Unnecessary, Banned and Malicious Plugins

WordPress has over 60,000 plugins, of which vast majority serve their function well. However, we have identified some plugins that we can not endorse to be used on your site hosted at Seravo. Plugins that perform poorly or that have poor code quality may cause severe issues with your site's loading speed, or be a threat to your site's security by offering an attacker a backdoor to access your data. Seravo may take action and automatically remove a plugin, if we detect any malicious activity on your site.

Seravo has invested considerable effort into page speed optimization on several levels. Additional caching may actually end up hindering the website's performance by introducing new tasks, and even interfere with the low-level optimization in our infrastructure. If you enable a caching plugin on your site, we recommend that you thoroughly test its features and its actual impact on your site's performance.

Our service is built specifically with WordPress in mind. In our environment your site doesn’t need separate security plugins. Even those plugins can contain vulnerabilities, or in the worst case, slow down your site’s performance. The WordPress core itself is secure. Problems usually stem from plugins, and it’s best to use as few as possible to minimize your site’s attack surface.

When it comes to security plugins, we recommend implementing Google reCAPTCHA or Cloudflare Turnstile with a plugin, as these can effectively protect comment sections and the login page by preventing automated bots from operating. We also recommend implementing two-factor authentication on your site.

In Seravo's WP service, daily backups are handled automatically, and backups are available for 30 days at a time. Therefore, no additional backup plugins are needed.

For security reasons, WordPress’s built-in file editor is disabled by default on Seravo. The WordPress file editor can be used to edit theme and plugin files.

When the file editor is active, it provides an easy way for a potential intruder to modify files located on the server directly through the admin panel. For this reason, plugins that grant access to the database or files are prohibited. If such plugins are in use on the site, the site’s security cannot be guaranteed, and Seravo’s Security Guarantee will not apply in such cases. Instead of plugins we recommend using the pre-installed Adminer or the wp db cli command via an SSH connection.

You can read more about how to customize your site’s theme and files in our environment in our help article.

Many websites have deactivated plugins that have not been used for a long time. These should be uninstalled completely, as all additional code and files on the server can offer a way for an attacker to find a path into your site. It's also a good practice to remove unnecessary files to save storage space. You can remove all unused plugins with the following command:

Starting with version 5.2, the WordPress core also includes its own built-in Site Health Checker tool, which recommends completely removing unused plugins and themes.