A plugin is a package of code that adds a feature to a website platform without changing the platform itself. On WordPress, plugins provide contact forms, SEO settings, online shops, booking calendars, backups, security tools and much more. Shopify calls them apps and other platforms use names such as extensions, but the idea is the same.
How a plugin works
WordPress is built with hooks: points in its code where other code is allowed to step in, add something or change the result. A plugin uses those hooks to do its job, for example adding a meta description box to the editor or sending form entries to your inbox. Installing one copies its files into wp-content/plugins; activating it tells WordPress to run them.
Free plugins come from the official WordPress directory, which holds tens of thousands of them and checks each one before listing it. Premium plugins are sold by their developers and update through a licence key. Each plugin can load its own scripts and styles on the front end, add database tables, set cookies and connect to outside services.
Why it matters
Plugins make a capable site affordable, but each one is code someone else wrote, running on your site. Out-of-date plugins are one of the most common routes into hacked WordPress sites, which is why security patches need applying promptly. Plugins also add weight: a slider, a chat widget, a social feed and a popup tool can each load scripts on every page.
For a UK business, plugins also bring legal duties. Many set cookies or send visitor data to outside companies: analytics tools, embedded maps and videos, chat widgets, reCAPTCHA, email marketing forms. Under PECR, non-essential cookies and similar storage need consent before they are set, so your cookie banner has to know about and control each of them. Under UK GDPR, a plugin that sends personal data to its developer’s servers often makes that company a processor, and sometimes a separate controller. Either way you need to know where the data goes, have the right contract in place and mention it in your privacy notice.
Common mistakes
- Installing a plugin that has not been updated in years, or that has open security warnings.
- Running two plugins for the same job, such as two SEO plugins or two caching plugins, which produces conflicting output.
- Leaving deactivated plugins installed. Their files are still on the server and can still be attacked.
- Using nulled premium plugins from unofficial sites, a common source of malware.
- Adding a plugin that sets tracking cookies on page load before the visitor has consented.
- Updating everything on the live site at once without a backup, then not knowing which update broke the layout.
How to act on it
Go through your Plugins screen and, for each one, note what it does, whether you still need it, when it was last updated and whether it sets cookies or sends data elsewhere. Delete what you do not need. For the rest, check the cookies each one sets with your browser’s developer tools on a fresh visit, and make sure your banner blocks the non-essential ones until consent is given.
Before adding a new plugin, check its update history, number of active installs and support forum, and test it on a staging copy. Auditing plugins for speed, conflicts and SEO output is a standard first step in my WordPress SEO work.