The Core Categories, Not Just Names
New WordPress users often ask "which plugins should I install?" as if there's one universal list. A better question is which categories of functionality your site needs — the specific plugin you pick inside each category matters less than covering the category at all.
This lesson focuses on six categories that apply to almost every site: security, backups, caching, SEO, forms, and spam protection. Yesterday's checklist still applies to every plugin you shortlist inside them.
- ✓Every site needs a security layer, a backup plan, and some form of caching — regardless of niche.
- ✓SEO and forms matter for almost any site that wants visitors or leads.
- ✓Spam protection becomes essential the moment you add any form or comment section.
One Plugin per Category
Here's a reasonable starter stack, organized by the problem each category solves rather than by brand loyalty.
Firewall rules, login attempt limits, and malware scanning — Wordfence and Sucuri are common choices.
Scheduled, off-site copies of your files and database — UpdraftPlus is a popular free option.
Serves pre-built pages instead of rebuilding them on every visit — WP Super Cache or W3 Total Cache.
Sitemaps, meta descriptions, and readability guidance — Yoast SEO, which you touched on Day 17 preview.
Drag-and-drop form building without writing PHP — WPForms or Contact Form 7.
Filters junk submissions out of comments and forms automatically — Akismet ships with WordPress by default.
You don't need every plugin listed here — pick one per category that fits your site, not all of them at once.
What Happens Without Them
// What an unprotected site looks like No security plugin // brute-force login attempts go unnoticed No backups // one bad update can mean starting from zero No caching // every visitor rebuilds the page from scratch No spam filter // comment sections fill with junk overnight
Install Order That Avoids Conflicts
Installing all six at once can make it hard to tell which plugin caused an issue if something breaks. Add them one at a time instead.
A Lean Stack vs a Bloated One
Signs Your Stack Needs Trimming
Breaking Down What You Just Learned
Think in categoriesSecurity, backups, caching, SEO, forms, and spam protection cover most sites.
One plugin per categoryPick a single trusted option rather than stacking several that overlap.
Install order mattersSecurity and backups first, caching last, once your content has settled.
Watch for overlapDuplicate roles and unused settings pages are signs to trim your stack.
Try It Yourself
Open your site's Plugins page and list every active plugin next to the category it covers from Section 02. Note any category that's missing, and any category with more than one plugin in it.
Build Your Starter Stack
Covering all six categories on your capstone site
By the end of today, your site should have a plugin covering each core category, installed in a sensible order.
- Install a security plugin and complete its basic setup wizard.
- Install a backup plugin and schedule a recurring backup.
- Add an SEO plugin and a form plugin, then build one simple contact form.
- Confirm spam protection is active on your new form.
- Install a caching plugin last and verify your site still loads correctly.
Recap
Security, backups, caching, SEO, forms, and spam protection.
Avoid overlap — pick a single trusted plugin for each job.
Security and backups first, caching last.
Watch for duplicate roles and unused settings pages.
Key Takeaways
- Think about plugin categories first — security, backups, caching, SEO, forms, and spam protection cover most sites.
- One well-vetted plugin per category is better than several that overlap in function.
- Install security and backups first, and add caching last, once your content has settled.
- A bloated stack shows up as duplicate roles, a slow admin dashboard, and unused settings pages.
- Revisit your plugin list periodically and deactivate anything you're no longer using.