A WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop. It is what makes WordPress flexible, and also why plugins deserve the most attention when you think about security and upgrades.
What is a WordPress plugin?
A plugin is made of PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. code. You install it from the admin screen, and from that moment its code runs on your server alongside the WordPress core.
The WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits. core is deliberately small. Plugins fill the gaps: one handles your contact form, another your SEO fields, a third your cacheA cache is a store of ready-made copies, such as finished pages, so a website or browser can show something instantly instead of building it again.. They hook into the core and can change what a page contains, add admin screens, store data in the database and answer requests from visitors.
Plugins come from many authors, from large companies to single developers. Their quality, update habits and PHP compatibility vary. Some are removed from the official directory when they are abandoned or when a serious problem is not fixed. Others simply stop getting updates and stay installed.
What plugins mean for your PHP site
Every plugin is code you did not write and still depend on. It adds to your attack surfaceThe attack surface is the total of all places where an attacker could try to get in, such as logins, forms, plugins and the code on your server., because a flaw in any of them can matter even if the rest of the site is current. When a plugin has a known vulnerabilityA vulnerability is a weakness in software that an attacker can use to do something the software was never meant to allow, such as reading private data., the fix arrives as a new plugin version, and it only helps once you have installed it.
Plugins also decide whether a PHP upgrade goes smoothly. A site can only move to a newer PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. if the core, the theme and every active plugin support it. One outdated plugin can block the whole move, or cause a fatal error afterwards. When we update PHP in WordPress, we start by finding those plugins on a test copy, so your live site stays up.
How to audit your plugins
Open the Plugins screen and go through the list with three questions. Do you use it? Was it updated recently? Does it state support for your PHP version? You can see the last update and the tested-up-to versions on the plugin’s page in the official directory at wordpress.org.
Deactivate and delete plugins you no longer use, rather than only switching them off. Check for plugins that do the same job twice. Keep a note of which plugin does what, so that the next person does not have to guess. Before you remove anything on a live site, take a backupA backup is a separate copy of your website's files and database, so you can bring the site back after a mistake, a hack or a failed update..
When a plugin is a reason to rebuild
Sometimes the cleaner answer is to remove the need for the plugin. A contact form or a page layout that needed three plugins in WordPress can be a few lines on a static page. If most of your plugins exist to keep a brochure site fast and safe, a move from WordPress to a static site may remove the whole category. A static siteA static website is made of ready-made page files that the server hands over as they are, with no PHP code or database working behind the scenes. has no plugin code running on the server during a page view, which means a smaller attack surface, though forms and third-party scripts still need care.
When to act
Act when a plugin has not been updated for a long time, when a security notice names a plugin you run, or when a PHP upgrade is planned. If the site is already broken by a plugin, use recovery modeWordPress recovery mode is a safe mode that starts after a serious error, so you can still log in and switch off the plugin or theme that broke your site. or ask us to fix your WordPress website.
Frequently asked questions
What does a WordPress plugin do?
A plugin adds a feature to WordPress without changing the core software. Examples are contact forms, SEO settings, caching, security checks and shop functions. Each plugin is PHP code that runs on your server.
Can a plugin make my site vulnerable?
Yes. A plugin is extra code that can contain a vulnerability, and if it is outdated or abandoned, flaws may stay unfixed. A deactivated plugin that is still installed can also remain a risk, so remove what you do not use.
Why did my site break after a PHP update?
A plugin may use PHP features that are not available in the newer version, which causes a fatal error. Test the new PHP version on a copy of the site first, and check that each plugin lists support for it.
How many plugins is too many?
There is no safe number. What counts is whether each plugin is needed, maintained and compatible with your PHP version. Fewer plugins means less code to patchA security patch is a software update that closes one known security weakness and adds nothing else, so installing it protects you against that problem. and fewer parts that can conflict.