Every plugin is third-party code running on your website. It can slow down your site, clash with other plugins and, in the worst case, open the door to attackers. Still, most WordPress websites pile up dozens of plugins and Elementor add-ons over the years – many of them long unused. With this checklist, you’ll check in about 30 minutes what stays, what gets replaced and what can go.
Why a plugin audit pays off
- Security: According to the Patchstack 2026 security report, a total of 11,334 new vulnerabilities were reported in the WordPress ecosystem in 2025 – 42% more than the previous year. 91% of them were in plugins, only 9% in themes. For 46%, there was no fix yet at the time of disclosure, and mass attacks started after a median of just five hours.
- Speed: Many plugins load their scripts and stylesheets on every page – even where they aren’t needed at all.
- Stability: The more plugins, the higher the risk of conflicts. A typical example: the Elementor editor takes forever to load because two plugins interfere with each other.
- Effort and cost: Every plugin needs updating, and premium licenses cost money every year.
Preparation: backup, staging and plugin list
- Create a backup – files and database.
- Work on a staging copy so your live website stays untouched during testing.
- Make a plugin list: Under “Plugins → Installed Plugins”, note down all plugins with their status and version. With WP-CLI, this takes seconds:
wp plugin list --fields=name,status,version,update
The 4-question method: how to assess every plugin
Go through your list line by line and ask four questions about each plugin:
1. Do I actually use it?
Many plugins were installed for a one-off task – an import, a migration, a test – and then forgotten. If you can’t say in one sentence what a plugin is for, it’s a candidate for the delete list.
2. Can WordPress, my theme or Elementor already do this?
WordPress now has a lot built in: lazy loading for images, WebP support and the Site Health check. Elementor Pro includes forms, popups and a Theme Builder. And your SEO plugin usually already generates the XML sitemap and manages redirects. A separate plugin for the same task is just extra baggage.
3. Is it still maintained?
Check WordPress.org or the developer’s site for the last update. Rule of thumb: no update for more than six months or “not tested with your version of WordPress” is a warning sign. If a plugin has been removed from the directory, you should replace it immediately.
4. What does it cost in performance?
Some plugins are practically weightless, others add dozens of database queries to every page. You’ll find out how to measure this below.
In the end, each plugin gets one of three decisions: keep, replace or delete.
Which plugins do you really need? The overview
| Category | Do you need it? | Note |
|---|---|---|
| SEO | Yes, exactly one | Never run two SEO plugins at the same time |
| Caching | Yes – as a plugin or server-side | Don’t combine two caching plugins |
| Security / firewall | Depends on your hosting | At Servflix, the firewall already runs on the server |
| Backup | Depends on your hosting | At Servflix, daily backups are included |
| Image optimization | Often useful | Important if you have lots of large photos |
| Contact form | One is enough | Elementor Pro has its own form widget |
| Cookie banner | Yes, if you use tracking | Important for GDPR |
| Elementor add-on packs | As few as possible | See next section |
| Slider, countdown, social share | Usually not | Often doable with Elementor’s built-in tools |
Clean out Elementor add-ons
Add-on packs for Elementor often come with 50 or more extra widgets. A typical website uses two or three of them – but all of them get loaded and maintained. Here’s how to proceed:
- Open Elementor → Element Manager. There you can see how often each widget is used on your website.
- Deactivate all widgets with zero uses. They’ll no longer appear in the editor, and the editor becomes less cluttered.
- Many add-on packs also have their own toggles that let you switch off individual modules. Use them.
- If you only use a single widget from a pack, replace it with a standard Elementor widget and delete the pack.
Rule of thumb: at most one add-on pack on top of Elementor Pro. Whether you need Elementor Pro at all or an alternative will do, we compare in our article ProElements vs. Elementor Pro.
Measure instead of guessing: Query Monitor and PageSpeed
With the free Query Monitor plugin, you can see for every page how many database queries, HTTP requests and PHP errors each plugin causes (“Queries by Component” view). Plugins near the top of this list deserve a closer look. Deactivate Query Monitor again after your analysis.
Also measure your most important pages with PageSpeed Insights before and after the cleanup. That way you’ll see in black and white what the audit achieved.
Safely remove plugins in 5 steps
- Create a backup.
- Deactivate the plugin, don’t delete it right away.
- Test your website: homepage, forms, checkout and the most important subpages – ideally for one or two days.
- Delete the plugin. Important: deactivated plugins remain on the server and, depending on the vulnerability, can still be attacked.
- Check for leftovers: some plugins leave tables and settings behind in the database. Many offer a “Delete data on uninstall” option for this – enable it before deleting.
Your checklist to tick off
- ☐ Backup created and staging copy set up
- ☐ Plugin list with version and status noted down
- ☐ Every plugin assessed with the 4 questions
- ☐ Duplicate functions (SEO, caching, forms) resolved
- ☐ Unused Elementor widgets deactivated in the Element Manager
- ☐ Unmaintained plugins replaced
- ☐ Unnecessary plugins deactivated, tested and deleted
- ☐ Load time measured before and after
- ☐ Next audit added to the calendar
Frequently asked questions
How many plugins are too many?
There’s no fixed number. 20 well-maintained, lightweight plugins are no problem, while a single badly coded one can bring a website down. What matters is the quality, maintenance and usefulness of each individual plugin – not the number.
Is it enough to deactivate a plugin?
No. Deactivated plugins remain on the server, and depending on the vulnerability, their files can still be attacked. You should delete plugins you no longer need after a testing period.
How often should I audit my plugins?
Once a quarter is a good rhythm. An audit is also worthwhile before major updates, before a relaunch and whenever your website gets noticeably slower.
Are premium plugins more secure than free ones?
Not automatically. According to the Patchstack 2026 report, premium components actually had three times more known, actively exploited vulnerabilities. On top of that, you only get updates with a valid license. An expired license is therefore a security risk.
Conclusion: fewer plugins, fewer worries
A plugin audit takes half an hour and gives you a faster, more stable and more secure website. It gets even easier when your hosting already covers the basics: at Servflix, the firewall, daily backups and caching run at server level – so you don’t need separate plugins for them. Take a look at our Elementor hosting or all our plans.