We host more than 500 WordPress sites and in nearly twenty years now not one of them has been seriously hacked.
That’s a combo of us being really intentional about the tools we use, the settings within those tools, and keeping up to date with that tool’s operating company.
Here’s the whole list, and more importantly, why each one is on it.
We choose plugins based on 2 things:
☝️ If the tool requires a pile of add-ons and upsells just to work normally, it’s the wrong tool.
That single rule filters out most of what people ask us to install. A plugin that arrives alone and does one thing well will still be working in five years. A plugin that arrives with a marketplace attached becomes a maintenance problem you pay for twice: once in license fees, once in the hours somebody spends untangling it.
✌️The people behind it.
A plugin is a promise that someone will keep fixing it. That promise is only as good as the people making it. So before anything goes on a client site, we want to know who’s behind it, whether they answer support tickets, and what happens to them if the company sells.
The stack we install on every single site we build at ARTILLERY
Forms: Gravity Forms + Surbma
Gravity Forms has been our form tool for over a decade. It’s made by Rocketgenius, still independently owned, and their support team is full of actual ninjas. You send a hard question and you get a real answer from someone who understands WordPress. Leading brands all over the world use this tool every day.
Sometimes we add Gravity Perks by Gravity Wiz is the one exception to our add-on rule, but this exception kinda proves our point. David Smith was employee number one at Rocketgenius. He left in 2013 and started Gravity Perks by himself with nine small tools. It’s now more than thirty perks and about fifteen people serving 130,000 sites. They call themselves a support-centric software company and we’ve seen that to be true.
We’ve used many of these perks. Like Address Autocomplete to help high-traffic forms with an address field move faster. Advanced Calculations for quiz-style forms, etc.
The difference between a tool like this one vs one like Woo (mentioned further down): Gravity Perks extends a tool that already does its job, and every perk is small and optional. It’s a really clear toolbox and if you only need the screwdriver, everything else is off. Compare that to when a platform needs add-ons before it can function at all, that quickly becomes a mess.
Surbma Divi + Gravity Forms is a small free plugin that makes Gravity Forms inherit your Divi styling. One job, done well, for free, no upsell.
Security: Wordfence and Akismet
Wordfence is the only security plugin we install, alongside SiteGround Security. Wordfence has a few settings we love to handle the firewall. SiteGround loves us to have their plugin installed and it’s useful for some very standard settings in a security plugin like locking system folders, hiding the WP version, and more.
Akismet handles spam. Akismet is made by Automattic, the same company behind WooCommerce, which you’ll find further down our list of things we skip. Both things can be true. Akismet does one job cleanly and has for twenty years.
Speed: SG Optimizer, and NitroPack only when we need it
SiteGround’s SG Optimizer is our caching layer. SiteGround has been our host for years for the same reason Gravity Forms is our form tool: you can reach a human who knows the answer.
For Divi: We leave minification turned off on purpose. It breaks Divi in ways that are miserable to debug, and the speed you gain is not worth the afternoon you lose. Caching stays on. Minification stays off.
When a site genuinely needs more speed than that, we reach for NitroPack. It has worked well for us. It’s also the only speed tool we’ll add, because stacking caching plugins is one of the most reliable ways to break a WordPress site.
SEO: Yoast and Redirection
Yoast is the SEO plugin we configure on every build. It was originally created by Joost (sounds the same as “Yoast”) de Valk. But it’s now owned by Newfold Digital, which we’ll come back to. Taylorswift.com still runs it. If Yoast holds up under that kind of traffic, it will do just fine on yours.
Redirection is maintained by John Godley, one person, who has kept it updated and running perfectly for years. Every site we launch gets it, because every rebuild changes URLs and every changed URL is traffic you paid for once already.
The Divi layer
We build in Divi, so three plugins come along with it. Divi Supreme Pro for modules Divi doesn’t ship. Divi Ultimate Blog for blog layouts.
Our developer’s new favorite: Novamira
Novamira connects a WordPress site directly to Claude, which means we can hand the tedious work to AI instead of assigning a person to it for a day.
Tread lightly here if you’re not familiar with the nitty gritty of WordPress, PHP, CLI, API, and other technical acronyms.
What it’s great at: Alt text on four hundred images. Meta descriptions across an entire site. Accessibility fixes. Keyword and title cleanup. Search and replace across hundreds of pages. Full site audits. Small tweaks that used to require opening every page one at a time.
This is the work that used to eat whole afternoons and put our team to sleep. Now it takes a few minutes and the person who would have done it works on something that actually needs a human.
Legal pages: Termageddon
Termageddon generates your privacy policy, terms, and cookie notice, then keeps them updated as laws change. Most agencies copy a policy off another website and hope. That’s a real liability for the client.
It’s run by Hans Skillrud, who we had on Slow & Steady and genuinely like. He built it because privacy law keeps moving and a static PDF can’t keep up.
The situational ones
Not every site needs these, but when they do, this is what we reach for.
WP Grid Builder is maybe our favorite plugin on this entire list. If a site needs filtering, faceted search, or a directory that actually works, this is the tool. We’ve used it for missionary directories, portfolio filters, and mapped location search. It has never once let us down.
It’s built by Loïc Blascos, working from home in the south of France near Marseille. He found WordPress in 2008 while studying materials science engineering, which is about as far from web development as you can get. He’d sold plugins on CodeCanyon before and walked away from it, because he decided a marketplace full of low-quality work was the wrong home for something he wanted to be proud of. So he spent over a year building WP Grid Builder from scratch and launched it in 2019.
He gives all his time to this one plugin. He also co-organizes the WordPress meetup in Aix-en-Provence and sponsors French WordCamps. That’s a person who is going to answer your support ticket.
UserWay is suggested to sit on-top of every site where a client has purchased ADA work. It’s the accessibility layer that, again, sits on top of the structural fixes, and it is not a substitute for doing those fixes properly.
Weglot handles multilingual sites. Situational, but it’s what we use when the need comes up. Yellow light on this one. Lots of good options out there.
Stripe handles payments. If you need a full cart, we’ll point you at Shopify and connect it to your WordPress site. More on that below.
The one we keep an eye on: Sugar Calendar
We currently use Sugar Calendar for events.
It started as Pippin Williamson’s plugin at Sandhills Development. In September 2021, Awesome Motive acquired it. That’s the same pattern we watch for, so it’s on a yellow light rather than a green one.
We use it anyway right now, because the price and the feature set are genuinely good. Sugar Calendar starts around $49 a year. The alternative most people know, The Events Calendar, still offers a free core plugin, but the affordable upgrade path is gone. Their single-site license went from $149 to $199 in February 2026, and the individual add-ons are now bundled into plans starting at $259.
The pattern just seems to continue:
- Fantastic founder builds a product (Calendar for WordPress) people love
- The product is well supported, features are added, issues are fixed fast
- The product grows because it’s a great product that is supported well
- The product sells to a larger company
- Support falls off a cliff and the price goes way up
It’s a bummer but we’ll keep our eyes on it!
What we don’t install
None of these are bad software. They’re all wrong for how we build and maintain sites.
Sliders. Nobody clicks past the first slide, they slow the page down, and they break on mobile. Use one strong image and a clear headline. Plus Divi + some custom CSS has all we need.
Caching plugins beyond SG Optimizer. Two caching layers fight each other and produce bugs that take hours to trace. If a site is slow, we’d rather find the actual cause than paper over it. Please do not add additional caching plugins to an ARTILLERY hosted website 🙂
Compression plugins. Same problem, plus they can quietly wreck your images. Compress before upload instead. Please don’t install additional image compression plugins to ARTILLERY hosted websites, either!
WooCommerce. It starts simple and becomes an add-on monster. Shipping, taxes, subscriptions, payments, bookings: each one is another plugin, another license, another thing that breaks during an update. If you just need to take payments, Stripe is excellent. If you need a real cart, use Shopify.
We know that sounds strange coming from a WordPress shop. Look at how Taylor Swift does it. Her main site, taylorswift.com, runs WordPress with Yoast, same as the sites we build. Her store lives at store.taylorswift.com and runs on Shopify.
The shop is its own corner. That’s the right answer, not a compromise! Your store carries customer data, payment records, and inventory, and none of that belongs in the same database as your blog posts. Separating them is better for security and better for how the site performs.
Other page builders. We build in Divi and support it deeply. Running a second builder on the same site is a mess we won’t create.
Jetpack. Too many features bundled together, most of which you won’t use, all of which have to load.
Extra security plugins. One is protection. Two is pushing it. Three is for sure a support ticket waiting to happen.
The real test: does the support survive?
We started this by saying we look at who’s behind a plugin. It isn’t independent-good and corporate-bad. Yoast was acquired by Newfold Digital and kept shipping. Akismet is Automattic and works fine.
The thing that actually matters is whether the humans survived the sale.
The Events Calendar is the cautionary tale. It was a plugin we used to recommend without hesitation. Then ownership changed, the price climbed, the support got slower, and the affordable tier disappeared. The product just kept feeling slower, bulkier, sluggish… The people around it changed.
So the question we ask before installing anything is simple:
If this breaks at 4pm on a Friday and a client’s site is down, is there someone on the other end who cares?
That’s the whole list. Hopefully no more than around ten plugins on a standard build, a handful more when a project calls for it, and a rule about people that has kept 500 sites online and unhacked for nearly two decades.
One more thing
We’re trying to get the people who make these tools onto Slow & Steady. Hans from Termageddon has already been on. We’d love to have the rest.
If you build one of the plugins on this list, consider this an open invitation! Email us.
If you’re a business owner and your site has 30+ plugins and you have no idea what half of them do, that’s worth a conversation. Tell us about your project and we’ll take a look.
