7 Free Plugins a New Blog Actually Needs, and Four It Does Not

A new blog needs four things from its software, and only four. It has to publish a post, keep spam out of the comments, survive a mistake, and be reachable by email and by search engines. Everything else is optional, which is a hard thing to remember while looking at a directory with sixty thousand plugins in it.

This piece names seven plugins that do those four jobs and four that a blog under a year old should leave alone. Every version, date and install count below was read from the plugin's own wordpress.org listing on 2026-10-16. There are no affiliate links on this page. The four in the second half are not bad plugins — the argument is about timing: each adds a decision or a cost a blog with eleven posts cannot yet pay for.

Start with spam and backups, because those are the two that hurt

Akismet Anti-spam, or Antispam Bee if you would rather not sign up

Open comments on a blog are a spam delivery mechanism with a form attached. Akismet is the default answer for a reason: version 5.7.2 was published on 2026-08-18, it runs on about five million sites, and it is tested against WordPress 7.1.3. It is for the blog that gets a handful of real comments a week and does not want to read the other four hundred.

Where it stops being enough: it needs an account, and the free tier is tied to a personal account rather than a site, so a blog you sell later needs its own key. It also filters what reaches the queue, not what reaches the database, so on a site that has already been hammered you will still be deleting rows by hand. If an account is the sticking point, Antispam Bee at version 2.11.13, updated 2026-08-23, does the same job entirely on your own server with 700,000 installs and no signup. Pick one of them, never both.

UpdraftPlus, the plugin whose value is invisible until it is everything

UpdraftPlus is version 1.26.11, updated 2026-10-16, tested against WordPress 7.1.3, and running on around four million sites with 8,676 ratings averaging 96%. It backs up files and the database to storage you own, on a schedule you set, and it restores them. It is for the blog that will eventually break something at eleven at night, which is every blog.

Where it stops being enough: a backup you have never restored is a guess. The free version restores from its own backup screen, and you should use it once, on a staging copy, before you need it on the real site. Its resumable uploads exist because big restores time out, so a 300 MB site on cheap shared hosting is at the edge of what it handles comfortably. Do not run two backup plugins; two scheduled jobs writing to the same remote storage will eventually overwrite each other.

Then close the two doors nobody locks: logins and email

Wordfence Security, for the login page that is being guessed at right now

Wordfence is version 9.0.2, published 2026-09-30, tested against WordPress 7.1.3, with around five million installs and 5,025 ratings averaging 94%. The free tier includes a firewall, a malware scan and login attempt limiting, covering the three ways a small blog actually gets taken over: a guessed password, a vulnerable plugin, and an uploaded file nobody noticed.

Where it stops being enough: the free firewall rules lag the paid ones, so a plugin vulnerability found this morning is not necessarily blocked this morning. Scanning is also CPU work on your own server, and on the cheapest shared plan a full scan can time out. If the host is that tight, Limit Login Attempts Reloaded at version 3.3.10, updated 2026-09-23, does the login half with far less overhead: 1,000,000 installs and a settings screen you can read in a minute. Choose by host, not by feature list.

WP 2FA, because a password is one secret and you want two

WP 2FA is version 4.2.1, updated 2026-10-14, tested against WordPress 7.1.3, with 100,000 installs and 183 ratings averaging 94%. It adds a second factor to the WordPress login, with per-role policies, and it is small enough to be the only plugin of its kind on the site.

Where it stops being enough: configuring it locks you out if you lose the phone and never printed the recovery codes. Set it up on your own account first, print the codes, and only then enforce it for editors. If your site is a single-author blog with a strong password and no user registration, this is the plugin on the list you can postpone longest — but it is not the one to skip forever, because a blog that grows gets a second author.

WP Mail SMTP, or your contact form lands in spam forever

WordPress sends email through PHP's mail function, which on most shared hosts means an unauthenticated message from an IP that thousands of other sites share. Gmail and Outlook treat those accordingly. WP Mail SMTP is version 4.10.2, updated 2026-10-08, tested against WordPress 7.1.3, with four million installs, and its free version connects your site to a real sending service so that password resets, comment notifications and form notifications arrive.

Where it stops being enough: it is a pipe, not a sender. You still need an account with a transactional email service, which has its own free allowance, and you still need SPF and DKIM records in your DNS. If you have never edited a DNS record, that is the afternoon this plugin costs. Do it anyway: a blog whose contact form silently drops messages is a blog nobody can reach.

Publishing and being found: three plugins that earn their place

WPForms Lite, for the contact page that is your only conversion

WPForms Lite is version 2.0.2.2, updated 2026-10-06, tested against WordPress 7.1.3, with five million installs and 14,384 ratings averaging 96%. Drag a form together, put it on a page, and notifications route through WP Mail SMTP along with everything else. It is for the blog whose contact page currently shows an email address that spammers scrape.

Where it stops being enough: the free version does not store entries, so if the notification email never arrives the message is gone. For a blog taking guest-post pitches or freelance enquiries, entry storage is the feature you will eventually pay for.

Rank Math, and the one honest reason to pick it over Yoast

Rank Math SEO is version 1.0.280, updated 2026-10-06, tested against WordPress 7.1.3, with four million installs and 7,514 ratings averaging 96%. Yoast SEO is version 28.7, updated 2026-10-13, tested against the same WordPress, on ten million sites with 27,819 ratings. Both generate a sitemap, both give you control of titles and descriptions, and both are more than a new blog uses. Install exactly one and never both, since two plugins writing the same meta tags produce whichever one wins the race and no way to tell which.

Where they stop being enough: neither writes your posts and neither fixes a title that does not match what people search for. The free tiers leave schema, redirects and internal-link reporting behind a paywall, which matters at a few hundred posts and not before. Choose on the interface you can live with: for a blog with under fifty posts, the difference between the two products is smaller than the difference between having one of them and having neither.

A page cache, if and only if your host does not already provide one

Check the host's documentation before installing anything here, because most managed WordPress hosts already cache pages at the server. If yours does not, WP Super Cache at version 3.1.4, updated 2026-09-30, tested against WordPress 7.1.3, writes a static copy of each page so that a cached request never starts PHP. LiteSpeed Cache, version 7.9.1, updated 2026-09-01, with seven million installs, is the better choice on a LiteSpeed server and the wrong one on Apache, where its most useful half is unavailable.

Where it stops being enough: a cache does not compress your images and does not speed up the first visitor. On a blog whose heaviest asset is a 3 MB photo straight from a phone, fix the images first.

Four plugins a new blog should wait on, and the reason for each

WooCommerce, until you have something to sell

WooCommerce is version 11.2.1, updated 2026-10-09, on seven million sites. It is not a plugin so much as a platform: it adds order tables, cart sessions, a checkout, product post types and its own email pipeline, and from that day forward every theme update, caching change and security scan has to account for it. A new blog does not have a cart, which makes every one of those considerations pure cost. Wait until you have a product, a price and a reason someone would buy from a blog instead of a marketplace. If you sell one ebook, a hosted checkout button is cheaper and impossible to break.

Elementor, because it replaces the editor you are still learning

Elementor is version 4.3.5, updated 2026-10-13, and is the most installed plugin in the directory at ten million sites. It also locks the layout of every page you build into its own data model. For a blog that is a strange trade: the block editor already does headings, images, columns, quotes and embeds, and a post built from blocks survives a theme change, a plugin removal and a decade of updates, while a page built in a builder survives as long as the builder does. Learn the editor that ships with WordPress first.

Jetpack, which sells you the plugins you already installed

Jetpack is version 16.3.1, updated 2026-10-12, on three million sites. Its free tier bundles security scanning, site stats, image delivery and social sharing, which overlaps with Wordfence, your analytics, your image plugin and your sharing buttons. The overlap is the point: Jetpack is a good answer for someone who wants one vendor and one dashboard, and a bad answer for someone who has already chosen the specialists. Its 2,407 ratings average 74%, the lowest of any plugin named here, which is a fair signal that a bundle this wide carries a wide range of experiences.

Google Site Kit, when a browser tab already does the job

Site Kit is version 1.189.0, updated 2026-10-05, on five million sites, and it shows Search Console and Analytics data inside wp-admin. The problem is not the plugin; it is having no data to show. A blog with under a few dozen posts and a few dozen visitors a week will open that dashboard, see flat lines, and change its titles to fix a sample size problem. Leave it off until search traffic is a number you can act on, and when it is, the same figures are in the Search Console browser tab either way.

Install order, and the two things no plugin fixes

Install in the order the pain arrives, not the order above. Spam filter first if comments are open, backup second, mail third, login protection fourth. Add SEO before your tenth post, when changing titles is still cheap. Add a cache last, after checking whether the host already caches. That is four plugins before the blog is useful, seven at most, and each maps to a job you can name. Keep a note of what you installed and when; a plugin list with dates beside it is the only way to answer which of them is now redundant.

What none of the seven fixes: hosting, and writing. A cheap host with a slow database will make every page feel slow no matter what you install, and a plugin has never published a post. If the choice on a Tuesday evening is between installing an eighth plugin and writing the next one, write the next one. The plugins become a different kind of decision when the blog has an income to protect and an audience that notices downtime: that is the point at which per-page control, support with a response time and a subscriber list you can migrate start to be worth money, and Paid plugins for a blog that has outgrown free works through which of those to buy first.