Every WordPress site starts small. Then someone needs a contact form, a slider, a popup, a backup tool, another SEO tool, and before long the dashboard lists 40 plugins and nobody remembers why half of them are there. The site gets slower, updates keep breaking things, and a plugin from 2019 sits quietly waiting to be hacked.
This guide walks you through a simple five-step plugin audit: back up and take stock, work out what each plugin does, measure the impact, decide what to keep, merge or remove, then test and stay on top of it.
The 5 steps at a glance
- Back up and take stock. Save a full backup and list every plugin you have.
- Work out what each plugin does. Match every plugin to a job and check that it is healthy.
- Measure the impact. Find out which plugins really slow your site.
- Decide: keep, merge or remove. Use a simple decision path for each one.
- Test, clean up and stay on top of it. Change one thing at a time, then set a routine.
Why plugin overload matters
Plugin overload is not just about the number. It is when your site carries plugins that overlap, are outdated, or do work you no longer need. Each one adds code that loads on your pages, needs updates, and can conflict with others. Over time, that costs you in four ways:
- Speed: extra scripts and styles slow loading, especially on mobile.
- Security: every plugin is a possible way in if it is not kept up to date.
- Stability: conflicts can break forms, menus or whole pages after an update.
- Cost and effort: premium licences, renewals and time spent managing them add up.
Signs it is time for an audit
- Your pages load slowly even after you compress images
- Updates regularly break something
- Several plugins do the same job (two SEO tools, two caching tools)
- You cannot explain what some plugins do or who installed them
- Plugins show “not tested with your version of WordPress” or have not been updated in over a year
- Your admin dashboard is full of notices and nags
Three patterns we see again and again
These are common situations rather than specific cases, but you may recognise one of them.
The slow brochure site
A simple five-page site loads like an online shop. Over the years it has collected a slider, an animation pack, two social feeds and a popup tool. Removing the ones nobody notices often makes the biggest difference to load time.
The form that quietly stopped
An update changes how a form sends email, and enquiries stop arriving without any error. Nobody notices for weeks. Regular test submissions catch this early.
The forgotten plugin
A plugin added for a one-off campaign is never updated or removed. Years later it is the weakest point on the site. Deleting what you no longer use removes that risk completely.
Myth or fact?
Step 1: Back up and take stock
Before you touch anything, make sure you can undo it. Then get a clear picture of what is actually installed.
- Take a full backup of your files and database, and confirm you can restore it.
- Use a staging copy if your host offers one, so changes never touch the live site first.
- List every plugin in a simple spreadsheet: name, version, last update and what it does.
- Include inactive plugins. They still count, because they can still be exploited.
Set aside about 30 minutes for this step. It feels slow, but it makes every later step safer.
Step 2: Work out what each plugin does
For every plugin on your list, write down its job and who relies on it. If you cannot name either, it is already a removal candidate. The sections below help you check each one.
Plugins most sites genuinely need
Most business and NDIS provider sites need only one plugin for each of these jobs, not several:
- Security and backups: regular, tested backups and basic protection against attacks
- SEO: one plugin for titles, descriptions and sitemaps. Our NDIS SEO services build on this foundation.
- Performance and caching: one caching tool, correctly configured
- Forms: a reliable, accessible contact or referral form
- Anti-spam: to keep enquiry forms clean
Many other features, like simple layout, fonts and social icons, can be handled by a well-built theme or a small amount of custom code instead of extra plugins. This is why a clean build matters from the start. See how we approach it on our web design and development page.
Plugin, theme feature or custom code?
Before installing anything, ask where the feature should live. The answer keeps your site lighter and easier to change later.
- Theme feature: layouts, fonts, colours and menus. These are part of how the site looks, so they belong with the theme.
- Plugin: features you would want to keep after a redesign, such as forms, SEO, security and backups.
- Custom code: small, specific tweaks, like a tracking snippet, where a whole plugin would be overkill. A developer should write and document it.
A simple rule: if you would still want the feature after changing your theme, it belongs in a plugin. If it only affects appearance, it belongs in the theme. A clean build avoids many extra plugins from day one, which is how we approach every web design project.
How to vet a plugin before installing
Before you add anything new, spend five minutes checking its listing on WordPress.org:
- Last updated: recent updates suggest active care
- Active installs and reviews: more usage means more scrutiny
- Compatibility: tested with your WordPress version
- Support activity: are questions answered?
- Known vulnerabilities: search the plugin on WPScan for reported security issues
Never install “nulled” or pirated copies of paid plugins. They are a common way malware reaches websites.
Step 3: Measure the impact
Now find out which plugins really cost you speed. Guessing is not enough, so measure.
- Run your home page and one key service page through PageSpeed Insights, and note the scores and the biggest issues.
- Install Query Monitor on staging to see which plugins add slow queries, scripts and styles. Remove it when you finish.
- Write the findings next to each plugin in your spreadsheet.
