Free tools
Score your site out of 1000
It checks five areas — response time, database queries, SEO, WordPress vulnerabilities and server configuration — and produces a report scored out of 1000. Anything it could not measure is marked "not verifiable" and dropped from the denominator, so the score never flatters the site.
Tools that give you time back on the admin screens you use every day.
Folds the admin sidebar — which grows with every plugin — into four groups: content, commerce, design and plugins. Nothing disappears; folded items move under a group, and one toggle brings the original menu straight back.
Edit post content visually. Building the whole site chrome with it — header, footer, static pages — makes migration and version control much harder, so we suggest keeping it to post bodies.
Clones a post or page and opens it as a draft. For something already published, "Rewrite & Republish" keeps the original in front of visitors while you work on the copy, then swaps it in at once — no more half-finished edits going live because you opened the published post directly.
Keeps the information that repeats on every post — price, specification, owner — in its own fields instead of buried in the body. The free version has no Repeater or Options Page, but solving repetition with a custom post type is better for ordering, querying and automation anyway. This site runs the free version only.
Replaces an uploaded file with a new one while keeping the same URL. When a logo or product photo is used across many posts, the re-upload-and-relink chore disappears entirely.
Not a plugin but a command-line tool. Updates, search-replace, backups and cache operations all run without a browser — if you have server access, this is the first thing worth learning.
Run exactly one SEO plugin. Two at once emit duplicate canonicals, schema and sitemaps, which damages indexing rather than helping it.
Covers metadata, structured data, sitemaps and redirects generously within its free tier. This site runs Rank Math too — we do not recommend what we do not use.
A free Google service rather than a plugin. It reports indexing status, the queries bringing you traffic and mobile usability problems — which is where SEO work is ultimately confirmed.
Tools for measuring and growing traffic. Analytics scripts cost you performance, so run only the ones you actually need.
Brings Search Console, Analytics and PageSpeed Insights into one admin screen, and prevents the classic accident of double-installing tags while wiring each service up separately.
A lighter alternative when Rank Math feels heavy: no ads, no upsells, simple settings. The one-SEO-plugin rule still applies.
How you translate decides whether you are found. A widget that translates inside the visitor's browser is a convenience only — to a search engine the page is still one Korean document. If you want traffic from searches in another language, each language needs its own address.
Serves translations on per-language URLs and adds hreflang for you. It is the fastest route in, but pricing is a subscription based on translated word count: past the free tier there is a monthly bill, and the tier rises as your page count does. Check that before you commit.
Creates a separate post and URL per language and attaches hreflang. You have to supply the translations yourself, but only pages built this way are recognised by search engines as pages in that language — the most dependable route to multilingual SEO without a subscription.
Drops the Google translate widget onto your site. Simple to install with no limit on languages, but the translation happens inside the visitor's browser and is never indexed — use it for accessibility, not for SEO. This site does the same for languages beyond Korean and English, and says so on screen.
Install only one all-in-one security plugin. Overlapping firewall layers block each other's requests and make the cause impossible to trace.
Before deciding what to install, find out what is actually missing. It lists known vulnerabilities in core, plugins and themes alongside server configuration problems.
Firewall, malware scanning and login protection in the free tier. The free version receives vulnerability data 30 days late, so it is not a reason to postpone core and plugin updates.
Two-factor authentication maintained by the WordPress core team. A stolen administrator account is the most common breach path, and this alone closes most of it.
Caps login attempts to slow brute-force attacks. Blocking at the server (nginx limit_req) is better where you can, but this is the practical second choice when you cannot.
Allows SVG uploads while stripping the scripts inside the file. SVG is a format that can carry code, so opening uploads without sanitising lets a script run inside your admin screens. If you want an SVG logo, add this step with it.
Give each cache layer exactly one job. Stacking page-cache plugins throws invalidation out of step, and someone ends up staring at a stale page.
Caches repeated query results in Redis, noticeably improving the admin screens and the experience for logged-in users. It needs Redis on the server — and it is the very plugin we configure during our own engagements.
Shows slow queries, hooks and HTTP requests right on the page. It adds overhead to every query, so keep it to development and staging and switch it off in production.
Converts uploaded images to WebP and AVIF, cutting transfer size sharply. It works through GD or Imagick, so it still runs on a hardened server where shell execution is disabled; on nginx the rule that serves the converted file has to be added to the server config by hand — which we do as part of our own work.
A bundle of modules from the WordPress core performance team, letting you try improvements — image formats, database checks — before they land in core.
Judge a backup by whether you have restored it, not by whether you made it. A backup never restored is the same as no backup.
Backs files and the database up to remote storage on a schedule. Scheduled backups and restores work in the free version — the point is not to leave the copy on the same server.
Packages a whole site and moves it to another server. Good for migrations and staging clones; on large sites it is resource-hungry, so run it during quiet hours.
Replaces URLs during a database export without breaking serialized data — which is what saves you from the widgets and options that hand-edited SQL quietly destroys.
A great deal of mail sent through PHP mail() lands in spam. Sort out the sending path before you build the form.
Sends WordPress mail over SMTP so it actually arrives. Most "the order confirmation never came" and "the reset email is missing" complaints end here.
The most widely used free form plugin. Spam handling is separate, so set up reCAPTCHA or Akismet alongside it.
Build forms by dragging, including conditional fields and multi-step forms, all within the free tier. Payments and third-party integrations are paid add-ons, so check that what you need is in the free version before you start.
Filters comment and form spam. Free for personal and non-commercial sites, and it prevents the common problem of spam comments bloating the database.
A table posted as an image, or hand-written in HTML, breaks on narrow screens and never appears in search. Build tables as tables — sorting, search and responsive behaviour come with them.
The most widely used free table plugin. Build the table in the admin, drop it in with a shortcode, and get CSV and Excel import plus sorting and search in the free version. If you need one table, start here.
Strong on responsive behaviour: you decide per table which columns to hide and which to keep on a narrow screen, which is what stops tables from being unreadable on a phone.
Handles tables of thousands of rows, or tables fed from a database or spreadsheet. The scope brings heavy scripts and a good deal of it sits behind the paid version, so it is overkill for a single simple table — load it only on the pages that need it.
Tools for narrowing down a cause when something breaks. Most stay switched off until you need them.
Lets you browse the site with plugins and themes disabled for you alone, so you can find a conflict without affecting visitors. It extends the core Site Health screen.
Lists scheduled WP-Cron events and lets you run or delete them by hand — the quickest way to find out why a scheduled post or backup is not running.
Switch to another user without their password and see exactly what they see. Useful for reproducing permission problems, and every switch is logged.