{"id":20432,"date":"2026-11-02T12:29:47","date_gmt":"2026-11-02T11:29:47","guid":{"rendered":"https:\/\/stage.surver.nl\/kennisbank\/wordpress-plugins-themas-gids\/"},"modified":"2026-11-03T12:16:29","modified_gmt":"2026-11-03T11:16:29","slug":"wordpress-plugins-and-themes-guide","status":"publish","type":"kennisbank","link":"https:\/\/stage.surver.nl\/en\/kennisbank\/wordpress-plugins-themas-gids\/","title":{"rendered":"WordPress Plugins and Themes: Choosing, Managing, and Keeping Them Secure"},"content":{"rendered":"
\"WordPress<\/figure>\n\n\n\n

Open your dashboard Plugins > Installed plugins<\/strong> and has thirty plugins. You don\u2019t recognize five of them, and for two of them, you\u2019re not sure if they still work. You can recognize good WordPress plugins and themes by their recent updates, compatibility with the current version of WordPress, a large number of active installations, and an active developer. Keep the number of plugins low, remove the ones you don\u2019t use, and never install nulled versions.<\/p>\n\n\n\n

In this guide, I'll walk you through how to choose, how to manage, and when to clean up, with a link to an article that goes into more detail on each topic.<\/p>\n\n\n\n

Plugins and themes: What's the difference?<\/h2>\n\n\n\n

A WordPress plugin is software that adds functionality to your site, such as a contact form or an online store. You can think of them like apps on your phone, each of which you install for a specific task. A WordPress theme determines the design and layout of your site, from colors and fonts to the header and footer. In between is the page builder, a plugin that lets you build pages visually and therefore has a major impact on how your site looks. You can find out whether you need such a builder later in this article.<\/p>\n\n\n\n

What plugins and themes have in common is that they are third-party code running on your server. So any error or vulnerability in that code becomes a problem for your site, even if you didn\u2019t write it yourself. Outdated plugins are one of the most common causes you\u2019ll see in How a WordPress Website Gets Hacked<\/a>. A plugin determines what your site does, and a theme determines how it looks, but as the owner, you're responsible for both.<\/p>\n\n\n\n

Do you really need a plugin for this?<\/h2>\n\n\n\n

For many tasks, you don\u2019t need an additional plugin because WordPress, your theme, or your hosting provider already handles it. That\u2019s why I always check what\u2019s already available before installing anything. WordPress itself can do more than many people realize. The block editor builds pages with columns, buttons, and galleries, and WordPress automatically generates an XML sitemap. Many themes also have their own settings for colors, fonts, headers, and footers, so you don\u2019t need a separate plugin for those.<\/p>\n\n\n\n

The biggest savings are often found in hosting. With a good Managed WordPress Hosting<\/a> run backups, malware scans, and a server-level firewall. On Surver\u2019s shared hosting plans, these include automatic backups, Imunify for malware scans, and the ModSecurity firewall. Caching is handled by the LiteSpeed server in conjunction with a single caching plugin, and you can create a staging environment by cloning your installation in Installatron. Adding a backup plugin or a heavy-duty security plugin on top of that would largely duplicate the same work.<\/p>\n\n\n\n

My rule is simple. Every plugin must perform a task that nothing else on your site already does. Having two caching plugins or a backup plugin in addition to the backups provided by your hosting provider won\u2019t make your site any more secure\u2014it\u2019ll just slow it down\u2014and yet we regularly come across these duplicates. What virtually every site does need, however, is an SEO plugin, a form plugin, and a cookie banner. You only need a spam filter if comments are enabled.<\/p>\n\n\n\n

How to Evaluate a WordPress Plugin or Theme<\/h2>\n\n\n\n

You can evaluate a plugin or theme based on a handful of indicators from the WordPress plugin directory\u2014the official repository at wordpress.org\/plugins\u2014or from the vendor\u2019s website. The table lists, for each indicator, what constitutes a good sign and when you should look further.<\/p>\n\n\n\n

Signal<\/th>Where can you find it?<\/th>A good sign<\/th>Warning<\/th><\/tr><\/thead>
Last update<\/td>Plugin page, \u201cLast Updated\u201d field\u201d<\/td>Updates from the Past Few Months<\/td>No update for over a year (our rule of thumb)<\/td><\/tr>
\u201cTested up to\u201d version<\/td>Plugin page, \u201cTested up to\u201d field\u201d<\/td>Current or previous version of WordPress<\/td>Note that the plugin has not been tested with recent versions of WordPress<\/td><\/tr>
Active Installations<\/td>Plugin Page<\/td>Thousands of active installations or more<\/td>Few installations and an unknown developer<\/td><\/tr>
Reviews<\/td>Reviews tab<\/td>Many reviews and positive recent reviews<\/td>Recent 1-star reviews regarding the same issue<\/td><\/tr>
Support Forum<\/td>Tab with support<\/td>Questions are answered and resolved<\/td>No response from the developer for months<\/td><\/tr>
Known vulnerabilities<\/td>WPScan or Patchstack<\/td>No open reports, or quickly closed<\/td>Unpatched Vulnerability<\/td><\/tr>
Source or developer<\/td>Plugin directory or the developer's website<\/td>Official plugin directory or well-known developer<\/td>Download from an unknown site<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

No single indicator is proof on its own; it\u2019s the combination that matters. A small plugin with few installations can be perfectly fine if the developer maintains it well. Conversely, popularity doesn\u2019t automatically mean safety, because widely used plugins are particularly attractive targets for attackers. That\u2019s why you should always read the recent reviews\u2014not just the average rating. If I see a string of 1-star reviews about the same issue following the latest update, I\u2019ll hold off on installing it.<\/p>\n\n\n\n

Free or premium?<\/h3>\n\n\n\n

Premium isn\u2019t automatically better than free. With a premium plugin, you pay for a license, which gives you access to updates and support. That\u2019s also where the pitfall lies. If the license expires, you often stop receiving updates, and the plugin then behaves like an abandoned plugin, with the same risks. A \u201cnulled\u201d plugin is a cracked version of a paid plugin that often contains malware\u2014and you should never install it. To find out why, read Why You Should Never Use Nulled Themes and Plugins<\/a>.<\/p>\n\n\n\n

Choosing a WordPress Theme<\/h3>\n\n\n\n

You choose a WordPress theme using the same criteria as for a plugin, plus a few points that apply specifically to themes. A lightweight theme loads only what you use, while an all-in-one theme sometimes comes with dozens of plugins that you\u2019ll then have to maintain. Make sure the theme is responsive\u2014meaning it works well on mobile devices\u2014is accessible, and is compatible with your editor or page builder. If you want to customize the theme, do so in a child theme, which preserves your changes even when the parent theme is updated. You can find out how that works in Create a child theme<\/a> and Install and customize a theme<\/a>. If you'd rather not do that customization yourself, our webmaster service<\/a> it for you.<\/p>\n\n\n\n

How many WordPress plugins are too many?<\/h2>\n\n\n\n

There\u2019s no magic number, because one bad plugin carries more weight than ten good ones. What does matter, however, is overlap between plugins, heavy plugins that load scripts on every page, and the number of plugins you can still keep track of yourself. A typical example is a form plugin that loads its scripts on every page, even though you only have one contact page. Moreover, every plugin is one more update to keep track of, so more plugins also mean more maintenance.<\/p>\n\n\n\n

Measure it instead of guessing. Test the loading speed of a few pages before and after installing a plugin, and you'll immediately see the impact it has. You can read more about measuring and other causes of slow performance in Why Your WordPress Website Is Slow<\/a>. My advice is to be strict. If you can't explain what a plugin does in a single sentence, it doesn't belong there. If you want to find out which plugin is slowing down your site, you can do so via WordPress Speed Optimization<\/a>.<\/p>\n\n\n\n

Keeping WordPress Plugins and Themes Secure<\/h2>\n\n\n\n

Maintaining a secure website means updating it promptly, monitoring vulnerabilities, and reviewing your site\u2019s content every quarter. Most of the work lies in that regular routine, not in expensive tools. If you update your site every month and clean it up every quarter, you\u2019ll prevent most of the problems we encounter on neglected sites.<\/p>\n\n\n\n

Updates: When and How<\/h3>\n\n\n\n

Updates are your most important security measure because they patch known vulnerabilities. Before each update, a backup<\/a>, even if it's just a small plugin. I always test major updates and updates to WooCommerce or your page builder first in a staging environment<\/a>, a copy of your site where any errors won't affect visitors. For a WooCommerce online store, you'll also want to check the checkout and payment links after every update, and for that, there's WooCommerce maintenance<\/a>.<\/p>\n\n\n\n

You can Turn automatic updates on or off<\/a> install per plugin. I only do that for developers I trust, and even then, I check after an update to make sure the site is still working. If something does go wrong, read what to do in the event of a Site Down After an Update<\/a>.<\/p>\n\n\n\n

Monitoring Vulnerabilities<\/h3>\n\n\n\n

A vulnerability is a flaw in the code that allows an attacker to do something they\u2019re not supposed to, such as logging in or uploading files. Vulnerabilities in plugins and themes are published in databases like WPScan and Patchstack. A notification doesn\u2019t necessarily mean your site has been hacked. Usually, an update is already available to fix the vulnerability, and in that case, updating is sufficient; however, if no update is available, you should replace the plugin. To learn how to keep track of these alerts, read Monitoring vulnerabilities in plugins<\/a>. If a vulnerability has already been exploited and your site has been compromised, it becomes a recovery process, and for that, you can contact WordPress hacked<\/a>.<\/p>\n\n\n\n

The plugin audit: ten minutes every quarter<\/h3>\n\n\n\n

A plugin audit is a routine check of all the plugins and themes on your site. I compare it to the electrical panel, where you check once a quarter to see what\u2019s still connected and what can be removed.<\/p>\n\n\n\n

    \n
  1. Make a list of all plugins and themes via Plugins > Installed plugins<\/strong> and View > Themes<\/strong>.<\/li>\n\n
  2. For each plugin, note what it does and whether you still use it.<\/li>\n\n
  3. For each plugin, check the latest update and the \u201cTested up to\u201d version.<\/li>\n\n
  4. Search for known vulnerabilities by plugin in WPScan or Patchstack.<\/li>\n\n
  5. Replace or remove unnecessary and abandoned plugins\u2014after creating a backup, and if in doubt, test them on the staging environment first.<\/li>\n\n
  6. Delete unused themes, except for one default theme to keep as a backup.<\/li>\n<\/ol>\n\n\n\n

    Cleanup: Outdated and Unused Plugins<\/h2>\n\n\n\n

    If you don't use a plugin, delete it\u2014because simply deactivating it isn't enough. The files from a deactivated plugin are still on your server and may still be vulnerable. You can recognize an abandoned plugin by a long period without updates and an inactive support forum. A premium plugin with an expired license falls into the same category, because it no longer receives updates. Also note that some plugins leave behind tables and settings in the database when you delete them. This is usually harmless, but after a major cleanup, it\u2019s worth cleaning up the database as well.<\/p>\n\n\n\n

    Never delete anything without first backing it up, and if in doubt, test a replacement on the staging environment first. If your dashboard stops working after a plugin fails, disable it by renaming the folder using File Manager. The complete step-by-step guide, including how to replace a deprecated plugin, can be found in Clean up outdated and unused plugins<\/a>.<\/p>\n\n\n\n

    Page Builders, Elementor, and Changing Themes<\/h2>\n\n\n\n

    Page builders, Elementor, and theme changes each have their own article, because they have a greater impact on your site than the average plugin. A page builder affects every page, so any error in it will be immediately visible everywhere. If you\u2019re unsure whether to use a visual page builder or the standard editor, read Page Builder or Block Editor<\/a>. If you choose a page builder, stick to just one, because having two builders running side by side loads duplicate code and makes it difficult to switch later.<\/p>\n\n\n\n

    If you use Elementor, always update Elementor and Elementor Pro together; otherwise, you'll run into errors in the editor. You can find instructions on how to do this in Maintaining Elementor<\/a>. You should never activate a new theme directly on your live site; always do so on the staging environment first, because menus, widgets, and layouts may shift. You can read the full guide in How to Switch WordPress Themes Without Breaking Your Site<\/a>.<\/p>\n\n\n\n

    Where will you start today?<\/h2>\n\n\n\n

    The best place to start is with the plugin audit above, beginning with the plugins you don't recognize. For each unknown plugin, find out what it does, and if no one knows what it's for, remove it after backing up your site. You can add new plugins via Plugins > New plugin<\/strong>, from the plugin folder or as a ZIP file. You can read step-by-step instructions on how to do this in Install, manage, and update plugins<\/a>.<\/p>\n\n\n\n

    What we provide as standard at Surver saves you from having to install a few plugins. Backups, malware scans with Imunify, and the ModSecurity firewall are included in all shared hosting plans, so you don\u2019t need a backup or security plugin. For a new WordPress installation, we install LiteSpeed Cache, Astra, and Elementor by default. You can add an SEO plugin (Rank Math) and a cookie banner (Complianz) as premium add-on<\/a> purchase, and we'll set them up for you. If you don't want to manage plugins and themes yourself, we'll take care of that with WordPress maintenance<\/a>. We update the core, themes, and plugins on a monthly basis; starting with the Business plan, a vulnerability scanner runs daily; and with the Enterprise plan, we test updates on the staging environment first.<\/p>\n\n\n\n

    Frequently Asked Questions<\/h2>\n\n\n\n

    Are WordPress plugins safe?<\/strong><\/p>\n\n\n\n

    Most of them do, as long as they come from a reliable source and are actively maintained. The main risk lies in outdated, abandoned, and compromised plugins. If you keep your plugins up to date and remove the ones you don't use, you'll significantly reduce that risk.<\/p>\n\n\n\n

    Are WordPress plugins free?<\/strong><\/p>\n\n\n\n

    There are plenty, available through the official plugin directory on wordpress.org. Premium versions require a license, which you\u2019ll need to continue receiving updates and support. So be sure to factor in the renewal cost when choosing a premium plugin.<\/p>\n\n\n\n

    How many themes can I have installed?<\/strong><\/p>\n\n\n\n

    Your active theme, your child theme (if you have one), plus one default theme as a backup. You\u2019ll need that backup theme in case your own theme ever fails. Delete all other themes, because even an inactive theme can be a security risk.<\/p>\n\n\n\n

    Do I need a cache or backup plugin for Surver?<\/strong><\/p>\n\n\n\n

    Do not use a backup plugin, because Surver automatically creates server-level backups on shared hosting plans. For a cache plugin, use only LiteSpeed Cache, which works in conjunction with the LiteSpeed server and is automatically installed during a new installation. A second cache plugin is unnecessary.<\/p>","protected":false},"excerpt":{"rendered":"

    Je opent in je dashboard Plugins > Ge\u00efnstalleerde plugins en telt dertig plugins. Vijf daarvan herken je niet, en van twee weet je niet of ze nog iets doen. Goede WordPress-plugins en thema’s herken je aan recente updates, compatibiliteit met de huidige WordPress-versie, veel actieve installaties en een actieve ontwikkelaar. Houd het aantal plugins laag, […]<\/p>\n","protected":false},"author":2,"featured_media":20489,"template":"","kennisbank_categorieen":[57],"class_list":["post-20432","kennisbank","type-kennisbank","status-publish","has-post-thumbnail","hentry","kennisbank_categorieen-plugins"],"acf":[],"_links":{"self":[{"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/kennisbank\/20432","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/kennisbank"}],"about":[{"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/types\/kennisbank"}],"author":[{"embeddable":true,"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/users\/2"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/media\/20489"}],"wp:attachment":[{"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/media?parent=20432"}],"wp:term":[{"taxonomy":"kennisbank_categorieen","embeddable":true,"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/kennisbank_categorieen?post=20432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}