WordPress powers a large share of the small business web because it is genuinely good at what it does. The trouble arrives through the plugin directory, one convenient install at a time.
The Real Cost Of A Plugin
A plugin costs you three things. Execution time on every page load. Attack surface, because its code runs with the same privileges as your site. And a maintenance dependency on a developer you have never met, who may lose interest.
None of that means avoid plugins. It means each one should be doing something you would miss.
The Audit Worth Doing Once A Year
Open your plugin list and for each one answer: what does this do, when did I last benefit from it, and when was it last updated?
Expect to find a contact form plugin you replaced but never deleted. A page builder used on one page. A caching plugin installed to fix a speed problem that turned out to be a 4MB image. Two plugins doing the same job because the first one seemed broken.
Deactivating is not enough. Deactivated plugin code still sits on disk and can still be reachable. Delete what you are not using.
Watch The Abandoned Ones
The directory shows when a plugin was last updated and whether it has been tested with current WordPress. Anything untouched for two years is a liability, however well it works today. When a vulnerability is found in it, nobody is going to fix it.
Replacing a working plugin feels like wasted effort. It is considerably less effort than cleaning up after it.
A Reasonable Target
Most small business sites run comfortably on well under ten plugins. Security, backups, SEO, a form, caching if you actually need it, and whatever your specific business genuinely requires.
If you are at thirty, there is a faster and safer site hiding underneath, and finding it costs nothing but an afternoon.
