Find the right WordPress plugin, without the noise.

WooCommerce

Featured

EcommerceFree

WooCommerce turns a WordPress site into a store without moving it to another platform. The core plugin is free and handles products (simple, variable, grouped, downloadable), orders, stock, coupons, taxes, shipping zones and a checkout that can run on blocks. Payments come through extensions or provider plugins; Stripe and PayPal are first-party. What makes WooCommerce significant is the surrounding ecosystem — subscriptions, memberships, bookings, multilingual stores and accounting integrations all exist as plugins that share the same data model. That openness is also the cost: performance and checkout behaviour depend on what you install, and a large catalogue needs hosting that can handle it. It suits businesses that want ownership of their storefront and are willing to maintain it.

Easy Digital Downloads

EcommerceFreemium

Easy Digital Downloads is built for selling files rather than physical stock. Instead of shipping zones and weight tables you get secure download links, file access controls, discount codes and a cart that can be turned off entirely for single-product sites. The extension library covers the parts digital sellers actually need: software licensing with activation limits, recurring subscriptions, Stripe and PayPal gateways, email marketing hooks and invoice generation. Because it does not carry WooCommerce's physical-product overhead, its admin is smaller and its checkout is quicker to configure. The free core is genuinely usable for a first product; the paid bundles matter once you add licensing or subscriptions. It is the default answer for theme shops, plugin authors and anyone selling courses or assets directly.

MemberPress

Ecommerce

MemberPress sells memberships rather than products: you define plans, connect a payment gateway and then decide which content each plan unlocks. Rules can target posts, pages, categories, custom post types or uploaded files, so a course library, a paid newsletter and a client portal can coexist on one site. It handles recurring billing, proration, coupons, trials and dunning for failed cards, which is the part most home-grown membership setups get wrong. Integrations cover Stripe, PayPal, Mailchimp and a handful of LMS plugins. It is a commercial plugin with annual licensing, and the price reflects that it replaces several smaller tools. The trade-off is scope: if you only need to hide a few pages, a simpler access plugin will do, and MemberPress will feel heavy.

Wordfence Security

SecurityFreemium

Wordfence combines a web application firewall with malware scanning and login hardening in one plugin. The free tier includes the firewall ruleset, a scanner that compares core, theme and plugin files against known signatures, brute-force protection with configurable lockouts, and live traffic logging that shows requests hitting your site. Its threat intelligence feed is shared across millions of installs, which is why new plugin vulnerabilities tend to appear as firewall rules quickly. Premium adds real-time rules, country blocking, two-factor authentication and support. The scanning is thorough to the point of being slow on large sites, and the live traffic view can grow unwieldy without tuning. For a small business site that needs one security plugin and no server access, it remains the most complete free option.

Patchstack

SecurityFreemium

Patchstack approaches WordPress security from the vulnerability side. It maintains a database of plugin and theme issues, watches the ones installed on your site, and can apply virtual patches at the firewall layer before an official update exists. That matters because plugin vulnerabilities are often disclosed before a fix ships, and small sites rarely update within hours. The free plan covers monitoring and alerts; paid plans add virtual patching, a firewall, and a dashboard across multiple sites. It is less of an all-in-one scanner than Wordfence and more of an early-warning and mitigation layer, which makes it a reasonable companion rather than a replacement. Agencies that maintain client sites tend to value the per-site overview and the disclosure timeline most.

Solid Security

SecurityFreemium

Solid Security, formerly iThemes Security, focuses on hardening the parts of WordPress that attackers probe first. It can enforce strong passwords, add two-factor authentication, limit login attempts, rename the login URL, change database prefixes on new installs, and schedule file-change detection that compares your installation against a known-good hash. The free version covers most of that; the pro tier adds an uptime monitor, passwordless login, and priority support. Its settings screen is organised by concern rather than by feature, which makes it easier to reason about than a long checkbox list. The plugin is less interested in live traffic inspection than Wordfence, so the two are sometimes run together. It suits administrators who want a checklist of hardening measures applied consistently.

WooCommerce

Featured

EcommerceFree

WooCommerce turns a WordPress site into a store without moving it to another platform. The core plugin is free and handles products (simple, variable, grouped, downloadable), orders, stock, coupons, taxes, shipping zones and a checkout that can run on blocks. Payments come through extensions or provider plugins; Stripe and PayPal are first-party. What makes WooCommerce significant is the surrounding ecosystem — subscriptions, memberships, bookings, multilingual stores and accounting integrations all exist as plugins that share the same data model. That openness is also the cost: performance and checkout behaviour depend on what you install, and a large catalogue needs hosting that can handle it. It suits businesses that want ownership of their storefront and are willing to maintain it.

WP Rocket

Featured

Performance

WP Rocket is the commercial caching plugin most agencies reach for when a site needs to get faster without server changes. It writes page cache files, generates and inlines critical CSS, defers or delays JavaScript, lazy-loads images and iframes, preloads links and sitemaps, and applies database and cron cleanup. The defaults are sensible enough to help on activation, and the interface keeps advanced options behind clear labels rather than a wall of toggles. It integrates with most hosting stacks and with Cloudflare, and its preload uses a bot that requests pages to warm the cache. The trade-off is that it is closed-source and annual: identical results can be assembled from free plugins plus a good host. For a business site where nobody wants to debug caching rules, the time saved is the product.

WooCommerce

Featured

EcommerceFree

WooCommerce turns a WordPress site into a store without moving it to another platform. The core plugin is free and handles products (simple, variable, grouped, downloadable), orders, stock, coupons, taxes, shipping zones and a checkout that can run on blocks. Payments come through extensions or provider plugins; Stripe and PayPal are first-party. What makes WooCommerce significant is the surrounding ecosystem — subscriptions, memberships, bookings, multilingual stores and accounting integrations all exist as plugins that share the same data model. That openness is also the cost: performance and checkout behaviour depend on what you install, and a large catalogue needs hosting that can handle it. It suits businesses that want ownership of their storefront and are willing to maintain it.

LiteSpeed Cache

PerformanceFree

LiteSpeed Cache is free and unusually capable, but its best features depend on the server. On LiteSpeed or OpenLiteSpeed hosting it can serve pages from a server-level cache, which is faster than anything a PHP plugin can do. On Apache or Nginx it falls back to a normal page cache and loses part of its advantage. The plugin also handles image optimisation, CSS and JS minification, critical CSS generation, lazy loading, and a QUIC.cloud CDN integration. Its settings screen is enormous, with dozens of options and a preset import tool, which is both the appeal and the problem: an untuned install can break layouts. Hosts that ship LiteSpeed increasingly preconfigure it. If your host runs LiteSpeed, it is the obvious first choice; if not, evaluate whether the server cache features are worth switching hosts for.

Contact Form 7

FormsFree

Contact Form 7 is the form plugin that ships with an enormous number of tutorials, which is why it is still installed on so many sites. Forms are written as markup-like templates with tagged fields, so you control exactly what renders and can move fields between columns without fighting a builder. It supports file uploads, reCAPTCHA, Akismet and a simple mail configuration with hooks for custom handling. Storage of entries is not built in — the plugin emails submissions and leaves persistence to add-ons, which is a deliberate design choice and a frequent surprise. Styling is minimal by default, so it inherits your theme unless you add CSS. For a simple contact form on a site that already has one, it is still the lightest option. For anything transactional or multi-step, most teams outgrow it quickly.

Burst Statistics

AnalyticsFree

Burst Statistics is a privacy-first analytics plugin that keeps everything on your server. It records pageviews, referrers, device types and countries without cookies or personal identifiers, and presents them in a clean dashboard with date comparisons. The plugin is lightweight by design: a small tracking script and aggregated tables rather than raw event storage, so it does not bloat the database the way a full event tracker would. A pro tier adds email reports, campaign tracking and ecommerce metrics. It is a sensible default for sites that want basic numbers without Google, and it pairs well with a consent-free privacy policy. The limitations are the flip side of its simplicity: no funnels, no user-level paths, and less granular attribution than a hosted product. For a directory, blog or small store, that trade is usually fine.

BackWPup

BackupsFree

BackWPup is a free backup plugin with a job-based model: you define a job, choose what it includes (database, files, plugins, themes, uploads), pick a destination and a schedule, and it runs on WP-Cron or a real cron job. Destinations include Dropbox, S3-compatible storage, Google Drive, FTP and email. It can also produce a WordPress XML export, which is useful for moving content rather than a full site. The interface exposes more detail than UpdraftPlus — compression format, file exclusions, job logs — which suits administrators who want to see exactly what happened. Restores are performed by uploading the archive through the plugin or manually; the free version's restore tooling is less guided than its backup side. For a no-cost, well-understood backup routine with off-site copies, it remains a solid choice.

Query Monitor

Developer utilitiesFree

Query Monitor is a debugging plugin that adds a toolbar panel showing what WordPress actually did to render a page. It lists every database query with the caller that triggered it, slow queries, duplicate queries, PHP errors and warnings, HTTP API calls, hooks and their callbacks, enqueued scripts and styles, and the template hierarchy that produced the page. It also flags plugins and themes that contribute unusually many queries. The value is diagnostic: when a page is slow or a plugin behaves oddly, this shows the cause instead of inviting guesswork. It is developer-only and should not be left active on a production site for visitors — its overhead is real, and the toolbar exposes internals. Used during development or behind a staging password, it is one of the most useful plugins in the ecosystem.