WordPress is deliberately a compact system. It provides a great deal as standard, but more importantly it provides a framework into which plugins can be added, so that a WordPress site can do almost anything you can imagine.
The other major benefit is independence: the WordPress core and every individual plugin can be upgraded separately without affecting the rest of the system.
There are many thousands of plugins, written by an equally large number of people with a very varied level of skill. Several repositories list plugins with rankings, reviews and, most usefully, the date the plugin was last updated. Read these carefully before installing anything, and be wary of anything that has not been touched in a long time.
Keeping the list short is one of the most effective things you can do for both speed and security. A site with forty plugins is not necessarily worse than one with ten, but it very often is.
The official WordPress plugin directory holds tens of thousands of free plugins, all of which have passed a review before listing. It shows the update history, tested-up-to version, active installations and support activity for each one, which is everything you need to make a sensible judgement.
The free versions of well known plugins cover most requirements for most sites. The common categories worth having are SEO, security, backup, caching, forms and, if you are selling, e-commerce.
It is worth knowing that many free plugins are the entry point to a paid version. That is a perfectly reasonable model, but check what the free tier actually includes before building a site around it.
Paid plugins typically offer more functionality and, more importantly, a support commitment and a funded development roadmap. For anything your business genuinely depends on, that is usually worth paying for.
Most are sold as an annual licence covering updates and support. If the licence lapses the plugin normally keeps working but stops receiving updates, which for a security or e-commerce plugin is not a state to leave it in.
As with themes, do not install cracked or “nulled” premium plugins. They frequently contain injected code, and a compromised site costs far more to clean than the licence would have cost.
Plugin choice has a direct effect on how much server resource your site needs. A site running a page builder, a security plugin, a backup plugin and a shop is doing considerably more work per request than a simple blog, and no amount of caching hides all of it.
If your site has become slow and you are not sure why, tell us. We can see what is actually happening on the server, which is usually quicker than guessing by deactivating plugins one at a time.
See also our page on WordPress themes, and our WordPress hosting plans.