Installing a plugin means deciding to run someone else’s code inside your site, with the same privileges you have. Most plugins are maintained conscientiously — that ecosystem is precisely why WordPress is powerful — but it does make what you let in a real decision. Helpfully, everything you need is already on the install screen.
Three numbers
A plugin listing shows three things: when it was last updated, how many active installs it has, and whether it has been tested with your WordPress version.
Last updated is the strongest signal. Core and PHP keep moving, and code that does not follow eventually breaks. More importantly, as the previous part showed, it means there is nobody left to fix a problem when one is found.
Active installs is not a popularity contest; it is the size of the test population. Widely used plugins have their problems surfaced and fixed quickly. But a high install count alongside a stale update date means a great many sites are exposed together, so always read the two numbers as a pair.
A vulnerability history is not a black mark
Here is a misconception worth clearing up. A plugin that has had vulnerabilities reported is not automatically a bad plugin. Widely used software gets reviewed, and review finds things. What matters is not whether issues exist but what happened next.
Never run two plugins that do the same job
This check is the one most often skipped. Two plugins doing the same work override each other and produce problems nobody can trace. SEO plugins and security plugins are the usual offenders: duplicated signals sent to search engines, or two firewalls blocking each other’s traffic.
Before adding anything, ask whether the capability already exists. Surprisingly often it is already in your theme, or in core.
Applying the same test to what you already have
Run these criteria across your current list. Start by deleting deactivated plugins — the files remain on the server whether or not they are active, so remove them properly. Then pick out the stale ones and look for maintained alternatives. Finally, resolve any overlapping pairs.
If you would like to inspect your current setup yourself, there is a site diagnostic plugin among our free tools, and the selection criteria are covered further in the themes and plugins archive.
Next part
That closes the “fewer incidents” half of the series. From here it is about losing nothing when one happens — starting with backups, or more precisely, backups you have actually restored.