24/7 HUMAN WORDPRESS WATCH · SAN DIEGO, CA · SINCE 1998
HackGuard.com Managed WordPress Security with Heart
TOPIC CLUSTER · SECURITY & HARDENING

What Are the Top 20 WordPress Plugins to Avoid?

Jim Walker By Jim Walker, The Hack Repair Guy™ Updated Topic: WordPress Security & Malware Defense
Quick Answer

Avoid plugins that run continuous background scans (like Broken Link Checker), load scripts on every page unnecessarily, duplicate your host backups locally, or leave outdated code on your server. Keep your active plugin count low and delete deactivated plugins.

What Are the Top 20 WordPress Plugins to Avoid?
Common WordPress plugins that cause high server load, database bloat, or security risks, plus lighter alternatives.

To help optimize your WordPress website for SEO, here is a list of the top 20 plugins to avoid

Broken Link Checker runs continually and may slow page loading.

Contact Form 7 loads plugin assets on every page.

Contextual Related Posts has outdated or bloated coding.

Disqus Comment System has outdated or bloated coding.

Download manager has outdated or bloated coding.

EWWW Image Optimizer runs continually and may slow page loading.

Essential Grid has outdated or bloated coding.

Image Optimization plugins runs continually and may slow page loading.

JetPack has outdated or bloated coding.

VaultPress has outdated or bloated coding.

NextGen Gallery has outdated or bloated coding.

Query Monitor runs continually and may slow page loading.

Revolution Slider has outdated or bloated coding.

S2 Member has outdated or bloated coding.

Similar Posts has outdated or bloated coding.

SumoMe has outdated or bloated coding.

WP Reset may created bloated database tables.

WordPress Multilingual (WPML) has outdated or bloated coding.

XML Sitemaps. Sitemap Plugins are generally unnecessary. Be sure to use more fully featured SEO plugins when possible, like Slim SEO or Rank Math SEO.

Yet Another Related Post has outdated or bloated coding.

As a WordPress website manager with over a decade of experience at HackGuard.com service, I recommend avoiding or replacing the plugin above. Plugins that change hands are a bigger risk still: see how 30 plugins were hijacked after being sold.

More Details About My Plugins List

It is not my intention to discredit the hard work of the developers who oversee these plugins. This list is based on my personal experience.

As a general rule of thumb, the fewer plugins "installed" within a WordPress website the better. Both active and inactive plugins installed within WordPress may impact the security of a website as well.

When Using WordPress, It's Best To Keep The Number Of Plugins To A Minimum

This is true for both active and inactive plugins, as they can both affect the security of your website.

After activating a plugin, you must disable all non-required features. For example, many SEO plugins have Google Analytics ( GA) enabled by default. If you are not using GA, be sure to disable that feature. Contact forms are another common source of feature bloat. If you are using a contact form on your website, be sure to choose a plugin that does not inject the contact form assets into every page of your website. I added Contact Form 7 to my list for this very reason.

Likewise, as a general rule, be sure to use social media connection plugins in moderation. Active social media connection plugins can greatly slow down the full loading of a web page.

If you are looking to dramatically improve the performance of your website, please see my article, "Improving Your WordPress Website Speed with Cloudflare, Image Optimization and Litespeed Today".

What is HackGuard.com service?

Based in San Diego, California, HackGuard.com service provides a personalized white label-ready WordPress management and security service experience for just pennies a day. [supsystic-price-table id=55]

Disclaimer:

If you need help with any of the recommendations above, please feel free to call me at (619) 479-6637. This post was written by Jim Walker for informational purposes only and was neither solicited nor paid for.

Frequently asked questions

What is the fastest way to fix or prevent this issue on my WordPress site?
Avoid plugins that run continuous background scans (like Broken Link Checker), load scripts on every page unnecessarily, duplicate your host backups locally, or leave outdated code on your server. Keep your active plugin count low and delete deactivated plugins.
Can HackGuard.com handle security & malware for my WordPress site?
Yes. For $14.95/month (or $49.85/month for up to 10 sites), Jim Walker and the HackGuard team perform a 9-point manual security and database overhaul in Week 1, test all core and plugin updates weekly by hand, maintain 60-day offsite cloud backups, and back your site with a free HackRepair.com cleanup guarantee. Call Jim directly at (619) 479-6637.
Jim Walker, The Hack Repair Guy

Written and reviewed by Jim Walker, The Hack Repair Guy™

Jim Walker has protected and repaired WordPress websites since 1998. Want Jim to handle your WordPress security, weekly updates, and 60-day offsite cloud backups for 50 cents a day?

Client Video Story