Plugins every small business WordPress site needs

A small business WordPress site needs plugins for only a few jobs: forms that save every inquiry, spam protection, SEO titles and descriptions, analytics, and, depending on your host and theme, backups, security, speed, and cookie consent. Check what your host and theme already do before you add anything. Most sites run best with fewer plugins than their owners expect.

The basics every small business site shares, such as owning your domain, security, speed, and upkeep, are in WordPress for small businesses.

Before you install any plugin

Every plugin is more code to keep updated, another way for the site to break, and often more weight on every page. Before you add one, check:

1. Is it already handled? Your host may run backups, caching, and a firewall. Your theme may already do SEO markup, image compression, or a cookie banner. Two tools doing one job usually fight.
2. Is it maintained? On the plugin's WordPress.org page, look at Last updated and whether it's been tested with the current version of WordPress. Skip anything that hasn't been updated in a year.
3. Who makes it? A plugin with a company behind it, clear documentation, and replies in its support forum is safer than an abandoned side project.
4. Does it load on every page? A plugin used on one page (a map, a booking widget) shouldn't add scripts to every page. You can see this in PageSpeed Insights. See Fix a low PageSpeed score.
5. One job, one plugin. One SEO plugin, one form plugin, one caching layer, one spam check per form.

Only install plugins from WordPress.org or directly from the company that makes them. A "free" copy of a paid plugin from another site is a common way sites get hacked.

Backups

What you need: a daily backup of files and database, stored somewhere other than your web server, kept for at least a few weeks, and a way to restore it that you've actually tried.

Check your host first. Many managed WordPress hosts back up daily and let you restore from their control panel. If yours does, a backup plugin is optional. Add one (for example UpdraftPlus, which can send copies to cloud storage) if your host doesn't back up, keeps copies only on the same server, or keeps them for only a few days.

A backup you've never restored is a guess. Restore one to a staging copy a couple of times a year. See What's included in website maintenance.

Security

What you need, in order of impact:

1. Updates. Most hacked WordPress sites ran an out-of-date plugin. Turn on automatic updates for plugins you trust, or check weekly.
2. Fewer administrators. Give staff the lowest role that lets them do their job. See Manage WordPress users and roles.
3. Strong, unique passwords for every login, kept in a password manager.
4. Two-step login for administrators. The free Two Factor plugin from WordPress.org adds codes by email or an authenticator app.
5. A firewall and malware scanning. Many hosts include a firewall. If yours doesn't, a security plugin such as Wordfence or Solid Security adds one. Run one security plugin, not two.

No plugin makes a site unhackable. If it happens, see My WordPress site was hacked.

Forms

What you need: a form plugin that saves every submission in WordPress, not only emails it. If an email goes missing, the inquiry is still under the form's entries.

Look for:

• Entries saved in the admin, with export to a spreadsheet
• Email notifications to more than one person, and a confirmation message or thank-you page
• File uploads, if customers send photos, drawings, or résumés
• Conditional logic, so a form only asks the questions that apply
• Payment fields, if you take deposits or donations through the form

Gravity Forms (paid) does all of these. WPForms and Formidable Forms are common alternatives with free versions; check that the version you pick saves entries. Contact Form 7 is free but doesn't save entries on its own.

Make sure the emails arrive. WordPress's default way of sending mail is often filtered as spam. Send through an email service from your own domain, with SPF, DKIM, and DMARC set up. See Fix contact form emails that don't arrive.

Spam protection

What you need: an invisible check first, and a visible one only if spam keeps coming.

• Honeypot and timing checks are invisible to people and stop most bots. Gravity Forms has both built in, turned on per form.
• Cloudflare Turnstile or Google reCAPTCHA stops bots that get past those. Use one per form: two checks don't stop more spam, they just add weight and another way for the form to fail.

Expect a little spam to get through. Filtering hard enough to stop all of it also blocks real customers. See Stop Gravity Forms spam.

SEO

What you need: a way to set each page's search title and meta description, a sitemap, the ability to hide thin pages from search, and redirects for pages you move.

• Titles and descriptions: an SEO plugin (Yoast SEO, Rank Math, or similar) adds a box under each page for these. Run one SEO plugin only.
• Sitemap: WordPress builds one at /wp-sitemap.xml. SEO plugins usually replace it with their own. Either is fine; submit it in Google Search Console.
• Redirects: the free Redirection plugin sends old addresses to new pages. See Set up a 301 redirect.

A plugin can't write your content for you. A clear page about each service you offer does more than any setting. See Edit the SEO title and meta description for a page.

Speed and caching

What you need: page caching, compressed images, and as few scripts on each page as possible.

Check your host first. Many managed WordPress hosts cache whole pages on their servers or through a content delivery network. A caching plugin on top of that can serve stale pages, or break forms and carts. If your host caches, skip the caching plugin.

Images are usually the biggest problem. Resize photos before upload or use a plugin that compresses them on upload. See Best image size and format for your website.

Analytics

What you need: a count of visitors, where they came from, and which pages lead to inquiries.

• Google Analytics 4 is free and the most common. You don't need a plugin to add it if your theme has a field for the measurement ID. See Add Google Analytics 4 to WordPress.
• Track the actions that matter: form submissions and clicks on your phone number. See Track form submissions in GA4.

Privacy and cookie consent

What you need: a privacy policy page, and a consent banner if your visitors or the law call for one. Whether you need a banner depends on where your visitors are and what tracking you run. See Do I need a cookie banner?

If you add a banner, make sure it actually holds tracking back until a visitor accepts. Some banners only show a message.

Signs of plugin overload

• Several plugins doing the same job: two SEO plugins, two security plugins, a caching plugin on a host that caches
• Deactivated plugins left installed (they can still be a security risk: delete them)
• A page builder plugin on top of the block editor, plus add-on packs for it
• Plugins installed for a feature you tried once and stopped using
• Nobody can say what a plugin does

Go through your list once a year. See See which plugins are installed.

If your site runs on Dirigible

Many of these jobs are built in, so a Dirigible site needs fewer plugins:

Dirigible also warns you before you activate a plugin that duplicates a built-in feature, such as a custom post order or related posts plugin. See Plugins Dirigible Replaces.