The plugin tax: what eighteen WordPress sites taught us about sprawl

We maintain a fleet of WordPress sites. A few years in, we did something uncomfortable: we counted every plugin across all of them and worked out what each one actually cost.

Nobody chooses plugin sprawl

It arrives the way weight does. A form plugin, because you needed a form. An SEO plugin, because you needed a title tag. A redirect plugin, because a page moved. A slider, once, in 2019, for a campaign that ended. A security plugin to watch the other plugins. A caching plugin to undo the damage the others did.

Every one of those decisions was correct on the day it was made. The sum of them is a site that takes six seconds to load and that nobody wants to touch.

What each plugin actually costs

The install button is free. The plugin is not. It charges you in four currencies.

• Speed. Most plugins load their CSS and JavaScript on every page, not just the pages that use them. A form plugin adds weight to your about page.
• Security surface. Every plugin is code from a stranger running with full database access. The most common way a WordPress site gets compromised is not WordPress. It is plugin number fourteen, whose author stopped updating it.
• Update risk. More plugins means more updates, and more chances two of them disagree at 11pm on a Friday.
• Lock-in. This is the expensive one and almost nobody prices it. Put your redirects in a plugin and your redirects belong to that plugin. Put your schema in a page builder and your rankings belong to your theme.

The lock-in problem, concretely

The clearest example we hit: a site where every redirect lived inside an SEO plugin. Switching that plugin out, for good reasons, would have silently dropped every redirect on the site. Years of accumulated link equity, sitting inside something we wanted to remove, held hostage by the install.

The same is true of your title tags, your meta descriptions, your schema, and your form submissions. If those live in something switchable, then the most valuable assets on your site are switchable too.

What we did instead

We started building a single plugin per client that owns the things a site cannot afford to lose, and a native theme with no page builder. Not because writing code is virtuous, but because the arithmetic was overwhelming: fourteen dependencies became one, page weight fell by more than half on several sites, and the number of things that could break on a Friday night went down by an order of magnitude.

The rule we ended up with is simple. If losing it would cost you rankings, leads, or money, it does not live in something you might deactivate.

How to audit your own site in twenty minutes

1. Open your plugins list and count them. Write the number down before you rationalise it.
2. For each one, answer honestly: what breaks if I delete this today? If the answer is nothing, delete it.
3. Find where your redirects live. Find where your title tags live. Find where your form submissions are stored. If any of those answers is a plugin you could imagine replacing, that is your biggest risk, not your slowest page.
4. Check the last updated date on every remaining plugin. Anything untouched for over a year is a security decision you are making by default.
5. Run your homepage through a speed test, then deactivate everything non essential and run it again. The gap is the tax you have been paying.

What we are not saying

Plugins are not bad. WordPress is the best CMS in the world precisely because of its ecosystem, and there are plugins we would not build ourselves in a hundred years. The argument is narrower than “write everything from scratch.” It is this: know what each one costs, do not let the important things live inside the optional things, and count them once a year.