Installing a WordPress plugin is technically four clicks. Doing it without breaking your site or introducing security holes takes slightly more thought than that. The difference comes down to whether you check a few things before clicking activate.

WordPress plugin installation screen showing the official repository search

Where to install plugins from

There are three legitimate sources worth knowing about:

1. The WordPress.org plugin directory

This is built directly into your WordPress admin under Plugins → Add New, and it’s documented in detail on the official WordPress.org Add New Plugins guide. Every plugin here is reviewed by WordPress’s team, GPL-licensed, and free. The vast majority of plugins you’ll ever need live here.

2. The plugin developer’s website

For paid (premium) plugins, you buy directly from the developer and download a zip file. Examples include WP Rocket, Yoast SEO Premium, Gravity Forms, and ConvertKit.

3. The WordPress.com marketplace

This applies if you’re on WordPress.com Business or higher. It offers the same plugins, just through a different install path.

Where NOT to install from

  • “Nulled” or pirated plugin sites. These contain malware embedded directly in cracked versions of premium plugins. Never use these, under any circumstances.
  • Random GitHub repos without verifying who the developer actually is.
  • “Free download” sites that mirror premium plugins. These carry the same risk as nulled versions.
  • Email attachments claiming to be plugin updates.

Plugin malware is the single most common WordPress security incident. Every “free” version of a premium plugin from a non-official source should be assumed infected until proven otherwise.

How to vet a plugin before installing

For each plugin you’re considering, check the following:

1. Last updated date

WordPress.org shows when the plugin was last updated. Anything not updated in the last year is worth a second look. Anything not updated in two or more years should be considered abandoned.

2. Compatibility

The “Tested up to WordPress 6.x” line should match your current version, or come close to it. Plugins that still say “tested up to 5.5” haven’t been touched in a long time.

3. Active installations

Higher install counts generally mean more eyes on the code and faster bug detection. A plugin with 50,000+ active installs tends to be more reliable than one sitting at 200.

4. Recent reviews

Read the 1-star and 2-star reviews specifically, since they tend to reveal what actually breaks. If several recent reviews complain about the same issue, take that seriously.

5. Support response

The “Support” tab on the WordPress.org page shows recent support threads. Check whether they’re actually being answered. An active developer responds to issues, while an abandoned plugin’s support threads tend to sit unanswered for months.

WordPress plugin page showing last updated date, active installs, rating, and recent reviews

The install process

Before installing anything

  1. Take a full backup first. Both database and files. Use UpdraftPlus or a similar plugin, and don’t skip this step no matter how minor the plugin seems. Our guide on setting up automatic WordPress backups covers getting this running once, so you’re never caught without one.
  2. If you have staging, install there first. Test that the plugin doesn’t break anything before it ever touches your live site.

Installation

For plugins from the WordPress.org directory:

  1. Go to Plugins → Add New.
  2. Search for the plugin you want.
  3. Click “Install Now.”
  4. Wait for the installation to complete.
  5. Don’t activate it yet.

For plugins from a developer (zip file):

  1. Go to Plugins → Add New → Upload Plugin.
  2. Choose the zip file from your computer.
  3. Click “Install Now.”
  4. Wait for the installation to complete.
  5. Don’t activate it yet.

Activation

  1. Click “Activate Plugin.”
  2. Immediately visit your homepage and a single post to check things.
  3. Verify everything still works as expected.
  4. Check the plugin’s settings page if it has one, and configure it as needed.

If anything breaks, deactivate the plugin right away and investigate before re-activating it.

Activating one at a time

If you’re installing multiple plugins at once, activate them one at a time rather than all together. Verify your site works after each individual activation.

Here’s why that matters: if something breaks, you’ll know immediately which plugin caused it. Activating five plugins at once and then discovering a broken site means you end up deactivating them one at a time anyway, just after the damage is already done, which is slower and more stressful.

Quick tip: keep a simple text note of which plugin you activated and when, especially if you’re setting up several in one sitting. It turns troubleshooting a week later from guesswork into a five-second lookup.

Plugin updates

Updates are critical to keep running. They include security patches, bug fixes, and compatibility improvements that keep your site safe.

How to update safely

  1. Take a backup before any major update.
  2. If you have staging, test the update there first.
  3. Update plugins one at a time, not all at once.
  4. Verify your site works after each individual update.

Auto-updates

WordPress 5.5 and later supports per-plugin auto-updates, and you can enable auto-update on individual plugins right from the Plugins screen.

The upside is that your site stays current automatically without extra effort on your part.

The downside is that an auto-update that breaks something will break it without your knowledge, sometimes for days before you notice.

A reasonable middle ground: auto-update minor versions (like 1.2.3 to 1.2.4) but manually approve major version jumps (1.x to 2.x), since those are far more likely to introduce breaking changes.

How many plugins should you have

This is one of the most-debated questions in WordPress circles. The quick answer is as few as you genuinely need, and no more.

For a typical blog, that usually looks like:

  • SEO plugin (Yoast or Rank Math).
  • Caching plugin (WP Rocket, W3 Total Cache, LiteSpeed Cache, or your host’s built-in option).
  • Image optimization (Imagify, ShortPixel, or Smush).
  • Backup plugin (UpdraftPlus or BlogVault).
  • Security plugin (Wordfence, Solid Security, or your host’s built-in option).
  • Anti-spam (Akismet).
  • Contact form (Fluent Forms or WPForms).
  • Analytics integration (Site Kit by Google).

That’s eight plugins covering the essentials, plus maybe two to four more for your specific niche (a recipe plugin for a food blog, for instance).

Running 10 to 15 well-chosen plugins is normal. Running 30 or more is usually a sign of plugin sprawl worth auditing. We go deeper into exactly how to run that audit in how many WordPress plugins is too many, which pairs well with this post once your site is up and running.

What to do when a plugin breaks your site

The dreaded “white screen of death” happens when a new plugin activates and your site suddenly goes blank.

Recovery steps:

  1. If you can access the admin, go to Plugins and deactivate the offending one.
  2. If you can’t access the admin, connect via SFTP or your host’s file manager, navigate to /wp-content/plugins/, and rename the offending plugin’s folder (adding “-disabled” to the name works fine). WordPress will auto-deactivate it once it can’t find the expected folder.
  3. Your site should come back at that point.
  4. Investigate the conflict afterward. Check the plugin’s documentation or contact the developer directly.

This is exactly why you back up before installing anything new. If something goes badly wrong, you’ll always have a clean version to restore.

The “should I remove unused plugins” question

Yes, you should. Even deactivated plugins:

  • Take up disk space on your server.
  • Show up in your update queue indefinitely.
  • Can still be security vulnerabilities if they contain flaws, even while deactivated.

If you’ve truly stopped using a plugin, delete it entirely through Plugins → Delete. You can always reinstall it later if you change your mind.

Premium plugin considerations

If you buy a premium plugin, keep a few things in mind:

  • Save the purchase confirmation and license key somewhere safe.
  • Note the renewal date so it doesn’t catch you off guard.
  • Enter the license key in the plugin’s settings to enable updates.
  • When the license expires, the plugin keeps working but stops receiving updates. Decide whether to renew based on how much those ongoing updates matter to you.

A theme like Aurora works the same way: activating your license key isn’t just a formality, it’s what keeps you eligible for updates and support as WordPress itself evolves.

Four clicks, a few minutes of care

Install plugins from the WordPress.org directory or directly from the developer. Verify last-updated date, install count, and recent reviews before committing. Take a backup. Activate one at a time. Verify your site works after each. Keep your plugin count to what you genuinely need. Remove unused plugins entirely rather than leaving them deactivated. Update regularly but test major updates first. The four-click install hides the few minutes of verification that prevent the next site-down emergency.