Out of the box, WordPress only comes with the essentials: pages, posts, images and users. Everything else is added through plugins. You install a plugin with a few clicks in the back end. After that, the new feature is ready to use, often with its own settings. The official directory on wordpress.org has over 76,000 free plugins (as of October 2026). On top of that, there are paid premium plugins.
Typical plugins on small business websites include contact forms and appointment booking, multilingual support for German and French, an online shop such as WooCommerce and SEO settings for titles and descriptions. Cookie notices, caching and image optimisation are often added too.
The downside: every plugin is someone else's code on your website. According to the security firms Patchstack and Wordfence, 91 to 96% of known WordPress security vulnerabilities affect plugins and only rarely WordPress itself. Once a vulnerability becomes public, automated attacks specifically look for websites still running the old version. That's why plugins need regular updates. Too many plugins also make a website slower and more prone to conflicts.
What to look out for:
- As few as possible: take a critical look at every feature. Do you really need it?
- Well maintained: when was the last update? How many active installations are there? Is the plugin compatible with the current WordPress version?
- A reputable source: only buy premium plugins from the developer, never as a ‘free version’ from dodgy websites.
- Tidy up: delete deactivated plugins, because they can contain vulnerabilities too.
Our maintenance packages include updates for WordPress, themes and plugins.
A farm shop in Entlebuch wants to offer products for collection on its WordPress website. Instead of paying for custom development, the owner installs a shop plugin. Two smaller add-ons follow for collection times and order confirmations. A year later, the website is running twenty plugins, some of them without an update for months. A review gets rid of seven unnecessary plugins. The rest are updated every month. Afterwards, the site loads faster and there are fewer potential entry points for attacks.