Common Plugin Questions: Amount, Speed, Security

Published

March 13, 2013

9 Comments

I get pinged at least once a week, if not a few times during a week, about plugins – which ones they should use, download, and how many a blog or WordPress website should have.

Ultimately, there isn’t any exact science to these questions but there are some general principles that seem to be agreed upon by those who work with WordPress professionally.

I wanted to post simply here so as to direct people to this so they can have their questions answered succinctly, especially around performance and security.

The question usually is asked like this:

How many plugins should I have? Does having more increase the risk of getting hacked? Does having more mean that my site is going to be slower?

What they are generally asking in the first question is to find a “top limit” of what someone may feel is “enough” plugins. In other words, what’s the total amount that one should have. The answer is simple: You can have as many as you want as you can do whatever you darn well please but I counsel people to limit the total amount of plugins for two reasons:

Management – The less you have the less you have to manage in terms of updates. This saves you time. That’s always a win.
Less Might Be More – I believe if you strategically look at your blog and site you may come to realize that many of the plugins are not as useful as you might have originally believed. In fact, you may not need a good majority of those plugins. Keep it trim and ask yourself the hard question of “Do I really need this?” and “Do my users really find this feature useful and valuable?”

To answer the second question of security I want to debunk a common misconception that many people have which is that the more plugins you have = the higher risk.

This is false. It isn’t the amount of plugins but rather about the amount of poorly developed ones that you need to be cautious of. You can have 50 plugins installed from trusted providers who build safe and quality products and be completely fine. Or, you could have 5 plugins from the corners of the internet that may leave you entirely vulnerable.

Look at the reviews of the plugins, date of updates (when it was last updated), the support area, as well as the general perspective of the community about it. Do your research so you don’t get bit. And test it on a local install so that it doesn’t conflict with other plugins.

Finally, the third question of speed. The number of plugins can impact speed if they are poorly developed or are super-bloated and causing your database to slow down in crazy ways. Server specs and hosting speeds can offset some of this but poorly coded plugins are simply poorly coded plugins and will impact performance.

WP Beginner has once said that they actively run 53 plugins and their speed is great:

Syed lurks around here from time to time and can answer specifically if he wants. They even have an answer themselves.

The point of speed, performance, and security is all about lowering risk on all fronts. There are enough opportunities and techniques for optimization but again, less may just be “more” for your WordPress site and blog.

Hope that helps.

There are 9 comments

March 13, 2013 #

John Turner

Excellent post! I’ll add…

You can have 50 plugins installed from trusted providers who build safe and quality products and be completely fine.

Even trusted sources can have security issues. I’ve seen plenty. But trusted sources tend patch them faster. So keep them up to date.

Finally, the third question of speed. The number of plugins can impact speed if they are poorly developed or are super-bloated and causing your database to slow down in crazy ways.

I’d argue that even optimized code will add execution time. Anytime you add more logic you add execution time in ms but these do add up. But if you are caching you can negate this of course.
- March 13, 2013 #
  
  Syed Balkhi
  
  Totally agreed. I think an important thing to consider is whether the plugin is for front-end or not. A lot of the plugins can just do one thing, and do one thing very well.
March 13, 2013 #

Alex

Good post, John. What I’ve taken more and more notice are plugins that load when they’re not in use or have components that load when not using them. Plugins that bundle a variety of different shortcodes can be a culprit here. They often have a variety of scripts loading on the site even if you’re not using them. Plugin devs need to be mindful to set some conditions on how their plugins load. Providing options to disable functionality helps, or only firing off when a plugin-specific function is present on the current page being another.

Good stuff.
March 13, 2013 #

Grant Palin

This myth is getting tiresome. It’s been said time and again by those in the know that it’s the quality, not the quantity, that matters. One bad plugin can gunk up the works, as can one conflict between two separate plugins.

As for me, I use about 24 plugins. I previously balked at having more than a handful of plugins running, but following my realization of the above, I’ve selected useful plugins with singular purposes for specific tasks. Works for me!
March 13, 2013 #

MaAnna

From doing site reviews that include the backend and security, what I see are folks who have plugins to make up for what a. Heap theme lacks, or plugins that do just one thing that another plugin they have has an option for. Even worse, the site owner doesn’t even know what some of their plugins do. They just saw it recommended and installed it. On top of that, many install plugins that require configuration, but never do it.

So, while the answers you provided in the post are true, they are generic answers to generic questions and still don’t address most of the problems I see. Only a re iew from a qualified set of eyes can properly determine if someone has too many, or the wrong kind of plugins.
March 13, 2013 #

Syed Balkhi

Just to add to this post, I’m sure I can reduce the number of plugins of my site from 50+ to easily under 15. All I would have to do is build a massively bloated plugin like JetPack. But I like my plugins to do one thing and do it well. It is also good for the sake of organization (my preference).

I have a simple plugin that just redirects users when they type /random/ to a random post on the site.

Another sets minimum comment length. Another disable self pings. Another preserve editor scroll position, so when I save a post… it doesn’t start me at the top again.

These plugins do one thing, and do them well.

Ofcourse I have other big ones like WP SEO by Yoast, W3 Total Cache etc.
- March 13, 2013 #
  
  Syed Balkhi
  
  Addition: In short, I don’t like a ridiculously crazy functions.php file. I like the concept of site-specific plugin, and I have quite a few of those small and some big functions as individual plugins. This allows me to easily get rid of one without editing a big long file…
March 14, 2013 #

Dan

Good critical points from others already, and I will add a few more in the same vein.

WordPress is inherently inefficient in an unoptimized environment, and a lot of people use it in such an environment — which may also be less than optimal for security. Adding stuff to WP will intensify the problem. http://ankursethi.in/2013/03/wordpress-under-siege/

More plugins = more code, and more code really does mean higher risk of security and performance problems. It is like adding windows and doors to a building. Even the high quality security door introduces a measure of risk. Having one door presents a lot less risk. That doesn’t mean quality doesn’t count; it’s just a simple fact of probability. Few people can vouch for every line of code they’re using, and none can flawlessly identify all vulnerabilities, so there is always a baseline risk that goes up the more code you use, and especially if it’s higher risk material run in a higher risk environment by people who don’t care or aren’t able to assess quality.

And yes there are always exceptions and tradeoffs that get made in specific cases.
- March 14, 2013 #
  
  Dan
  
  I meant having one door as opposed to many will tend to be a lower risk situation, unless of course the door is a board swinging on one hinge with nobody watching it. The typical “rather bad” real world scenario is someone on cheap shared hosting with no real concern or idea about plugin quality or security randomly selecting from the free options and then seldom running updates. Generally speaking, I think it;s just a matter of probability that the more stuff they install, the more likely it is a scripted attack will catch a vulnerability they have.

How do you stay on top of your WordPress game?