Most plugin lists are written by people who install forty plugins and then wonder why the site takes four seconds to load. I’ve launched enough small stores to know that the useful list is short and ordered. Here’s the exact stack I’d put on a new WooCommerce store if the goal is to take a payment by Sunday night, plus the ones I’d deliberately leave out until there’s a reason.
Start with the host, not the plugins. If you’re on shared hosting with a $3 plan, no plugin list will save your checkout page. You don’t need a managed WooCommerce host for a store with twenty products, but you do need PHP 8.1 or newer, HTTPS, and enough memory that the admin doesn’t time out when you upload a product image. Check that before you install anything.
Plugin one is WooCommerce itself, obviously. During setup it asks about shipping and taxes; answer honestly but don’t agonize, because you’ll change both later. Skip the onboarding wizard’s marketing emails. Turn off the WooCommerce analytics if you’re not going to look at it — it adds scheduled jobs you don’t need on a small store.
Plugin two is a payment gateway. Stripe is the default recommendation for most people, and the official Stripe plugin for WooCommerce is what you want, not a third-party connector. Install it, connect it in test mode first, and run one test order with a real card number in test mode before you flip to live. This is the step people skip and then spend a weekend debugging a checkout that was never wired up.
Plugin three is a backup plugin. UpdraftPlus free is fine. Set it to back up daily to remote storage — Google Drive or Dropbox — and run one manual backup before you touch anything else. If you skip this, the first thing that goes wrong will be the thing you can’t undo.
Plugin four is a security and login plugin. Wordfence free or Solid Security free, plus limit login attempts. Not because you’re a target, but because every WordPress site gets hit by credential-stuffing bots within days of going live, and a locked-out admin is a bad way to spend a Saturday.
Plugin five is an SEO plugin, and the only real decision is Yoast or Rank Math. Pick one and stop reading comparison posts. For a small store, the free version of either is enough. The useful part isn’t the scoring meter, it’s the sitemap and the ability to set a proper title template for product pages.
Plugin six is a caching plugin. If your host has its own caching, use that and skip this. Otherwise WP Super Cache or LiteSpeed Cache, depending on your server. The setting you’ll forget: exclude cart, checkout, and my-account pages from caching. Every caching plugin has this option and every one of them defaults to something that can cache a cart page if you’re not careful.
Plugin seven is a legal/compliance plugin for cookie consent and policy pages, and this is where I’d tell you not to install a giant GDPR suite. A simple cookie banner plus WooCommerce’s built-in privacy tools covers most small stores. If you sell to the EU, read the actual requirements rather than trusting a plugin’s checklist.
Plugin eight is an email plugin — specifically, something that connects WooCommerce order emails to a real transactional sender. WooCommerce’s default emails come from your server and land in spam roughly half the time on cheap hosts. Use Post SMTP or WP Mail SMTP with a proper SMTP provider. The setting you’ll forget: set the from-address to a domain you actually own and authenticate it, or your order confirmations will go to spam and customers will email you asking if the order went through.
Plugin nine is optional but worth it: a lightweight plugin for order delivery notes or custom checkout fields, only if you actually need to collect something extra — a gift message, a business name for an invoice. Don’t install it because it looks useful. Install it because you have a specific field you keep typing into the order notes manually.
Now the ones I’d skip until later. Skip the upsell/cross-sell suites. Skip the abandoned-cart plugins until you have enough traffic that abandoned carts are a real number and not three people. Skip the page builders if you’re comfortable with the block editor — a page builder on top of WooCommerce is a second system to debug when a product layout breaks. Skip the review-import plugins; fake reviews are a liability and a bad habit.
The install order matters more than the list. Host and SSL first, then backup, then security, then WooCommerce, then payment, then email/SMTP, then caching, then SEO. If you install caching before you’ve finished configuring WooCommerce, you’ll spend an hour wondering why your settings changes aren’t showing up. They’re cached. Clear the cache, or better, do caching last.
On timing: this is a two-evening job, not a two-week one. Evening one is host, SSL, WordPress install, backup, security, and WooCommerce with three test products. Evening two is payments, SMTP, caching, SEO, and a full test purchase from a different browser where you’re not logged in. If the test purchase works and the confirmation email arrives, you’re live. Everything else is polish.