Nine Plugins Worth Removing From a Site You Just Took Over
Taking over a WordPress site usually means inheriting a plugin list nobody has audited in years. Most of it can go. These are the categories worth removing first, in the order that buys you the most.
The short version
- Deactivated plugins are still files on your server. Delete, do not deactivate.
- Two plugins doing the same job is worse than either one alone.
- Anything unmaintained for a year is a scheduled vulnerability.
- Audit before you delete. Some of these are load-bearing.
1. Every deactivated plugin
Deactivated plugins do not run on page load, but their files sit on the server and can be reached directly if they contain a vulnerable entry point. If you are not using it, delete it. If you might need it later, you can reinstall it in thirty seconds.
2. The second caching plugin
Sites that have changed hosts often end up with two caching layers fighting each other, plus leftover drop-in files from a third. The symptoms are cache that will not clear and changes that do not appear. Pick one caching solution, remove the others, and check wp-content for leftover object-cache.php or advanced-cache.php files.
3. The second SEO plugin
Two SEO plugins both output meta tags and schema. You end up with duplicate titles, duplicate descriptions and conflicting structured data. Export settings from the one you are keeping, then fully uninstall the other rather than deactivating it.
4. All-in-one suites
Plugins that do security, caching, backups, SEO and image optimisation in one package do each job adequately and cost real page weight. Replace with focused tools for the two or three jobs you actually need.
5. Social sharing plugins
Most load external scripts from several networks, add render-blocking requests, and generate almost no traffic. Static share links styled with your own CSS do the same job at zero cost.
6. Related posts plugins
Many run expensive database queries on every page load to compute relevance. Most themes can output related posts from the same category with a simple query, which is both faster and more predictable.
7. Anything unmaintained for a year
Check the plugin’s last-updated date in the repository. A plugin that has not been touched in twelve months is not being watched for vulnerabilities, regardless of how well it works today.
8. Page builders you are not using
A builder that was used for three pages years ago still loads its assets. Rebuild those pages in the block editor, then remove it. Budget real time for this one — builder content often does not survive removal intact.
9. Nulled or pirated anything
Remove immediately and treat the site as compromised until you have audited it. Nulled plugins are the most common delivery mechanism for backdoors we encounter.
Watch out
Before deleting anything, take a full backup and work through the list on staging. Some plugins that look decorative are holding a critical integration together.
A safe order of operations
1. Back up and clone to staging
Do the entire audit on staging. Only repeat the changes on production once the staging site is verified.
2. List everything with last-updated dates
Note which plugins are abandoned, which duplicate each other, and which you cannot identify.
3. Delete deactivated plugins first
Zero risk, immediate reduction in attack surface.
4. Resolve duplicates one at a time
Export settings, remove the loser, test, then move on. Never two at once.
5. Replace the suites
Install focused replacements, configure, verify, then remove the suite.
6. Re-test the critical paths
Forms, checkout, search, login. Then repeat on production.
Common questions
How many plugins is too many?
There is no number. Twenty well-maintained lightweight plugins can be healthier than five bloated ones. Judge by what each one costs in requests and queries.
Will removing plugins speed up my site?
Usually yes, but the gain comes from removing the ones that load assets or run queries on every page, not from the count itself.
What if I cannot tell what a plugin does?
Deactivate it on staging and use the site normally for a day. If nothing breaks, it is a candidate for removal.
Sumit
Writes everything on TechMozz.