WordPress's thousands of plugins offer endless possibilities for extending your site, but not all of them make sense to use at Seravo. Our server architecture automatically takes care of core backend features such as server-level caching, daily backups, and server-side protection. Because of this, certain plugins are completely redundant or can even be detrimental in our environment. This guide covers which plugins to avoid, recommended best practices, and which plugins are strictly prohibited for site security reasons.
Unnecessary Plugins
Many traditional plugins run background processes that Seravo’s servers handle far more quickly and efficiently.
Caching Plugins vs. Asset Optimization
Page cache plugins are unnecessary: At Seravo, page caching is handled directly at the server level (nginx and Redis cache). This is many times faster than internal PHP-based WordPress caching. Traditional page caching plugins (such as WP Super Cache, W3 Total Cache, or LiteSpeed Cache) duplicate this effort, put unnecessary load on the PHP engine, and can even slow down your site or interfere with dynamic server functions.
Front-end and asset optimization: However, Seravo's server cache does not replace front-end code or file optimization. Resource optimization—such as image compression, WebP formats, minifying CSS/JS files, and deferring script loading (defer/async)—remains the responsibility of the site developer and depends on how the site is built.
Tip for using optimization plugins:
You are free to use plugins for code and file optimization (such as minifying or deferring CSS/JS), but always keep the plugin's own page caching feature turned off so it doesn't conflict with Seravo's server-level cache.
Backup Plugins
Seravo automatically creates a backup of your site files and database once every 24 hours, and we retain backups for 30 days. Standalone backup plugins (such as UpdraftPlus) unnecessarily consume disk space and server resources, as restores can always be performed directly from Seravo's own backups.
Heavy Security Suites
We manage key security protections directly at the server level, including automated security updates, traffic filtering with a Web Application Firewall (WAF), and regular automated scans.
If you wish to use an external security plugin (such as Wordfence), you are allowed to do so. However, please note that frequent, repetitive database scans and intensive logging from within WordPress can impact your site’s speed and performance. To get the best results, keep the plugin's scan settings as lightweight as possible.
Prohibited and Dangerous Plugins
Some plugins open wide attack vectors into the server environment, especially if admin credentials are leaked or if a vulnerability is discovered in the plugin itself.
File managers and code editors: Plugins that allow browsing, editing, or uploading server files directly through the WordPress admin dashboard are strictly prohibited.
Database management plugins: Plugins that grant direct database editing access from within the admin dashboard pose a massive security risk.
Important Note on Seravo's Security Guarantee:
If plugins providing direct file or database access are used on a site, security cannot be guaranteed and Seravo's Security Guarantee will be voided. Files should always be edited over a secure SSH or SFTP connection, and for database management, you can use the pre-installed Adminer tool or the wp db cli command line tool.
If a severe security anomaly is detected, Seravo may automatically remove confirmed malicious or dangerous plugins to ensure the integrity of the server and protect other sites.
Recommended Security Plugins
While heavy monitoring suites are unnecessary, we recommend the following lightweight measures to improve site protection:
Bot protection: We recommend using the Cloudflare Turnstile or Google reCAPTCHA plugin on forms, comments, and login pages. These effectively prevent automated bots from spamming and placing unnecessary load on the site.
Two-Factor Authentication (2FA): Setting up Two-Factor Authentication for administrative accounts is the most effective way to prevent unauthorized access if passwords ever get compromised.
Remove Inactive and Unnecessary Plugins
Over time, many sites accumulate deactivated plugins that are no longer needed. Even when a plugin is deactivated, its PHP files remain on the server and can still represent a potential security risk.
Always delete plugins completely: Simply deactivating a plugin is not enough—delete unused plugins entirely.
Tip for developers (WP-CLI): You can remove all inactive plugins at once via SSH using the following command:
wp plugin delete $(wp plugin list --fields=name --status=inactive)
You can also inspect your site's status and recommendations through the Seravo Plugin's Security view (Tools > Security).
See Also
The rule of thumb for WordPress maintenance is simple: the fewer plugins your site has, the faster it performs and the smaller its attack surface will be. By taking full advantage of Seravo's built-in server features while managing front-end asset optimization, you keep your site blazing fast, secure, and easy to maintain.