Category Archives for "Plugins"

I've been using WordPress since 2004 (less than a year after it launched). I launched my own WordPress blog and wrote my very first blog post on Jan 24, 2005.

And in all those years of working with WordPress, developing WordPress plugins, building my own WordPress websites, and helping my clients build their own websites, I've found the following to be among *the very best* and "must have" WordPress plugins I use (or have used) - and highly recommend.

I've separated them loosely into multiple categories, like Making, Managing, Marketing and Monetizing. Most of these are best-of-breed plugins. But doesn't mean you should install all of them. In fact, trying to install a plugin just-because is a sure-fire way to make sure you never launch anything :-). So don't do that. Use them IF and ONLY IF you absolutely need to implement a specific feature.

And be sure to bookmark this page, as I add and remove plugins over time as plugins evolve.
Legend: * (f) Free * (p) Paid * (fr) Freemium (Free tier, Premium extras)

Yes, they absolutely do!

WordFence is the #1 plugin I install on any new WordPress sites I create, and it's installed on every single one of my existing WordPress websites.

• A security plugin can monitor a lot of things for you as the site owner or admin:
• Monitoring successful logins,
• Login attempts
• Throttling login attempts,
• Preventing PHP execution in the uploads folder
• Firewall to detect malicious traffic and "protects against a number of common web-based attacks as well as a large amount of attacks specifically targeted at WordPress and WordPress themes and plugins" - especially useful because it's learning in real-time from 100s of thousands of websites around the world
• Protect against SQL Injection, Malicious File Upload, Cross Site Scripting (XSS), Directory Traversal, Local File Inclusion, etc
• Malware scanner to scan files on your website to make sure neither WordPress or other files have been compromised (" checks core files, themes and plugins for malware, bad URLs, backdoors, SEO spam, malicious redirects and code injections")
• IP banning (both manual as well as database-learned)
• Hiding WordPress version (which can be used by hackers to target vulnerabilities in older versions)
• Brute-force protection
• Locking out invalid username login attempts
• Banning certain usernames
• Enforce strong passwords
• Preventing users from using usernames like "admin" when registering
• Prevent discovery of usernames
• Block IPs who send POST requests with blank User-Agent and Referer
• Blocking fake Google crawlers trying to spoof Google user-agent
• Country-based blocking

The list goes on.

You can no longer afford to run a WordPress website without WordFence installed. That’s just... begging to get hacked 🙂