A plugin is a software component installed in another program to add features without changing that program's code. On the web, the word mostly refers to add-ons for a content management system such as WordPress, for example a contact form, a cookie notice or an SEO plugin.
A plugin adds features to a program without changing its code: how plugins work in WordPress and how they affect speed, security and SEO.
What plugin means
The word comes from the verb to plug in: a part you connect to a program and can remove again. Other languages, including Spanish and German, use the English word.
The word also had another meaning that has gone out of use. MDN describes a browser plugin as a component that handled content the browser could not display by itself, such as Adobe Flash animations. Between 2016 and 2021 browser vendors phased them out, and today no major browser supports them. They should not be confused with browser extensions, which still exist.
How it works
In WordPress, according to its developer handbook, a plugin is a package of code that extends the core functionality. It is written in PHP and can include images, CSS and JavaScript. The simplest plugin is a single PHP file with a header and a few functions attached to specific points in WordPress, called hooks.
The handbook's basic rule is not to touch WordPress core: every update overwrites its files, so any new feature belongs in a plugin. That is why a WordPress site can be updated without losing what has been added to it. The official WordPress.org directory offered more than 75,000 free plugins on 15 October 2026. Since version 5.5, released in 2020, WordPress lets site owners turn on automatic updates plugin by plugin.
WordPress: the core, and the plugins attached to its hooks.
Structure
WordPress corehooks: specific points that plugins attach to
Contact form
Cookie notice
SEO plugin
The simplest plugin: a single PHP file with a header and a few functions. It can include images, CSS and JavaScript.
On every update
Changed in coreoverwritten, the update replaces the core files
Added as a pluginstays
What each plugin adds
code the server runsoften, files the browser has to downloadupkeep: keep them updated, delete unused ones
A deactivated plugin stays on the server.
Whatever is changed in core is gone after the next update; whatever comes as a plugin stays.
Why it matters
Many SEO tasks in WordPress go through a plugin. According to their pages in the WordPress.org directory, SEO plugins such as Yoast SEO or Rank Math let you edit the title and meta description of each page and generate XML sitemaps.
Each plugin also adds code that the server runs and often files the browser has to download. The WordPress documentation says that the number of plugins and their performance have a huge impact on site speed, and that deactivating and deleting unnecessary plugins is a significant way to improve it. Plugins matter for security too: the WordPress hardening guide asks site owners to keep plugins updated, delete unused ones and install them only from the official directory or from well-known companies.
We measured this for zds.es on 15 October 2026. According to its generator meta tag, the site is built with Astro v5.18.1, and it loads no files from WordPress plugins. What a plugin would usually handle in WordPress arrives here as separate files: the cookie notice is Klaro, with two JavaScript files and two stylesheets. Its main JavaScript file is transferred compressed at 69,162 bytes; the site's own template file at 1,427.
Best practices
Install plugins only from the WordPress.org directory or from well-known companies.
Keep them updated, or turn on automatic updates where possible.
Delete unused plugins; deactivated ones stay on the server.
Measure speed before and after installing a plugin.
Use one plugin per task, for example a single SEO plugin.
Test updates on a copy of the site before applying them to the live site.
Common mistakes
Installing a plugin for every small feature without checking how much code it adds.
Editing the files of a plugin or of WordPress core, changes that are lost with the next update.
Leaving deactivated plugins on the server for years without updating them.
Running two SEO plugins at once that do the same tasks, such as the title or the sitemap.
Downloading paid plugins from unofficial websites.
Manuel Riveiro RodriguezCEO & Digital Strategist
A technical audit covers this and everything else in one pass.
What is the difference between a plugin and a theme in WordPress?
The theme decides how the site looks, and a plugin adds features. According to the WordPress handbook, new features belong in a plugin, not in core, because every update overwrites the core files.
How many plugins can I install in WordPress?
There is no maximum. The WordPress documentation says that the number of plugins and their performance have a huge impact on speed, so what matters is how much code each one adds. One heavy plugin can slow a site down more than several light ones.
Do I need an SEO plugin?
In WordPress it is the usual way to edit the title and meta description of each page and to generate the XML sitemap. Plugins such as Yoast SEO or Rank Math handle these tasks, according to their pages on WordPress.org. One is enough.
Are plugins a security risk?
They can be. The WordPress hardening guide asks site owners to keep them updated, delete unused ones and install them only from the official directory or from well-known companies. It also warns about plugins that execute code stored in the database.
What happened to browser plugins like Flash?
According to MDN, browser vendors phased out plugins between 2016 and 2021, and today no major browser supports them. What still exists are browser extensions, which work differently.
