I run a portfolio of WordPress sites, and every one of them starts with the same short list of plugins. The goal is a lean, mean WordPress machine: fast, secure, and with nothing installed that I don’t actually need. This is that list, what I think are the best WordPress plugins for a site like that, what each one does for me, and what I cut.
One rule shapes everything below: if a plugin I already run can do the job, I don’t add another one.
The best WordPress plugins on every site I build
Here’s the full set, grouped by the job each one does, starting with the foundation everything else sits on. Where I use a paid version, I say so.
Theme and layout: GeneratePress and GenerateBlocks
Strictly speaking, GeneratePress is a theme, not a plugin, but it’s the foundation of every build, with the GP Premium plugin on top. According to its listing, a fresh GeneratePress install adds less than 10kb (gzipped) to a page.
For layouts, I use GenerateBlocks and GenerateBlocks Pro instead of a page builder. It’s a small set of blocks rather than dozens of single-purpose ones, and it outputs static HTML and CSS on the front end. I don’t use a child theme. Custom CSS goes in Additional CSS, and small bits of PHP go in WPCode (more on that below).
SEO: Rank Math
Rank Math handles titles, meta descriptions, XML sitemaps, schema markup, redirects and a 404 monitor, all from its standard feature list. That’s four jobs that would otherwise mean four plugins.
Speed and images: LiteSpeed Cache
My hosting runs LiteSpeed web servers, so LiteSpeed Cache does the page caching. It also optimizes images through LiteSpeed’s QUIC.cloud service, whose standard queue is free, and it can clean up the database, clearing out old post revisions, spam comments, trashed items and expired transients.
Because it already covers images, I no longer run a separate image optimization plugin.
Login security: Loginizer Pro
Every WordPress login page gets hammered by bots guessing passwords. Loginizer blocks them: by default, an IP is locked out for 15 minutes after 3 failed attempts, and for 24 hours after repeated lockouts. The Pro version adds two-factor login through an authenticator app and a checksum check of WordPress’s core files, so I’d know if one had been changed. That’s a core-file check, not a full malware scanner.
I use the Pro versions of Loginizer and CookieAdmin because my hosting provider’s Softaculous package includes them.
Comment spam: Antispam Bee
Antispam Bee blocks spam comments and trackbacks without captchas and without sending visitors’ personal information to third-party services. It’s free and works as soon as it’s activated.
Forms: WPForms Lite
Every site needs a contact form, and WPForms Lite is a drag-and-drop form builder with spam protection built in. For a contact page, the free version is all I need.
Analytics: Site Kit by Google
Site Kit is Google’s official WordPress plugin. It connects Search Console, Analytics and PageSpeed Insights, so I can see search performance and traffic without leaving the dashboard.
Custom code: WPCode
WPCode lets me add PHP, JavaScript and CSS snippets without editing the theme’s functions.php file. It’s also how I avoid installing plugins for small jobs: a few lines in WPCode often replace an entire plugin.
Links: Internal Link Juicer and Broken Link Checker
Internal Link Juicer adds internal links between posts automatically, based on keywords I assign to each post. Broken Link Checker finds links that have stopped working. I run it on its cloud engine, because the local engine runs on your own server, while the cloud engine scans with no load on it.
Post views: Post Views Counter
Post Views Counter counts how many times each post is viewed, without third-party tracking scripts, and shows the count where I want it. Worth knowing: when a count interval is set, it uses a first-party cookie to avoid counting the same visitor twice.
Cookie consent: CookieAdmin, where needed
On sites that run analytics or ads, CookieAdmin shows the cookie consent banner and lets visitors choose which cookie categories load. On metahead, its script blocking holds Google Analytics back until a visitor accepts. You can see exactly what metahead collects in its privacy policy. The free version covers the banner, basic cookie scanning and categories. I run Pro, which adds features like consent logs, geo targeting and Google Consent Mode v2. More on whether you need a cookie plugin at all below.
Occasional: Export All URLs
Export All URLs downloads a list of every URL on a site as a CSV file, which is handy for migrations and for mapping redirects. I only switch it on when I need it.
On top of these, my sites run a few private plugins I built for my own workflow.
What I removed
ShortPixel. It’s a good image optimizer, but LiteSpeed Cache already does the job, so running both made no sense. That’s the whole philosophy in one decision: one plugin per job.
What I don’t use a plugin for
- Backups. I use the backups in my hosting control panel instead of a backup plugin.
- Uptime monitoring. I use UptimeRobot, an outside service, so nothing runs on the site itself.
- Email delivery. My WordPress emails arrive without problems, so I don’t run an SMTP plugin. If yours land in spam, that’s when you’d add one.
Do you actually need a cookie plugin?
It depends on two things: whether anything on your site sets tracking cookies, and who visits. Google Analytics sets cookies, and so do most ad networks.
The EU’s cookie rules apply to any site with visitors from the EU, wherever the site owner is based, and analytics and advertising cookies need the visitor’s opt-in consent first. Here in Canada, Quebec’s Law 25 goes further than the rest of the country: tracking technologies that can identify, locate or profile a person are generally read as needing to be off by default until the visitor turns them on. And if you run Google AdSense, Google requires a certified consent platform to serve personalized ads to visitors in the EEA, the UK and Switzerland.
So if your site runs analytics or ads and gets visitors from those places, you need one. If it doesn’t track anyone, you can skip the banner. I’m not a lawyer, so for a site that earns real money, it’s worth checking with one.
The list at a glance
- GeneratePress + GP Premium (theme)
- GenerateBlocks + GenerateBlocks Pro
- Rank Math SEO
- LiteSpeed Cache
- Loginizer Pro (included with my hosting’s Softaculous package)
- Antispam Bee
- WPForms Lite
- Site Kit by Google
- WPCode Lite
- Internal Link Juicer
- Broken Link Checker
- Post Views Counter
- CookieAdmin Pro (where tracking runs; included with Softaculous)
- Export All URLs (only when needed)
That’s the whole list. For me, the best WordPress plugins are the ones that each do one job well, and there aren’t many of them.
Top photo: rawpixel (CC0).
Sources
- WordPress.org: GeneratePress, GenerateBlocks, Rank Math SEO, LiteSpeed Cache, Loginizer, Antispam Bee, WPForms Lite, Site Kit by Google, WPCode, Internal Link Juicer, Broken Link Checker, Post Views Counter, CookieAdmin, Export All URLs
- Online services costs, QUIC.cloud
- Database, LiteSpeed Cache documentation
- Loginizer features, Loginizer
- What Is the EU Cookie Law?, Consently
- Quebec’s Law 25 and Cookies: Not So Cookie Cutter, McCarthy Tétrault
- Google consent management requirements for serving ads in the EEA, the UK and Switzerland (for publishers), Google AdSense Help