The Plugin Audit We Run on Every Site We Inherit

When a new WordPress site comes under management, the first thing we do isn't a redesign or a speed pass. It's an inventory. Plugins accumulate the way browser tabs do — each one added for a reason nobody wrote down.

The average site we inherit runs 31 active plugins. In our experience about nine are doing something the business would miss.

Step 1: List everything, with dates

For each plugin: version installed, last update from the author, active installs, and whether it's premium with a lapsed license.

A plugin the author hasn't touched in two years is not "stable." It's abandoned, and it's running with full database access.

Step 2: Sort into four piles

Load-bearing. Forms, e-commerce, memberships, booking. Break these and the business stops. These get updated carefully, on staging, and never on a Friday.

Doing something small that could be done in ten lines. "Insert header script," "hide the admin bar," "add a favicon." Each is a full plugin with a full attack surface, an update cadence, and a settings page, doing something a snippet does. These get consolidated.

Duplicates. Two caching plugins. Three SEO plugins where one was configured and two are half-configured and fighting. A security plugin and a firewall doing overlapping work. Duplicates aren't just waste — they interact, and the interactions are the bugs nobody can reproduce.

Nobody knows. Deactivated-but-installed, or active with no visible effect. Vendor plugins from a service that was cancelled in 2021.

Step 3: Check what they're loading on every page

This is the part clients find most surprising. A plugin used on one contact page frequently loads its CSS and JavaScript on every page of the site — including the homepage nobody has a form on.

Ten plugins doing this is a second of load time and a hundred kilobytes of script for no benefit. Conditional loading, or the right plugin, fixes it.

Step 4: Remove, don't deactivate

A deactivated plugin still sits on disk. Its files are still reachable by URL. Vulnerabilities in deactivated plugins have been exploited plenty of times.

If you're not using it, delete it. If you're nervous, take a backup first — which you have, because you tested your backups. (You did test your backups.)

What the numbers usually look like

On a typical audit: 31 plugins in, 12 to 16 out. Page weight down 20–40%. One or two genuine security issues found. And a site that a person can reason about, which matters more than any single metric.

The rule going forward

Every new plugin answers three questions before it's installed: what does it do that we can't do without it, who maintains it, and what breaks if it disappears tomorrow?

Most requests don't survive question one.