Plugins add features to WordPress: a contact form, an online store, search settings, a page cache. The six plugins below each cover a job that many sites need sooner or later, and each has a free version in the WordPress.org plugin directory.
Don't take "must have" literally: few sites need all six, and none of them is required. Install a plugin when your site needs what it does, and remove it when it no longer does. For each one, this guide says what it does today, what the free version covers, and what to use instead if it doesn't fit. Versions, update dates and active installations are as WordPress.org showed them on November 4, 2026.
How to choose a WordPress plugin
- Get it from a trusted source. WordPress's own hardening guide says to install plugins only from the WordPress.org directory or well-known companies. A "nulled" copy of a paid plugin from elsewhere can carry malware.
- Check that it is maintained. Each plugin page shows when the plugin was last updated and the latest WordPress version it was tested with. WordPress notes that a plugin not updated since the latest WordPress release may not be compatible with it.
- Check its requirements. The page also lists the minimum WordPress and PHP versions. Contact Form 7, for example, needs WordPress 7.1 and PHP 8.3 or higher, so check that your hosting runs a PHP version your plugins support.
- Use one plugin per job. Two SEO plugins or two page caches on one site do the same work twice and can get in each other's way.
1. Contact Form 7: contact forms
Contact Form 7 is a free, open-source form plugin. You build each form from short form-tags, such as a text or email field, and each submission is sent to you by email. To stop spam, it works with Cloudflare Turnstile, Google reCAPTCHA and Akismet, and it offers a quiz field and a list of disallowed words.
It doesn't store the messages it sends. If an email goes missing, so does the message, unless you also install Flamingo, a message storage plugin made for Contact Form 7.
On WordPress.org: version 6.2.4.1, last updated October 29, 2026, with 10+ million active installations. It needs WordPress 7.1 and PHP 8.3 or higher.
Alternatives: if you'd rather build forms with drag and drop, WPForms Lite (5+ million active installations) and Ninja Forms (500,000+) do that. Ninja Forms also stores every submission in your WordPress database.
2. All-in-One WP Migration: moving a site
All-in-One WP Migration exports a whole WordPress site, with its database, media, themes and plugins, to a single .wpress file, and imports that file into another WordPress installation. It updates the site's addresses as it imports, which makes it a quick way to move a site to a new host or domain.
The free plugin exports sites of any size. To restore one for free, you upload the file on the Import screen, and your hosting company's upload limit decides how large a file goes through. The paid Unlimited Extension adds one-click restores and works around that limit; scheduled backups and cloud backups are paid extensions too.
That makes the free version a migration tool more than a backup plan. For backups on a schedule, use a backup plugin such as UpdraftPlus (4+ million active installations), whose free version can send scheduled backups to remote storage such as Dropbox, Google Drive or Amazon S3, alongside your host's own backups. An export file holds your whole database, user accounts included, so don't leave copies where others could download them.
On WordPress.org: listed as "All-in-One WP Migration and Backup", version 7.113, last updated October 27, 2026, with 5+ million active installations.
3. Yoast SEO: titles, descriptions and sitemaps
Yoast SEO handles the technical side of search for a WordPress site: each page's title and meta description, canonical URLs, XML sitemaps and Schema.org structured data. While you write, it checks your text against a focus keyphrase and for readability, and shows a preview of the search result. Yoast SEO Premium adds more schema types, more keyphrases and AI tools.
A plugin helps you get these settings right, but it doesn't decide where you rank. Google says the same of SEO services: "No one can guarantee a #1 ranking on Google." Treat the plugin's traffic-light score as a writing aid, not as the goal.
On WordPress.org: version 28.8, last updated October 27, 2026, with 10+ million active installations.
Alternative: Rank Math SEO (4+ million active installations) does the same job and lists a one-click import from Yoast, if you want to move from one to the other. Keep only one SEO plugin active: two would both write titles, descriptions and sitemaps.
4. WP-Optimize: caching and clean-up
WP-Optimize works on speed in four ways: it caches pages, compresses images (and can convert them to WebP), cleans old revisions, auto-drafts, spam and trashed comments out of the database, and minifies HTML, CSS and JavaScript. Some features, such as lazy loading and caching per user role, are in the paid version.
Two points from its own FAQ: back up your entire database before you use it for the first time, and don't run its page cache together with another caching plugin, because both would need the same drop-in file, advanced-cache.php.
On WordPress.org: version 4.7.0, last updated September 21, 2026, with 1+ million active installations.
5. WooCommerce: an online store
WooCommerce turns WordPress into an online store, with products, a cart and a checkout. The core plugin is free and open source, and you can export all of your store's content to move it elsewhere. You take payments through gateways such as Stripe, PayPal and Square, and add features such as subscriptions or bookings with free and paid extensions.
A store needs more care than a blog, because it handles customer details and orders. Keep WooCommerce and its extensions updated, and make sure the cart, checkout and account pages are never served from a page cache. WP-Optimize's FAQ, for example, says its cache works with WooCommerce and leaves out pages such as the cart, checkout and account pages.
On WordPress.org: version 11.2.1, last updated October 9, 2026, with 7+ million active installations.
6. Elementor: a visual page builder
Elementor is a drag-and-drop page builder: you design pages visually, with live editing, widgets and templates, instead of working in your theme's code. The free version includes the editor, basic widgets and templates; Elementor Pro adds more advanced tools.
WordPress has its own visual editor too: the block editor, the default editor since WordPress 5.0 in December 2018. Try it first. A page builder adds its own code to the pages it builds, and those pages depend on it, so moving away from it later means rebuilding them.
On WordPress.org: listed as "Elementor Website Builder", version 4.3.6, last updated November 2, 2026, with 10+ million active installations.
Keep your plugins secure
- Update plugins promptly. WordPress's hardening guide counts old and outdated plugins among the targets of attacks, and says to keep your plugins updated. Since WordPress 5.5, you can turn on automatic updates plugin by plugin on the Plugins screen.
- Delete plugins you don't use. The same guide says: "if you are not using a specific plugin, delete it from the system." Deactivating isn't enough: a deactivated plugin's files stay on the server until you delete it.
- Back up before you update. WordPress advises having a current backup of your site before updating plugins, because problems can happen during the update.
- Try big changes on a copy first. Test major updates and new plugins on a staging copy of your site before they reach the live one.
- Keep the list short. Every plugin is more code that can have bugs and more updates to follow.
Running WordPress on LyraHosting
Our offshore web hosting runs WordPress on both plans, with cPanel and SSD storage in the Netherlands, from €5.99 a month. Supported applications install with the included one-click installer, and every account includes free SSL certificates, standard anti-DDoS protection and malware scanning (basic on SSD Starter, advanced on SSD Enterprise).
Remote daily backups copy your files and databases to a separate backup system, so a mistake or a hacked plugin doesn't mean starting over. SSD Enterprise adds SSH, Git and staging environments, where you can try updates before they go live.
Moving an existing site? Our technicians can migrate your website from cPanel, Plesk or CyberPanel, with its files, databases and email, and simple moves may be free. Technical support is by ticket, 24/7/365, with a first reply within 1 hour.
