Which WordPress plugins does a business site need?
A typical business website in Bangkok needs plugins for seven to nine jobs: a contact form, SEO settings, caching, security, backups, image compression, spam filtering, and on Thai sites, PDPA cookie consent plus a second language. A shop adds WooCommerce and a payment gateway. That is the whole list. Everything else should earn its place.
If you are new to the platform, our plain guide to what WordPress is and how it works explains themes and plugins before you pick any. The rest of this article names one or two well-known options per job, explains the Thai-specific needs, and gives you a quick test for judging any plugin you find, so you are not relying on a listicle that someone else wrote to sell affiliate licences.
The jobs a business site needs covered
Treat this as a coverage list, not a shopping list. Some jobs can be handled by your host or your theme, in which case you need no plugin for them at all.
- FormsOne form plugin for contact and enquiry forms, with a consent checkbox.
- SEO settingsTitles, meta descriptions, XML sitemap and schema from a single plugin.
- CachingPage caching, unless your host already provides it at server level.
- SecurityLogin protection and a firewall, or equivalent protection from the host.
- BackupsScheduled off-site copies of files and database.
- ImagesCompression and modern formats such as WebP.
- SpamFiltering for forms and comments.
- PDPA consentA cookie banner that blocks trackers until the visitor agrees.
- LanguagesEnglish and Thai versions linked to each other, if you publish both.
Why fewer plugins is better
A plugin is a bundle of code that adds a feature to WordPress. Each one you install runs on your server, and many also load their own scripts and styles on every page. The cost is not the number itself. It is what the plugins do.
Speed
Many Thai visitors arrive on a phone, often on mobile data. A slider plugin that loads a large script library on every page, or a social feed that calls an outside service, adds weight that a visitor on the BTS pays for in waiting time. One heavy plugin can do more harm than ten light ones, and it is often the first suspect when we look at why a WordPress site is slow.
Security
Plugins are code written by many different developers. When a flaw is found in a popular plugin, sites that have not updated become easy targets. Every extra plugin is one more thing that must be patched promptly.
Update burden
Each plugin updates on its own schedule. Two plugins that each work fine can clash after an update, and the person who finds out is usually a customer who sees a broken checkout. Fewer plugins means fewer combinations to test, and a shorter monthly routine for whoever looks after the site.
Plugins by job: forms, SEO, speed, security and backups
These are well-known options with long track records in the official directory. Check each one's page for current details before installing; the point here is the job, not the brand.
| Job | Common options | What to watch |
|---|---|---|
| Forms | Contact Form 7, WPForms | Add a consent checkbox and send entries to email you actually read. |
| SEO settings | Yoast SEO, Rank Math | Pick one. Turn off modules you do not use. |
| Caching | LiteSpeed Cache, WP Super Cache | LiteSpeed Cache only helps fully on LiteSpeed servers. Skip it if your host caches for you. |
| Security | Wordfence, Solid Security | Firewall rules can block legitimate logins; test after setup. |
| Backups | UpdraftPlus | Store copies off the server, and test a restore once. |
| Images | Smush, EWWW Image Optimizer | Compress on upload, then bulk-compress older images. |
| Spam | Akismet, Antispam Bee | Akismet is paid for commercial sites; read its terms. |
Security and backups deserve more than a row in a table. Our WordPress security checklist and our guide to WordPress backups cover hardening and backup routines in depth; here the aim is only to make sure each job has one owner.
Plugins Thai sites need: consent, languages and payments
Three needs are specific to running a site for Thai customers, and they are where generic plugin lists fall short. Our overview of using WordPress for a business in Thailand covers hosting and Thai fonts too; here we stay with plugins.
PDPA cookie consent
Thailand's Personal Data Protection Act expects you to get consent before collecting personal data for purposes such as analytics or advertising. On a website that means a consent banner that actually holds back tracking scripts until the visitor agrees, records the choice, and lets them change it later. Complianz and CookieYes are widely used options. Whichever you choose, check that the banner text is available in Thai and that your Google Analytics or Meta Pixel tags are really blocked before consent, not just hidden behind a banner. Your forms also need a consent line linked to a privacy notice.
English and Thai content
Polylang and WPML are the two established multilingual plugins. Both let you keep a Thai page and its English twin linked, with a language switcher and the correct hreflang tags. Polylang has a free core; WPML is a paid licence. Pick one at the start: switching later means rebuilding the language links page by page. Our multilingual website development work sets this up before the first page is written.
Thai payments on WooCommerce
WooCommerce itself is free. To take payments you add a gateway plugin from a provider that serves Thailand, such as Omise (for a time branded Opn Payments) or 2C2P, which can offer cards and PromptPay QR. Use only the plugin published by the payment provider itself, and confirm current fees and supported methods on the provider's own site.
How to vet any plugin in five minutes
Open the plugin's page in the official WordPress.org directory. Everything you need for a first judgement is on that one screen.
- Last updated. A plugin that has not been updated in over a year may be abandoned. The directory also shows a warning when a plugin has not been tested with the last three major WordPress releases.
- Active installations. A large install base is not proof of quality, but it means problems get noticed and reported quickly.
- Tested up to. Compare this with the WordPress version your site runs.
- Support forum. Read the last page of threads. Are questions answered, and are bugs acknowledged, or are threads left open for months?
- Developer. Who publishes it? A company with a real website and a changelog is easier to trust than an anonymous account with one plugin.
Free versus premium
Many plugins are free with a paid "pro" tier. Premium licences are usually annual, so the price you see is a yearly cost, and updates often stop when the licence lapses. Before buying, write down every renewal date in one place. Three or four small licences add up, and an expired licence on a security or backup plugin is a risk you only notice when something goes wrong.
Plugins to skip
- A second SEO plugin. Running Yoast SEO and Rank Math together produces duplicate meta tags and two sitemaps. Keep one.
- Overlapping caching or optimisation plugins. Two tools that both minify scripts or both cache pages fight each other and cause blank pages that are hard to trace.
- All-in-one bundles. A plugin that promises forms, sliders, popups, analytics and security in one package loads code for all of it even if you use one feature.
- Abandoned plugins. If the directory shows it has not been updated for years, replace it now rather than after it breaks.
- Plugins for one small visual effect. Animated counters, a scrolling logo strip or a fancy lightbox can usually be written in a few lines of theme code.
- Nulled premium plugins. Pirated copies of paid plugins are a common way malware reaches WordPress sites. Never install them.
Fewer plugins with a custom theme
A large share of plugin bloat comes from page builders and the add-ons around them: sliders, galleries, icon packs, extra widgets. A custom theme builds those layouts into the theme itself, so the site ships only the code it uses. That is how we work as a WordPress developer in Bangkok: custom theme, no page builder, and a short plugin list that we can keep updated.
Our Business package, from THB 30,000 as an indicative one-time price, includes that custom theme along with English and Thai pages. For what drives the figure up or down, see our breakdown of what a WordPress website costs.
Planning a new site from scratch? Start with a step-by-step build guide for the overall order of work, then our walkthrough on building a WordPress website yourself, where plugins are one step among many. If you are weighing other routes, our piece on headless WordPress and when it makes sense covers a very different setup, and if your current site lives on Wix, read about moving a site from Wix to WordPress before you choose any plugins. After launch, website maintenance, priced per site on request, keeps the plugin list updated and tested for you.
Who reviewed this guide
Who builds your site
Litesh Dhir
Builds and ranks the websites: the systems behind the 17 client sites whose Search Console numbers we publish.
More about usMore on WordPress
Sources
- WordPress.org: Plugin directory
- WordPress.org: Detailed plugin guidelines
- Akismet: Pricing and plans
- Polylang on WordPress.org
- PDPC Thailand: Office of the Personal Data Protection Committee
- Omise Payments plugin on WordPress.org