Open Plugins and there are twenty-three names. Half of them you have never clicked. Someone has told you to delete what you don’t use, and you are afraid the site will go white if you do. Both of those are right, in that order. A plugin you don’t need is one more thing to update and one more way in. A plugin your pages are built with, switched off on a Tuesday, is a white page until someone switches it back.

This is for a business site of about twenty pages, a contact form and no shop. Do it on a morning when you can click through afterwards, and when you know how to reach your host. Not ten minutes before you leave.

The ones that hold the site up

Leave these switched on. How to tell which one you have is under the table.

What it does Leave it on
Builds the pages Elementor, Divi, WPBakery, Bricks, or a plugin that carries your theme’s name
Sends the enquiries The one form plugin a test message actually arrives from
Shows the cookie banner For as long as analytics or ads run
Writes the page titles One SEO plugin, Yoast or Rank Math, not both
Keeps a backup Until you know your host’s copy exists, and how to ask for it
Watches for break-ins Wordfence and the like, for as long as the site stays on WordPress
Speeds the pages up A cache plugin. Switching it off is a tidy-up, not a win
Publishes a second language Only where the site really has one

The builder. Edit the homepage. Pages → All Pages, then Edit. If the way in is “Edit with Elementor”, or Divi, or a backend full of blocks from WPBakery, that plugin is the layout. Switching it off takes the design with it, and the page is left as a stack of text or as bracketed codes where the layout was. A plugin with the same name as the theme (an “Avada” or “Enfold” beside the theme) is in the same category. So is a blocks plugin the theme added, Kadence, Spectra, Stackable, GenerateBlocks, if the pages are made of those blocks. If the name worries you, it is not this week’s deletion.

The form. Send yourself a message from the contact page before you call any form plugin unused. Contact Form 7, WPForms, Gravity Forms, Ninja Forms: a site often has two, from two different people who worked on it. The one that lands in the inbox stays. Jetpack is a bundle, and sometimes the form is inside it, along with the statistics. Treat Jetpack like a builder. Switch it off only when you can say what it was doing, and look straight after.

The cookie banner. Switching it off while Google Analytics or an ad pixel still runs is the breach, not a tidy-up. The banner is what stops those from firing before anyone has agreed. Two banners means two plugins. Keep the one that shows, and turn the other off only once you’ve watched a page load without a second banner and without a hole where the first was.

The SEO plugin. It writes the title in the browser tab, which is the title Google usually shows. The score next to it is not Google’s. What Google actually lists is in will Google still find you. If Yoast and Rank Math are both active, they are fighting over that title. Turn one off and look at the browser tab on the homepage and on one inner page. A title that collapses into “Home”, or into the business name on every page, means you turned off the one that was writing them. Turn it back on, and try the other. Write the titles down before you delete either. The Search Console verification is sometimes pasted into this plugin too. If you delete it blind, you can lock yourself out of the report. The listing stays. Your view of it doesn’t.

Backup, security, cache. Ask the host where their backups are and how far back they go before you delete the only backup plugin. UpdraftPlus can stay until that answer is in writing. A security plugin earns its place while the site is still WordPress. An outdated plugin is the usual way in (what to do in the first 24 hours), which is why the ones you keep want updates. A cache plugin such as WP Rocket makes the site faster and occasionally serves an old copy. Leave it until you have a reason.

The ones that are usually a leftover

For a site that doesn’t sell online and doesn’t take comments, these are the names that sit there from the year the site was built.

  • A slider or carousel, Slider Revolution and its relatives. Open the homepage on your phone after you’ve turned it off. If the page still makes sense, it was decoration. A decoration that needs its own updates is one more outdated plugin, and that is the usual way in.
  • A migration plugin from the original build. Duplicator, All-in-One WP Migration. Once that move is years behind you, the plugin and the installer files it leaves are a copy of the site waiting in a folder. Delete it. This is not your backup plugin. Don’t confuse the two.
  • A file manager. Anything that lets you edit the site’s files from the browser. Your host already gives you the files. A second door there is not worth keeping.
  • Share buttons, a popup, related posts, a floating chat you never asked for. Turn one off and look at the page. If you can’t see what changed, it can go.
  • A second form plugin, once the test message has told you which one is real.
  • Akismet or another comment filter, when the site has no comments. Settings → Discussion shows whether comments are open. If they are, and you don’t want them, close them there. Then the filter has nothing to do.
  • A maintenance or “coming soon” plugin, when the site is already public. Switched on by mistake, it is what customers and Google both see instead of you.
  • Hello Dolly, the sample plugin older WordPress installs still have. It does nothing for a business.
  • A language plugin installed “for later”, WPML or Polylang, on a site where every page is in one language. If there really is a second language, it stays.
  • WooCommerce on a site with nothing to buy. The add-ons that depend on it have to go first, or WordPress will refuse to turn WooCommerce off. If you might sell later, this is a decision, not a Tuesday click. If you do sell, it stays.

Inactive plugins are the easy first pass. “Inactive” means the files are still on the server. A deactivated plugin is still there to be attacked. WordPress’s own hardening guide says to delete what you don’t use, not to switch it off and leave it. If it has been off since the agency left and the site looks right, delete the ones you recognise. A name you don’t recognise can wait for the one-at-a-time test rather than a blind delete. Deleting throws away that plugin’s saved settings. Months of the site looking right without it is the evidence you won’t need them.

One at a time

  1. Take a backup, in the host’s panel or with the backup plugin. If the admin goes white, this is what you ask the host to restore.
  2. Screenshot the plugin list, so you have a before.
  3. Delete the inactive ones you recognise, from the list above.
  4. Pick one active candidate. Deactivate. Don’t delete yet. Plugins → Installed Plugins, then Deactivate.
  5. Open the homepage, one inside page and the contact page, on your phone as well as the computer. Send the form if you went near forms or the cookie banner. If you went near the SEO plugin, compare the browser-tab title with what you wrote down.
  6. A white page, or a layout collapsed into a stack of text: activate it again. That one holds the site up. Stop, and leave it.
  7. If you can’t get into the admin either, call the host and have them restore this morning’s backup. Don’t keep clicking.
  8. If the site still looks like itself the next day, delete it. Then the next one. Not five in a row before you’ve looked.

Update the ones that stay. An old plugin you decided to keep is the one to patch. The PHP version underneath the whole list is a separate question: which version you are on.

Each premium plugin you delete also stops a renewal. Themes, form plugins, SEO plugins and backup plugins are the yearly licences in what a WordPress site really costs. Deleting one you have already proved you don’t use is the saving that doesn’t risk the site. Deleting one to save the renewal, without the morning above, is how the site goes white.

What happens to them on Johnny

The jobs move. Forms, analytics and the cookie banner come with the site, and we test them before the switch. The plugins stay behind, which is the point: on your domain there is nothing left to update. Pages built in Elementor, Divi or WPBakery are rebuilt as they look, without the builder. A normal blog moves post by post, each post at its old address.

A shop or a members’ login can’t move yet. If the site needs one, we say so before you pay.

How a move goes: How it works.

Sources