The Plugin That Does One Small Thing

Thirty plugins and nobody knows why

Count the plugins on any WordPress site that has been live for five years or so. Thirty is unremarkable. Forty is not unusual.

Some do substantial work: the forms, the backups, the security. Many were installed to do one small thing. Add a button. Load a font. Paste a line of tracking code into the header.

Each was a reasonable choice on the day, made by somebody who has since moved on. None was ever removed.

Why the small ones become weak points

A plugin's code runs with the same access to the site as WordPress itself. A flaw in any one of them can be enough to let somebody in.

Small plugins are often written by one person in a weekend and shared for free. Some are maintained for years. Many are not, and the author simply stops, without announcement.

WordPress keeps changing, and so do the methods of people looking for weaknesses. A plugin nobody has touched since 2015 has missed everything since.

When the plugin directory closes a plugin, sometimes over a security problem, the sites already using it are not told. It simply stops receiving updates.

Count them by what they do

• Essential, such as backups, security, forms and caching.
• Features visitors use, such as a booking calendar or gallery.
• Small jobs: a button, a font, a line of code.
• Duplicates, two plugins doing the same work.
• Leftovers from a feature removed long ago.
• Mysteries nobody can explain.

The third group is where the risk hides. Each one brings a whole plugin, with its own author and update history, for a job that needs a few lines in the theme.

When each was last updated

For each plugin, look up its page in the WordPress plugin directory. It shows when the plugin was last updated, how many sites use it, and which version of WordPress it has been tested with.

A plugin not tested with the last few major releases carries a warning on that page that it may no longer be maintained. Take the hint.

A plugin that has vanished from the directory, or whose page says it has been closed, is a stronger warning still.

Plugins bundled with a premium theme are a special case. They are updated only when the theme's author ships a new version, and some never are.

Jobs WordPress now does itself

Several common small-job plugins duplicate features WordPress has added in the last few years.

The Customizer's Additional CSS panel now holds custom styling, so a plugin for it is redundant. The site icon shown in browser tabs has its own setting, as does the logo in most current themes.

Videos from YouTube and similar sites embed themselves when their address is pasted on a line of its own. A custom HTML widget handles most of the small boxes people once installed plugins for.

Worth checking before keeping anything that does one of these.

Where small jobs belong

The right home for a small job is the site's own code, written by whoever maintains it.

That usually means a child theme: a small layer on top of the main theme that holds your changes and survives its updates. Some developers use a small site-specific plugin instead, holding nothing but your own customisations.

Either way, the tracking code, the font and the button become a few documented lines with no outside author who can disappear.

The theme editor inside the dashboard is not the place for this work. It changes the live site directly, and edits made to the main theme vanish at its next update.

A worked example

A dance studio with classes for children and adults had a site built five years ago and extended by three different people since.

It ran thirty-four plugins. Sorting them by what they did took an hour.

Eleven were doing small jobs: adding the Analytics code, loading a font, showing a floating register-now button, holding custom styling, counting down to the spring recital, and others like them.

Four of the eleven had not been updated in more than two years. One had been closed in the directory.

The developer moved the Analytics code, the font and the button into a child theme, put the styling into Additional CSS, and replaced the countdown with the recital date in plain text. Two redirect plugins became one.

The site now runs nineteen plugins, and every one has a known purpose and an author still updating it.

Removing them safely

Take a full backup first, and work on a copy of the site if one is available.

Deactivate one plugin at a time and check the pages that used it. Some leave behind shortcodes, bits of bracketed text that appear on the page once the plugin has gone.

Then delete the plugin rather than leaving it deactivated. A deactivated plugin's files are still on the server, and a flaw in them can sometimes still be reached.

This is work for whoever maintains the site, done on a quiet morning, not between customers.

Before adding the next one

The clean-up holds only if the habit changes.

Before installing anything, ask whether WordPress or the theme already does the job, and whether a few lines in the child theme would do it better.

If a plugin really is the answer, check its last update, its number of users and whether its support forum gets replies. Then write down what it is for, so the next person to count does not have to guess.

The counter-case

Plugin count alone is not the measure.

A site with thirty well-maintained plugins, kept updated and reviewed by somebody who knows why each is there, can be safer than one with ten that nobody has looked at in years.

Some small-job plugins are maintained by large teams and are perfectly sound to keep.

And a site due for a rebuild this year may be better served by doing this properly in the new build than by surgery on the old one.

Otherwise, count your plugins by what they do, and move the small jobs into the theme.

The order to do it in

1. Take a full backup of the site.
2. List every plugin and what it does.
3. Note when each was last updated.
4. Delete duplicates and leftovers first.
5. Move small jobs into a child theme.
6. Replace abandoned plugins that do real work.
7. Write down why each remaining plugin stays.

Step two is the foundation. Until each plugin has a one-line description of its job, nobody can say which are essential and which are a liability.

Why that code should not be edited from inside the dashboard is covered in WordPress 4.9 and the code editor warning.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.