Every plugin list you find online is either fifteen items long or written by someone who hasn’t built a store in three years. Here’s the list we actually install when a client needs to be selling by Sunday. Nine plugins. Two of them you probably already have. The rest take about forty minutes total.
Start with WooCommerce itself. It’s the store engine and there’s no way around it if you’re on WordPress. Install it, run the setup wizard, and then close the wizard’s upsells because you don’t need WooCommerce Shipping or any of the hosted extras for a digital store. The wizard will try to sell you three things. Decline all three.
For payments, Stripe for WooCommerce is the shortest path. It handles cards, Apple Pay, and Google Pay in one plugin, and the connection flow is a single OAuth click. If you’re in a country where Stripe isn’t available, use the official PayPal Payments plugin instead. Don’t install both on day one. Pick one, get a test transaction through, and add the second later if you actually need it.
For digital delivery, use WooCommerce’s built-in downloadable product type before you reach for anything fancier. It handles expiring download links, download limits, and file-level permissions out of the box. The fancy delivery plugins add license key management and versioned releases, which you don’t need until you’re shipping updates to customers. Put that off.
For email, you need one transactional plugin so order receipts actually arrive. WP Mail SMTP with a free Brevo or Postmark account is the least painful setup. WordPress’s default mail function gets flagged as spam by half the inboxes on the internet, and you’ll spend Sunday wondering why nobody’s getting receipts. Fix it before you take a single order.
For caching, use one plugin only. WP Super Cache or LiteSpeed Cache depending on your host. Not both. We’ve seen stores with two caching plugins fighting each other and serving stale cart pages, which is a support ticket you don’t want. Pick one, enable page caching, and exclude the cart and checkout pages in the settings.
For backups, UpdraftPlus free. Schedule a daily database backup to Google Drive and a weekly full backup. This is the plugin you’ll never notice until the day you need it, and then it’s the most important plugin on the site. Set it up before you install anything else so you don’t forget.
For security, Wordfence free. It’s heavier than some alternatives but it does login throttling, which matters because every WordPress site gets brute-force attempts within a week of going live. Turn on two-factor for your admin account while you’re in there.
For SEO and product schema, Rank Math free is the fastest to configure for a store. It generates product structured data automatically, which is what makes your listings show up with prices in search results. Yoast works too, but the free version makes you configure more by hand.
The two plugins you probably already have are Akismet, if you’re running comments, and a cookie consent plugin if you’re selling to the EU. Keep them. The four plugins we regularly see installed and should not be: a page builder you’re not using, a slider plugin, a related-posts plugin, and any “all-in-one” security suite that duplicates Wordfence. Deactivate them before you take an order. They add weight and nothing else.
That’s the list. WooCommerce, Stripe or PayPal Payments, WP Mail SMTP, one cache plugin, UpdraftPlus, Wordfence, Rank Math, plus the two you already have. Install them in that order, run a test transaction with a real card and refund it, and you’re live. The whole install is under an hour if you don’t get distracted by the plugin repository’s recommendations, which you should ignore entirely.