoast can generate its own XML sitemap index. WordPress core also has basic sitemaps since 5.5. Make sure you are not serving more than one sitemap system.
3. Pick one sitemap system. If you use Yoast’s, submit its index to your search console as your primary sitemap. If you turn off Yoast’s sitemaps, WordPress core sitemaps remain unless you filter them off in code. The key point is: avoid duplicates.

Undo

• If you are migrating from another SEO plugin and see duplicate titles or canonicals, deactivate the other SEO plugin and clear any caches you use. Recheck source code for duplicates.
• If you prefer the old plugin’s output, deactivate Yoast and reactivate the previous plugin. Do not leave both active. If you choose to delete a plugin, export any settings first, because uninstall routines can remove stored data.

Step 4: Use a forms plugin that stores entries

Contact forms are where leads arrive. Do not run a form that discards data when mail delivery hiccups. Choose one of the two patterns below.

Option A: Free build that stores entries: Contact Form 7 + Flamingo

Contact Form 7 does not store submissions by itself. Flamingo is a companion plugin that saves messages in your database so you can view them in wp‑admin.

Do

1. Install Contact Form 7: Plugins, Add New, search, Install, Activate.
2. Install Flamingo: Plugins, Add New, search for Flamingo, Install, Activate.
3. Build your form in Contact Form 7. Place the shortcode on your contact page. Submit a test message. Confirm you receive the email and that the message appears in Flamingo’s Inbound Messages.

Undo

• If you remove Flamingo, new submissions will not be stored in the dashboard. Before deactivating or deleting Flamingo, export any messages you need, because uninstalling plugins can remove data.
• If Contact Form 7 misbehaves after an update, deactivate it to restore the page and then re‑enable it to test. If problems persist, leave it deactivated and open a support ticket.

Option B: Busy or mission‑critical sites: Gravity Forms

Gravity Forms is a commercial plugin that stores entries in your WordPress database. It is better suited to sites that cannot afford missed leads.

Do

• Install Gravity Forms following the vendor’s installation steps. Create your form and test entries. Confirm entries appear in the Entries list in wp‑admin.

Undo

• Before deactivating or deleting a forms plugin, export entries and settings. Deleting a plugin can run its uninstall routine and remove data.

Email deliverability notes

• WordPress uses wp_mail() which often sends via PHP mail by default. Production deliverability can require SMTP configuration with proper authentication. If your test messages do not arrive, review your mail route and SPF/DMARC with your mail provider or open a support ticket.
• WPForms Lite users: entries are backed up to WPForms’ servers via Lite Connect and are not browsable in your dashboard unless you upgrade. Know where your data lives before you rely on it.

Step 5: Set up backups that you control: UpdraftPlus

UpdraftPlus lets you schedule file and database backups and send them to remote storage. Premium adds incremental backups. Restores can be full or partial. This is different from cPanel’s full account backups, which are not end‑user restorable inside cPanel. A WordPress‑level tool is what lets you self‑restore an individual site or test a change.

Do

1. Install UpdraftPlus: Plugins, Add New, search, Install, Activate.
2. Open Settings for UpdraftPlus. Choose a remote storage target such as Drive or S3. Connect and save. The point is to get backups off the server.
3. Set a schedule for Files and for Database that matches how often your content changes. Save.
4. Click Backup Now to create a manual backup. Wait for it to complete and confirm it reaches your remote storage.

Undo

• Before any restore, take a fresh backup so you can roll forward again if needed. Restoring the database reverts content to the backup point. If you restore the wrong component, run another restore and choose only Files or only Database to correct it.
• If you had backups configured to save locally only, add remote storage now. Local‑only backups are lost with the server.

Step 6: Update safely and use WordPress’ newer protections

Keep your small plugin set updated and lean on the protections added in recent core versions, without assuming they remove the need for backups.

Do

1. Per‑plugin auto‑updates can be toggled on the Plugins screen. Enable auto‑updates for Wordfence, Yoast SEO, your chosen forms plugin and UpdraftPlus if you prefer automation.
2. On WordPress 6.6 and newer, auto‑updates roll back automatically if a plugin update causes a fatal error. That reduces downtime but is not a substitute for off‑site backups.
3. From WordPress 6.5, Plugin Dependencies help ensure required plugins are present and reduce missing dependency breakage. When you update, watch for dependency notices and follow them.
4. After updates, spot‑check: homepage, a post, your contact form submit, and wp‑admin. If you see errors, identify the last change and revert it.

Undo

• If an update breaks a feature and rollback did not trigger, use UpdraftPlus to restore the affected component. Prefer restoring plugin files only first. Restore the database only if needed and only after taking a fresh backup.

Step 7: Remove plugins you do not need

Do not carry abandoned or duplicate functionality. Each active plugin adds code to run, options to load and one more chance for conflicts.

Do

1. Deactivate the candidate plugin.
2. Test the site’s key pages and admin.
3. If all is well, Delete the plugin. If it stored data you care about, export first.

Undo

• If deleting broke functionality, reinstall the plugin from Plugins, Add New. If data is missing and the plugin’s uninstall cleared it, restore from your backup.

Step 8: Keep it fast and stable

Avoid the slow and broken pattern by treating plugins as controlled changes.

• Add one plugin at a time. Test immediately.
• Keep only one all‑in‑one SEO plugin. Keep only one security suite.
• Prefer plugins that do one job you need over bundles you will not use.
• If you hit issues, follow WordPress’ standard troubleshooting flow. Deactivate plugins one by one until the issue clears to identify the cause. Then prune accordingly.

What next

If you are outgrowing shared hosting and want more control over server‑level performance tuning, see our Linux VPS page. For administration topics beyond WordPress itself, browse our VPS guides.

Need help applying this on your Hostworld account or locked out after a change? Open a support ticket and we will take a look.