Every plugin list for WordPress stores I’ve read has the same problem: it recommends twenty plugins, and you install all of them, and then nothing works and you don’t know which one broke it. So here’s the opposite approach. Six plugins. That’s the whole store. You can add more later when you have a specific problem to solve.
The core choice is your commerce engine. WooCommerce is the default answer and it’s still the right one for most people, because every payment gateway, every shipping calculator, and every tutorial on the internet assumes it. The tradeoff is weight — WooCommerce adds tables to your database and scripts to every page unless you tell it not to. If you’re selling three digital products to fifty customers, honestly, you could skip it and use a hosted checkout button. But the moment you want a customer account area, coupons, or a second product type, you’ll want Woo. Start there.
Plugin two is a caching layer. Not a caching plugin in the abstract — a specific one, configured specifically. For most shared hosts, that means something like WP Super Cache or LiteSpeed Cache if your host runs LiteSpeed. The setting you’ll forget: exclude cart, checkout, and my-account pages from caching. Every caching plugin has a field for this and every one of them calls it something different. If you don’t do it, a customer will add something to their cart, navigate away, come back, and find an empty cart. That bug report is miserable to diagnose because it only shows up intermittently.
Plugin three handles backups. Not because backups are a store feature, but because you will break something in week one and you want a restore point. UpdraftPlus free tier is fine. Set it to daily database backups and weekly full backups, and store them somewhere off your hosting account. A backup that lives on the same server as the thing it’s backing up is not a backup.
Plugin four is your SEO layer. Rank Math or Yoast, doesn’t matter much. What matters is that you configure it once and then forget it. The only settings that genuinely affect a new store are the title templates and the sitemap. Skip the keyword analysis features entirely; they’re a distraction when you have twelve pages of content.
Plugin five is a form or email capture tool. Even if you’re only selling products, you want a way to collect emails from people who aren’t ready to buy. A simple newsletter plugin that syncs to your email provider is enough. The mistake here is treating this as optional. Your first hundred visitors will mostly not buy. If you can’t reach them again, you paid for that traffic and got nothing.
Plugin six is a security and login-hardening plugin. Wordfence or Solid Security, free tier. The reason isn’t sophisticated attacks — it’s that WordPress stores get brute-forced constantly by bots trying admin/password combinations. Rate limiting and two-factor auth on the admin account closes that door. Do it on day one, not after you notice something weird.
Now the skip list. Skip page builders until you have a layout problem you can’t solve with the block editor and twenty lines of CSS. Skip membership plugins until you’re actually gating content. Skip affiliate management, skip multi-currency, skip abandoned cart recovery. Each of those solves a real problem for a business that has that problem, and adds configuration surface area for a business that doesn’t.
The test for adding a seventh plugin is simple: name the specific customer-facing problem it solves. If you can’t name one, you’re shopping, not building.