I’m new to WordPress. I recently read an article about how hackers can exploit vulnerabilities in plugins. Various sources such as Google Pagespeed has also disssuaded me from using plugins or at least keep it to the minimum. Personally, I also try to avoid plugins because I feel more in control of what happens on my site, and downloading one almost feels like ‘Great, another thing I have to learn how to use’.
I understand that ‘Plugins-recommendation’ are off-topic, but what I’m after is actually explanation to why/if some plugins are essential in WordPress.
Take these for example:
Security – A few top plugins has to do with security. But are WordPress sites vulnerable in general? Why do I need an additional plugin to avoid exploitation?
Back Up – I’m new to the blogging world, but don’t most hosts provide backup services? Or do I need special plugins for that with WordPress?
AdSense Click-Fraud Monitoring – Supposed to block click bombs to avoid banishment from Google. But I don’t understand, are a few fake clicks all people have to do to shut your revenue down unless you download a plugin?
Edit: Might be better to ask this one in Google support, ignore it if so
##Plugin Necessity##
What the necessity of plugins really boils down to is the question, “Am I satisfied that WordPress’s core functionality is all that I need?“
If all you want is a simple blog with some categories and a number of static pages you’re set. But if you want to start integrating interactive maps, calenders with events, maybe a 3rd-party REST API, force users to use strong passwords, or even turn the site into a social network then you need plugins. Grant Palin’s answer provides more insight into why one might desire plugins. Dan Gayle’s answer points out that many themes provide all sorts of plugin functionality without explicitly using WordPress plugins.
#Core Security#
The WordPress core itself is considerably secure, and the core developer community does a respectable job isolating and patching security vulnerabilities as soon as they are identified – one of the benefits of having hundreds of millions of users and an average of around 200 core contributors per release. And the risk that used to be present for the duration between the identification of a vulnerability and the release of its fix is quickly being eliminated with the addition of Automatic Core Updates.
Yes, WordPress has inherent security vulnerabilities. But so do Drupal, CakePHP, Ruby on Rails, Symfony, Zend, etc…. There is no platform or system that I would use without implementing additional security precautions in addition to those already provided by the platform. I think it simply a bad idea to rely on the CMS or framework alone for the front-line security of any website, especially any framework with notable adoption rates.
#Plugin Security#
Plugins are not definitively insecure. The problem is that plugins are not vetted to ensure that their authors followed good security practices. WordPress has set forth a number of standards that authors should follow, but many plugins are authored by novices or others who ignore the standards. But as with all code-bases in existence, the more code you add to a system, the greater the likelihood of introducing bugs and vulnerabilities. The more plugins you add to your installation, the greater the risk you tend to take. By the same means, know that WordPress themes present an equally malicious threat – particularly the slews of “free themes” available from obscure theme-sites, many of which attempt to directly exploit your site rather than innocently exposing security vulnerabilities through ignorance or accident. Only obtain themes and plugins from trusted sources and credible authors.
A rule of thumb is to not install plugins from widely unknown authors or plugins that are relatively new on the scene. If you can, take the time to establish the author’s credibility. Ideally, learn the factors that go into a well-secured plugin (numbers-used-once [a.k.a. “nonce”s] for request and URL authentication, input sanitization, output escaping, prevention of direct access to plugin files, proper access of the database through WordPress methods and functions, the absence of errors and deprecation notices when debugging is enabled [refrain from enabling it in production environments], etc.) and vet every plugin you install yourself. There is no substitute for understanding what goes into secure plugin script, nor any better defense from crappy plugins.
If the thought of insecure plugins and themes frightens you or you are not familiar with or seeking to become familiar with PHP, you may find the services of WordPress.com to be more your cup of tea as they assume responsibility for vetting plugins and themes and only allow those determined to be secure to be installed on users’ sites. You may still use a custom domain with WordPress.com if desired.
#Back it Up#
Some hosts provide such services, others don’t. Just as I don’t trust the security of any platform to stand on it’s own, I don’t trust any host to take care of my backups. Rather, I prefer to have my backups pile up in my Dropbox and synced to different servers so that I can be confident that I always have direct access to my backups with copies on several different systems. If my host goes down or is bought out by a larger company or some other hosting misfortune, my sites are a few clicks away without even the risk of having to deal with my host’s support.
#Final Notes#
You should read the codex entry on Hardening WordPress for more security advice. If you don’t think that you should need many plugins or any obscure plugins in the future, it may well be wiser to have WordPress.com or an alternate managed WordPress hosting provider such as Pagely host your blog.
Regardless of the new “Automatic Core Updates” feature of WordPress, you should still strive to manually ensure that your installation and all of your plugins and themes are up to date. Some might think it excessive, but I like to enable debugging after an update and ensure that no plugins or themes have lost compatibility (a stream of errors and deprecation notices is a strong symptom of this). If they have, I disable them until their authors update them, or make the necessary changes myself to hold me over until they release an official update. Note that you should either take your website offline or run an offline development copy of your website before you enable debugging to troubleshoot anything.
I am not sure as to the prevalence of the Ad-sense click-bombing practice, but a WordPress plugin offering to mitigate the effects of such click-bombs is offering you an additional layer of security in addition to whatever precautions Google has in place. Websites not running WordPress face the same exact threat regarding click-bombing, and either must implement protection by other means or survive without it.
Simply put – WordPress does what it does out of the box, without plugins required.
However! Different people have different ideas about what else should it do. Some of those ideas are sound. Some are completely bonkers.
Specifically on your examples:
WP (or more precisely current stable version of it for the moment) is secure, many security plugins focus on auditing (things like other plugins’ code) and proactive monitoring (nothing is really absolutely secure).
many people (me included) don’t trust third party to handle backups. There are many horror stories around how trusting hosts with backup led to rather sad results and unless you can personally monitor, access, and verify backups that host is [supposedly] taking it’s safer to treat them like they don’t exist.
WordPress is quite functional on its own. If your needs are straightforward, or you know how to add custom functionality, there’s generally no need for plugins. However, there are advantages to the plugin model, some which I’ll enumerate:
Referring to the second-to-last point, if there’s certain functionality you want to add, odds are good that it has been implemented in plugin form already. It’s not wrong to benefit from work that has already been done.
Per the final point, numerous plugins available are the result of developers’ hours and experience. Such plugins tend to be well-built and -supported, and have the reputation to go with. Look at Pippin Williamson, Scott Kingsley Clark, and Alex King, to name only a few. They not only have technical skills, they have credibility. This is a tremendous benefit of certain third-party plugins.
In the case of backups, I’d be reluctant to trust web hosts with something so important, especially if backups are kept on the same server or within the same network. A third-party plugin or DIY approach provides you more control, as well as usually storing backups in a very separate location from the website.
Security plugins are not strictly necessary, if one has the know-how to handle security arrangements themselves. Some such plugins, such as Better WP Security, simplify the handling of file permissions,
.htaccessdirectives, and the like. Others such as WordFence provide monitoring services, while Limit Login Attempts provides some protection for the site backend.If you’re worried about plugin quality, it can be a hit or miss affair. Those on the WordPress plugin repo I think undergo at least some vetting by the people behind WordPress, but quality or value is quite variable – and heavily depends on your needs and abilities. If a plugin is well-reviewed, has active support, and comes from a well-known author or team, you are likely in good hands.
Backups
Backups can be taken care of by your host, but they usually only offer an “all or nothing” approach. If you you use a plugin, you can do weekly file backups and daily DB backups, run them before you do any maintenance, or stash the backup files onto an SFTP/S3 account. Can’t do that out of the box without a plugin.
Performance
Since your concern is in performance (as evidenced by your Pagespeed reference), the only way I know of to use a third-party CDN for hosting your images is by using a plugin (unless you’re really into scripting on your server, in which case you’d probably not be asking this question here).
Long Term Maintenance
Any functionality that resides outside the scope of WP itself and modifies/changes your content (such as a shortcode) should reside in a plugin, because you almost assuredly will someday change your theme and you don’t want a bunch of broken content on your site.
User Input
User input is where a lot of security vulnerabilities come in, so if you’re accepting user data of any kind, I’d definitely consider using a reputable plugin to handle that. They’re much more likely to have been vetted by others and have been put to the test than some hand-coded forms you might want to add.
HOWEVER
Sometimes everything you need is in your theme. (ESPECIALLY if you bought it on Code Canyon/Envato, etc., since they seem to be extremely “feature” driven.)
Sometimes, it really is simply easier to make a mod to your theme than to deal with a plugin, like a good portion of the “seo” plugins.
Actually it depends on your requirement. If you want to add more functionality for your site without modifying the theme file then surely you need plugins.
They’re essential if you want to add a eCommerce system or fully customize a child theme otherwise you would need to complete a huge amount of custom coding for things like eCommerce.
Another important point is the difference between using themes which include a huge amount of theme options compared to a theme which offers a large range of theme specific plugins.
Its clearly easier to customize WordPress by installing plugins to add functionality rather than using a theme which includes a huge amount of built in options because then you need to filter the existing functions using code as opposed to installing plugins only to add the functions you need to use.
The code in plugins is also updated when new versions of WordPress are in Beta as well and if the plugins don’t get updated, you can easily delete and install a new plugin.