Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm new to WordPress. I recently read an article about how hackers can exploit vulnerabilities in plugins. Various sources such as Google Pagespeed has also disssuaded me from using plugins or at least keep it to the minimum. Personally, I also try to avoid plugins because I feel more in control of what happens on my site, and downloading one almost feels like 'Great, another thing I have to learn how to use'.

I understand that 'Plugins-recommendation' are off-topic, but what I'm after is actually explanation to why/if some plugins are essential in WordPress.

Take these for example:

Security - A few top plugins has to do with security. But are WordPress sites vulnerable in general? Why do I need an additional plugin to avoid exploitation?

Back Up - I'm new to the blogging world, but don't most hosts provide backup services? Or do I need special plugins for that with WordPress?

AdSense Click-Fraud Monitoring - Supposed to block click bombs to avoid banishment from Google. But I don't understand, are a few fake clicks all people have to do to shut your revenue down unless you download a plugin?

Edit: Might be better to ask this one in Google support, ignore it if so

share|improve this question
2  
Welcome to WPSE! If you haven't already, you might want to have a read through the site's tour. If you have a peek at the Help Center, you'll find a section on What topics can I ask about? I would say that your question deals with WP management best practices, and thus is a good question. –  Pat J Dec 31 '13 at 4:09
1  
This is a good question. In my experience, the first thing I do when taking over someone's site as webmaster is to audit their plugins and remove everything that isn't 100% essential. Nine times out of ten, no one notices a difference, except the site runs faster and there are less bugs. –  Dan Gayle Jan 1 at 1:18

6 Answers 6

up vote 23 down vote accepted

Plugin Necessity

What the necessity of plugins really boils down to is the question, "Am I satisfied that WordPress's core functionality is all that I need?"

If all you want is a simple blog with some categories and a number of static pages you're set. But if you want to start integrating interactive maps, calenders with events, maybe a 3rd-party REST API, force users to use strong passwords, or even turn the site into a social network then you need plugins. Grant Palin's answer provides more insight into why one might desire plugins. Dan Gayle's answer points out that many themes provide all sorts of plugin functionality without explicitly using WordPress plugins.



Core Security

The WordPress core itself is considerably secure, and the core developer community does a respectable job isolating and patching security vulnerabilities as soon as they are identified - one of the benefits of having hundreds of millions of users and an average of around 200 core contributors per release. And the risk that used to be present for the duration between the identification of a vulnerability and the release of its fix is quickly being eliminated with the addition of Automatic Core Updates.

Excerpt from a Pagely WordPress security infographic. Click to view it in its entirety.

WordPress security infographic from Pagely (Fair amount of solid info - click through to view it in its entirety)

Yes, WordPress has inherent security vulnerabilities. But so do Drupal, CakePHP, Ruby on Rails, Symfony, Zend, etc.... There is no platform or system that I would use without implementing additional security precautions in addition to those already provided by the platform. I think it simply a bad idea to rely on the CMS or framework alone for the front-line security of any website, especially any framework with notable adoption rates.



Plugin Security

Plugins are not definitively insecure. The problem is that plugins are not vetted to ensure that their authors followed good security practices. WordPress has set forth a number of standards that authors should follow, but many plugins are authored by novices or others who ignore the standards. But as with all code-bases in existence, the more code you add to a system, the greater the likelihood of introducing bugs and vulnerabilities. The more plugins you add to your installation, the greater the risk you tend to take. By the same means, know that WordPress themes present an equally malicious threat - particularly the slews of "free themes" available from obscure theme-sites, many of which attempt to directly exploit your site rather than innocently exposing security vulnerabilities through ignorance or accident. Only obtain themes and plugins from trusted sources and credible authors.

A rule of thumb is to not install plugins from widely unknown authors or plugins that are relatively new on the scene. If you can, take the time to establish the author's credibility. Ideally, learn the factors that go into a well-secured plugin (numbers-used-once [a.k.a. "nonce"s] for request and URL authentication, input sanitization, output escaping, prevention of direct access to plugin files, proper access of the database through WordPress methods and functions, the absence of errors and deprecation notices when debugging is enabled [refrain from enabling it in production environments], etc.) and vet every plugin you install yourself. There is no substitute for understanding what goes into secure plugin script, nor any better defense from crappy plugins.

If the thought of insecure plugins and themes frightens you or you are not familiar with or seeking to become familiar with PHP, you may find the services of WordPress.com to be more your cup of tea as they assume responsibility for vetting plugins and themes and only allow those determined to be secure to be installed on users' sites. You may still use a custom domain with WordPress.com if desired.



Back it Up

Some hosts provide such services, others don't. Just as I don't trust the security of any platform to stand on it's own, I don't trust any host to take care of my backups. Rather, I prefer to have my backups pile up in my Dropbox and synced to different servers so that I can be confident that I always have direct access to my backups with copies on several different systems. If my host goes down or is bought out by a larger company or some other hosting misfortune, my sites are a few clicks away without even the risk of having to deal with my host's support.



Final Notes

You should read the codex entry on Hardening WordPress for more security advice. If you don't think that you should need many plugins or any obscure plugins in the future, it may well be wiser to have WordPress.com or an alternate managed WordPress hosting provider such as Pagely host your blog.

Regardless of the new "Automatic Core Updates" feature of WordPress, you should still strive to manually ensure that your installation and all of your plugins and themes are up to date. Some might think it excessive, but I like to enable debugging after an update and ensure that no plugins or themes have lost compatibility (a stream of errors and deprecation notices is a strong symptom of this). If they have, I disable them until their authors update them, or make the necessary changes myself to hold me over until they release an official update. Note that you should either take your website offline or run an offline development copy of your website before you enable debugging to troubleshoot anything.

I am not sure as to the prevalence of the Ad-sense click-bombing practice, but a WordPress plugin offering to mitigate the effects of such click-bombs is offering you an additional layer of security in addition to whatever precautions Google has in place. Websites not running WordPress face the same exact threat regarding click-bombing, and either must implement protection by other means or survive without it.


Additional Resources

share|improve this answer
    
great, detailed answer! –  Will the Web Mechanic Dec 31 '13 at 3:26
2  
YouTube videos don't need a plugin. They're embeddable in the default WP install. Have been for a long time. –  Dan Gayle Jan 1 at 0:52
    
Good catch, Dan! I edited my answer to account for this. I've also gone back and re-formatted my response for readability and added an ungodly number of linked resources to provide more detailed information. –  boscho Jan 1 at 1:47
    
I had thought that there was once a Codex page entirely devoted to plugin security best practices but I cannot seem to locate it now. There really should be... –  boscho Jan 1 at 1:48
1  
bosco: Making me jealous of the images. I might go back and create an infographic myself :p –  Dan Gayle Jan 1 at 1:51

Simply put - WordPress does what it does out of the box, without plugins required.

However! Different people have different ideas about what else should it do. Some of those ideas are sound. Some are completely bonkers.

Specifically on your examples:

  • WP (or more precisely current stable version of it for the moment) is secure, many security plugins focus on auditing (things like other plugins' code) and proactive monitoring (nothing is really absolutely secure).

  • many people (me included) don't trust third party to handle backups. There are many horror stories around how trusting hosts with backup led to rather sad results and unless you can personally monitor, access, and verify backups that host is [supposedly] taking it's safer to treat them like they don't exist.

share|improve this answer
    
Here's proof about what can happen to backups your host makes or doesn't make smh.com.au/technology/security/… –  Brad Dalton Jan 3 at 15:06

WordPress is quite functional on its own. If your needs are straightforward, or you know how to add custom functionality, there's generally no need for plugins. However, there are advantages to the plugin model, some which I'll enumerate:

  • modular, plug and play (mostly) functionality
  • encapsulate specialized functionality
  • avoid reinventing the wheel
  • benefit from experienced plugin authors' work

Referring to the second-to-last point, if there's certain functionality you want to add, odds are good that it has been implemented in plugin form already. It's not wrong to benefit from work that has already been done.

Per the final point, numerous plugins available are the result of developers' hours and experience. Such plugins tend to be well-built and -supported, and have the reputation to go with. Look at Pippin Williamson, Scott Kingsley Clark, and Alex King, to name only a few. They not only have technical skills, they have credibility. This is a tremendous benefit of certain third-party plugins.

In the case of backups, I'd be reluctant to trust web hosts with something so important, especially if backups are kept on the same server or within the same network. A third-party plugin or DIY approach provides you more control, as well as usually storing backups in a very separate location from the website.

Security plugins are not strictly necessary, if one has the know-how to handle security arrangements themselves. Some such plugins, such as Better WP Security, simplify the handling of file permissions, .htaccess directives, and the like. Others such as WordFence provide monitoring services, while Limit Login Attempts provides some protection for the site backend.

If you're worried about plugin quality, it can be a hit or miss affair. Those on the WordPress plugin repo I think undergo at least some vetting by the people behind WordPress, but quality or value is quite variable - and heavily depends on your needs and abilities. If a plugin is well-reviewed, has active support, and comes from a well-known author or team, you are likely in good hands.

share|improve this answer

Backups

Backups can be taken care of by your host, but they usually only offer an "all or nothing" approach. If you you use a plugin, you can do weekly file backups and daily DB backups, run them before you do any maintenance, or stash the backup files onto an SFTP/S3 account. Can't do that out of the box without a plugin.

Performance

Since your concern is in performance (as evidenced by your Pagespeed reference), the only way I know of to use a third-party CDN for hosting your images is by using a plugin (unless you're really into scripting on your server, in which case you'd probably not be asking this question here).

Long Term Maintenance

Any functionality that resides outside the scope of WP itself and modifies/changes your content (such as a shortcode) should reside in a plugin, because you almost assuredly will someday change your theme and you don't want a bunch of broken content on your site.

User Input

User input is where a lot of security vulnerabilities come in, so if you're accepting user data of any kind, I'd definitely consider using a reputable plugin to handle that. They're much more likely to have been vetted by others and have been put to the test than some hand-coded forms you might want to add.


HOWEVER

Sometimes everything you need is in your theme. (ESPECIALLY if you bought it on Code Canyon/Envato, etc., since they seem to be extremely "feature" driven.)

Sometimes, it really is simply easier to make a mod to your theme than to deal with a plugin, like a good portion of the "seo" plugins.

share|improve this answer
    
I am a large fan of the Envato marketplaces for resources; all of the plugins and themes I have purchased from Code Canyon and Theme Forest (admittedly fewer than 30 combined) have been of excellent quality and demonstrate good practices. The authors tend to be responsive, as well (though I'm definitely not trying to vouch for all of Envato, lol. I assume there are bad seeds as well!). –  boscho Jan 1 at 2:08
    
Spot on examples of utterly desirable functionality that can only be obtained via plugins; these are definitely some of the main facets! –  boscho Jan 1 at 2:11
1  
I'm not saying they're not professionally done, some are quite excellent. I'm saying that there's an arms race going on over there for the most "features" added, and I've purposely avoided buying a theme I wanted because it simply had too much conflicting functionality with the site I was running. I wish some of them simply had the base templates and stylesheets, without the extra stuff. –  Dan Gayle Jan 1 at 2:11
    
Fair point. They do tend to be bloated with "features" that serve no more purpose than a peacock's tail-feathers. I have certainly opted to convert HTML templates myself rather than purchase the bloated WP counterpart in a number of instances. –  boscho Jan 1 at 2:14

Actually it depends on your requirement. If you want to add more functionality for your site without modifying the theme file then surely you need plugins.

share|improve this answer
    
You can add theme functions in your child themes functions file without plugins. –  Brad Dalton Jan 3 at 15:51
    
Yes, child theme can be a solution but it will be complex solution when you have option to solve your problem in a quick and effective way without modifying you theme file. –  WpMania.Net Mar 3 at 9:53

They're essential if you want to add a eCommerce system or fully customize a child theme otherwise you would need to complete a huge amount of custom coding for things like eCommerce.

Another important point is the difference between using themes which include a huge amount of theme options compared to a theme which offers a large range of theme specific plugins.

Its clearly easier to customize WordPress by installing plugins to add functionality rather than using a theme which includes a huge amount of built in options because then you need to filter the existing functions using code as opposed to installing plugins only to add the functions you need to use.

The code in plugins is also updated when new versions of WordPress are in Beta as well and if the plugins don't get updated, you can easily delete and install a new plugin.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.