Too Many WordPress Plugins? How to Decide Before You Install

Too many WordPress plugins is a common worry, but the count is the wrong thing to measure. What matters is what each plugin loads, how well it is maintained, and whether it solves a problem you have. This guide gives you a check for performance, security and maintenance that you can run before you install any plugin. It ends with a test for whether you need a kanban board plugin at all. KanbanWP, the kanban plugin this site is about, is our own product.

Too many WordPress plugins: how many is too many?

WordPress does not publish a safe number. Its optimization guide says that “the number of plugins and their performance will also have a huge impact on your site’s performance.” The sentence names two factors, count and performance. Ten small plugins that each load one file on one admin screen can cost less than one plugin that runs a heavy database query on every page view.

So the useful question is not “how many plugins should a WordPress site have?” It is “what does each plugin add to every request, and who keeps it safe?” The three sections below answer that for performance, security and maintenance.

Performance: what a plugin adds to each page

A plugin can slow a site in a few specific ways:

• Front-end assets. Scripts and stylesheets that load on every public page, even where the plugin’s feature does not appear.
• Database queries. Extra queries on each request, or one slow query on a large table.
• Autoloaded options. Settings that WordPress loads into memory on every page view. The optimization guide says that “having too many autoloaded options can slow down your site” and suggests staying under about 800 KB in total.
• Background work. Scheduled jobs and outbound HTTP requests to external services.

To find which plugin causes a slowdown, the optimization guide suggests that you “try selectively disabling plugins to measure server performance.” On a staging copy of the site, a private test copy, deactivate one plugin at a time and measure the same page each time.

Query Monitor makes this faster. It lists every database query on a page, flags slow and duplicate queries, and groups queries by the plugin or theme that ran them. You can also set SAVEQUERIES to true in wp-config.php to record each query’s time, as the debugging handbook explains. Turn it off again afterwards, because it slows the site.

WordPress plugin security: what the reports show

Plugins are where most WordPress vulnerabilities are found. Two security companies publish yearly figures from their vulnerability databases.

From Patchstack’s State of WordPress Security in 2026 report, covering 2025:

• 11,334 new vulnerabilities were found in the WordPress ecosystem, 42% more than in 2024.
• 91% were in plugins and 9% were in themes. Only 6 were in WordPress core.
• 46% had no patch available when they were disclosed.
• Heavily exploited vulnerabilities reached mass exploitation in a median of 5 hours.

From Wordfence’s 2024 Annual WordPress Security Report, published in April 2025:

• 8,223 vulnerabilities were published in its database in 2024.
• 96% affected plugins, and 5 affected WordPress core.
• About 35% of the vulnerabilities disclosed in 2024 were still unpatched in 2025.
• About 58% were in plugins and themes with fewer than 10,000 active installations.
• Over 68% were rated low risk for most sites, because they need a logged-in user or a user action to exploit.

The two companies count differently, so the totals do not match, but both found that plugins hold more than 90% of the vulnerabilities. Wordfence’s report also says that removing unused and abandoned plugins and themes “may be critically important.”

Inactive plugins count too. A deactivated plugin’s code does not run on page loads, but its files stay on the server. WordPress’s own Site Health screen warns about this. In the core source, the check reads: “Inactive plugins are tempting targets for attackers. If you are not going to use a plugin, you should consider removing it.”

Maintenance: signs a plugin is still cared for

Every plugin page on WordPress.org shows the facts you need. Look for these before you install:

• Last updated. A plugin with no release in a year or more may not get a fix when a vulnerability is found.
• Tested up to. The latest WordPress version the developer has tested. The directory shows a warning when this falls far behind the current release.
• Requires PHP. The plugin must support the PHP version your host runs.
• Active installations. Wordfence’s report says plugins with larger install counts “are more mature and will likely receive timely security updates.”
• Support forum. Check whether recent threads get answers, and whether security reports were handled.
• Uninstall behavior. Read the FAQ for what happens to the plugin’s data when you delete it.

How to audit the plugins you already have

If your site already has too many WordPress plugins, review them before you add another:

1. Open Tools > Site Health and read the plugin items in the Status tab, such as inactive plugins and plugins with updates waiting.
2. Delete every inactive plugin you do not plan to use again.
3. On the Plugins screen, write down why each active plugin is there. Mark any plugin whose job you cannot name.
4. Check each marked plugin against the maintenance signs above.
5. On a staging copy, deactivate the marked plugins one at a time, and use Query Monitor to compare the same page before and after.

Remove what no longer has a job, and replace what is no longer maintained.

A checklist before you install any plugin

Run these questions in order. Stop at the first “no”.

1. Can WordPress already do this? Core includes synced patterns (reusable blocks), scheduled posts, user roles and an export tool. A theme setting or a short code snippet may also be enough.
2. Does a plugin you already run do this? Many sites have two plugins with overlapping features.
3. Is the plugin maintained? Use the maintenance signs above.
4. What does it load, and where? Install it on a staging site first and check the public pages with Query Monitor.
5. Where does it send data? Some plugins call external services on every page view or store your data on the vendor’s servers.
6. Can you remove it cleanly? Find out whether its data stays behind, and whether you can export it first.

Once a plugin passes, put it on a list with the reason you installed it. Review the list every few months and delete anything that no longer has a reason.

Do you need a kanban plugin?

The same test applies to the kind of plugin we build. A kanban board shows work as cards in stages, such as Ideas, Drafting, In Review and Published. Our article on why kanban works covers the method itself.

You probably do not need a kanban plugin if:

• you work alone on one or two things at a time, and a plain list keeps you on track,
• nobody else needs to see your progress,
• you have not missed a deadline or lost a task because of how you track work.

A board starts to be useful when:

• several people touch the same work and handoffs get lost in chat and email,
• tasks pass through stages, such as a post that moves from idea to draft to review to published,
• you track more work than you can remember, and items drop off a flat list,
• clients or editors ask for updates, and you want them to check progress without asking you,
• you repeat the same process, such as publishing, onboarding or support.

If two or more of these apply, try the paper test below.

A ten-minute paper test

1. Write down everything you are working on now.
2. Draw three columns: Not started, In progress and Done.
3. Place each item in a column.
4. Count the items in the middle column. If it holds more than three or four, you have a work-in-progress problem, and a board makes it visible.
5. Ask whether anyone else would benefit from seeing this page.

If the exercise helped, a board is likely to help. If it felt like busywork, skip the plugin.

How KanbanWP measures up on the checklist

If you decide to try a board inside WordPress, here is how KanbanWP 1.0.1 answers the questions above:

• Cost. It is free and licensed under GPLv2 or later, with no per-user fees.
• Requirements. It needs WordPress 5.8 or later and PHP 7.4 or later, and the readme lists it as tested up to WordPress 6.8.
• Data location. Boards, tasks and comments are stored in 11 custom tables in your own WordPress database. Our guide to custom post types and custom tables lists them.
• Outbound requests. KanbanWP contacts outside services only for features you set up: AI requests sent with your own API key, Slack and Discord notifications, and outgoing webhooks, which send event data to a URL you choose.
• Removal. Deactivating or deleting the plugin keeps your data. If you tick Delete data on uninstall in the settings, deleting the plugin removes its tables and settings. The Download all data (JSON) button exports everything first. See advanced settings.

Set a time limit for the trial. Spend one afternoon on setup with a board template, put real tasks on it, and use it for two weeks. If you are not opening it without a reminder by then, delete it. The guide to your first board walks through the setup.