Choosing and managing plugins

What plugins are

A plugin adds features to WordPress: contact forms, SEO tools, online shops, backups, caching, security, analytics. Plugins are PHP code that hooks into WordPress (you will write your own later in the course). Once active, a plugin's code runs on every request where it is needed, which is why choosing well matters.

Managing plugins

In the dashboard, Plugins → Installed Plugins lists them with Activate, Deactivate, Delete and update links. Plugins → Add New Plugin searches the official Plugin Directory, and Upload Plugin installs a zip from elsewhere.

WP-CLI does the same. On this site, external downloads are disabled, so the examples use the two plugins WordPress ships with:

wp plugin activate hello
wp plugin list --fields=name,status,version

Plugin 'hello' activated.
Success: Activated 1 of 1 plugins.
+---------+----------+---------+
| name    | status   | version |
+---------+----------+---------+
| akismet | inactive | 5.7.2   |
| hello   | active   | 1.7.2   |
+---------+----------+---------+

Hello Dolly now shows a random lyric at the top of every admin screen. Let's look at what a plugin is, by reading its header, the comment at the top of its main file that WordPress reads:

<?php
$data = get_plugin_data( WP_PLUGIN_DIR . '/hello.php', false, false );
foreach ( [ 'Name', 'Version', 'Author', 'RequiresWP', 'RequiresPHP' ] as $field ) {
	echo str_pad( $field, 12 ), $data[ $field ] ?: '(not set)', "\n";
}
echo "active: ", is_plugin_active( 'hello.php' ) ? 'yes' : 'no', "\n";

Name        Hello Dolly
Version     1.7.2
Author      Matt Mullenweg
RequiresWP  (not set)
RequiresPHP (not set)
active: yes

Deactivate or delete?

• Deactivate stops the plugin running. Its files and settings stay, so you can turn it back on.
• Delete removes the plugin's files. Well-written plugins also offer to remove their data (database tables and options) when deleted, through an uninstall routine.

wp plugin deactivate hello
wp plugin delete hello
wp plugin list --fields=name,status

Plugin 'hello' deactivated.
Success: Deactivated 1 of 1 plugins.
Deleted 'hello' plugin.
Success: Deleted 1 of 1 plugins.
+---------+----------+
| name    | status   |
+---------+----------+
| akismet | inactive |
+---------+----------+

Deactivating is also the first step in troubleshooting: if the site breaks after installing or updating a plugin, deactivate it. If you cannot reach the dashboard, use wp plugin deactivate <name> or rename the plugin's folder in wp-content/plugins over FTP or your host's file manager; WordPress then treats it as missing and deactivates it.

Choosing a plugin

Before installing, check the plugin's page in the directory:

• Last updated: within the last few months is a good sign.
• Tested up to: should be a recent WordPress version.
• Active installations and ratings: popularity is not proof of quality, but a widely used plugin gets more scrutiny.
• Support forum: are questions answered? Are recent threads full of "broke my site"?
• Developer: an established developer or company?
• What it loads: some plugins add scripts and styles to every page even where they are not used.

Prefer one good plugin that does a job well over several that overlap. Be wary of pirated ("nulled") premium plugins, which commonly contain malware.

How many plugins is too many?

There is no magic number; a site with 30 well-written plugins can be faster than one with 5 poor ones. But every plugin:

• adds code that must load, and often database queries;
• is something to update and a possible security hole;
• can conflict with other plugins or the theme.

Ask of each one: do I still need it? Could a small piece of code (in a plugin of your own) do the job? Is the feature available in WordPress core already? (For example, WordPress creates XML sitemaps at /wp-sitemap.xml on its own, without a plugin.)

Updates

Updates fix bugs and security holes, so they matter. Dashboard → Updates and the Plugins screen show available updates. You can enable auto-updates per plugin in the Automatic Updates column; it is a good choice for trusted, well-maintained plugins, especially security-related ones.

For important sites:

1. Take a backup before major updates (the hardening and backups lesson covers how).
2. Test big updates (for example, a major version of a shop plugin) on a staging copy first.
3. Read the changelog for anything that says "breaking change".

With WP-CLI, wp plugin update --all updates everything, and wp plugin update <name> --version=<x.y.z> installs a specific version if you need to roll back.

Must-use plugins

Files placed in wp-content/mu-plugins/ are must-use plugins: they load automatically on every request, cannot be deactivated from the dashboard, and load before normal plugins. Hosts and developers use them for site-critical code. They appear under Plugins → Must-Use.

Common mistakes

• Installing a plugin for every small need.
• Never removing plugins that were tried and abandoned.
• Ignoring updates for months.
• Installing plugins from untrusted sources.
• Updating everything on a live shop at once without a backup.

Exercise

List the plugins on a site you manage (or your local site). For each one, write what it does, when it was last updated, and whether you still need it. Deactivate one you do not need, check the site still works, then delete it.