• Having fewer, well-maintained plugins is always better than a bloated plugin stack
• Favour plugins with strong development teams, regular updates and excellent support
• Always choose bespoke development over installing unnecessary plugins
• There isn’t one “best” plugin; different websites have different requirements
• These are our recommendations based on real-world experience

If one plugin has challenged Yoast’s position over the last few years, it’s Rank Math. We’re seeing more and more clients adopting it, largely because its free version includes features that traditionally required premium upgrades elsewhere.

Its schema options, redirect management, and modular approach make it particularly attractive for advanced users.

While we still lean towards Yoast for most bespoke projects, we wouldn’t be surprised if Rank Math eventually becomes the most widely used SEO plugin in the WordPress ecosystem.

If we could only recommend one WordPress security plugin, Wordfence would be it. The free version alone is excellent and more than sufficient for many websites.

Premium plans provide faster access to firewall rule updates and malware signatures, making them particularly worthwhile for higher-risk or business-critical websites.

Its features include:

• Web Application Firewall (WAF)
• Malware scanning
• Brute-force protection
• Login security
• File integrity monitoring
• Security alerts

This is one of those plugins that rarely appears in “best plugin” lists but proves invaluable on client websites. WP Activity Log creates a detailed audit trail showing who changed what and when. It’s particularly useful for:

• Multi-user websites
• Publishers
• Membership websites
• eCommerce stores
• Troubleshooting unexpected changes

When multiple people manage a website, having a clear activity history can save hours of investigation.

WP Rocket has earned its reputation as one of the best all-around WordPress performance plugins. It combines several optimisation features into a relatively straightforward interface, including:

• Page caching
• File optimisation
• Lazy loading
• Database cleanup
• JavaScript delay
• CSS optimisation
• Preloading

It’s one of the easiest premium plugins to recommend because it consistently delivers good results without requiring advanced technical knowledge.

Object caching stores the results of database queries, reducing the amount of repeated work WordPress has to perform. This makes it particularly effective for:

• WooCommerce
• Membership websites
• Large publishing platforms
• Query-heavy websites

Technologies such as Redis are commonly used to provide object caching at the server level.

While UpdraftPlus is an excellent plugin, we don’t typically rely solely on WordPress plugins for client backups.

As part of our managed hosting platform, websites are backed up automatically every day and replicated to two independent off-site storage providers as part of our disaster recovery process.

That approach removes the dependency on a plugin while providing additional resilience should the worst happen.

gravityforms.com

Gravity Forms remains our preferred forms plugin.

It’s incredibly flexible and has become something of an industry standard for bespoke WordPress development.

Features include:

• Multi-page forms
• Conditional logic
• File uploads
• Payment integrations
• User registrations
• Extensive API support
• Hundreds of third-party integrations

For anything beyond a simple contact form, it’s usually our first recommendation.

Sending email directly from WordPress using PHP mail is increasingly unreliable. Many email providers simply won’t trust messages sent that way. WP Mail SMTP solves this by connecting WordPress to dedicated email providers such as:

• Mailgun
• Microsoft 365
• Google Workspace
• Amazon SES
• SendGrid
• SMTP servers

This is one of our favourite developer tools. Visitors never see it, but developers use it constantly. Query Monitor provides detailed insights into:

• Slow database queries
• PHP errors
• REST API requests
• AJAX requests
• Hooks and actions
• HTTP requests
• Performance bottlenecks

When we’re investigating a slow WordPress website, Query Monitor is often one of the very first tools we open because it quickly highlights where WordPress is spending its time.

Every WordPress website should have a reliable way of managing redirects. The Redirection plugin provides a simple interface for creating and managing:

• 301 redirects
• 302 redirects
• Redirect groups
• Redirect logging

While it’s useful for day-to-day website management, it becomes particularly important during website migrations.

Changing URLs without implementing proper redirects can result in broken links, lost search rankings and a poor user experience. Giving both developers and clients an accessible way of managing redirects makes ongoing website maintenance considerably easier.

WP Accessibility isn’t designed to make an inaccessible website compliant on its own. Instead, it provides a collection of useful enhancements that can help improve accessibility.

Features include:

• Skip links
• Language and text direction improvements
• Accessibility toolbar options
• Form enhancements
• Utility fixes

It’s a useful supporting plugin, but accessibility should always begin with good design, semantic HTML and proper development practices rather than relying on plugins alone.

If you’d like to understand more about this topic, we’ve covered it in our guide to creating a WCAG-compliant WordPress website.

One of the most interesting recent developments is the official WordPress MCP Adapter.

It allows AI assistants and third-party tools that support the Model Context Protocol (MCP) to interact with WordPress in a secure, structured way.

Potential use cases include:

• Managing content through AI assistants
• Automating editorial workflows
• Integrating WordPress with external AI tools
• Building bespoke AI-powered processes

While still relatively new, we think this is an exciting glimpse into how AI will integrate with WordPress over the coming years.

This is probably our most opinionated recommendation in the entire article.

At Yellow Peach, we don’t build bespoke client websites using page builders such as Elementor, Divi or WPBakery. They’re inherently bad products; they’ve made WordPress more accessible and have enabled millions of people to build websites without writing code.

However, they don’t align with the way we approach bespoke WordPress development.

Page builders are designed to cater for almost every possible layout and use case. As a result, they often introduce additional HTML, CSS and JavaScript that simply isn’t needed for an individual website. Over time, this can impact:

• Core Web Vitals and loading performance
• Long-term maintainability
• Consistency across the website
• Development flexibility
• The ease of introducing new functionality

Instead, every website we build is based on a bespoke WordPress theme that’s designed and developed specifically for that client.

Using native WordPress tools like Gutenberg blocks allows us to create editing experiences that are tailored to each website, rather than asking clients to build pages from dozens of generic widgets. The result is a website that’s typically:

• Faster
• Easier to maintain
• More consistent
• Simpler for content editors
• Better positioned to grow over time

That’s not to say page builders never have a place. For smaller brochure websites, prototypes or projects with very limited budgets, they can be a perfectly sensible solution.

But for the bespoke WordPress websites we specialise in, we believe a custom-built theme delivers a better outcome for both our clients and their users.

Many plugins promise SEO, performance, security, backups, analytics and marketing automation all in one package. In reality, they often do each task less effectively than dedicated solutions. Smaller, focused plugins are usually easier to maintain and troubleshoot.

A plugin that hasn’t been updated for several years should immediately raise questions. Regular updates indicate that developers are actively maintaining compatibility, fixing bugs and addressing security vulnerabilities.

Whenever you’re evaluating a plugin, it’s worth checking:

• When it was last updated
• Whether it’s compatible with the latest version of WordPress
• How responsive the developer is to support requests
• How many active installations it has

Popularity alone shouldn’t determine your decision, but active maintenance certainly should.