The must-have WordPress plugins for what actually breaks your clients’ site
Most “must-have WordPress plugins” lists are written for people building one site. Maintenance is a different job. You are not building, you are keeping fifteen or thirty sites alive while the people who own them log in and change things.
In this post I want to come at this from the other direction. Instead of a checklist, here are the ways client sites actually break, and the plugins that stop each one. That is the real must-have list for anyone doing WordPress maintenance for a living.
I built ToggleWP after one too many Friday afternoon emergencies. Every plugin below is on this list because I have watched its absence cause a problem.
A client logs in and clicks something
This is the most common emergency, and it is almost never malicious. A client opens the plugins screen, sees a name they do not recognise, and deactivates it to “tidy up.” Now your caching is off, or your security is off, or something the whole site depends on is off, and nobody tells you until it breaks.
No backup or security plugin can stop this, because the client has admin rights and good intentions. The fix is to take the option away. ToggleWP’s Plugin Control hides your essential plugins from other admin users and protects them from deactivation, so the tools you rely on cannot be switched off by accident.
It also emails you the instant any plugin is activated or deactivated on the site, so on the rare occasion something does change, you hear about it and can act before it becomes a bigger problem.
This one module prevents more support tickets than anything else I maintain.
Recently I had an activation email for a new backup plugin begin installed. I asked the client why, and they said they were following a guide on how to change permalinks for blog posts. Unknown to them, posts were used by a variety of content types and that would have messed up a whole lot of content. By quickly replying to an email to ask a question that prevented an hour or more work down the line to resolve the situation.
Media disappears across the entire site
Here is a specific version of the problem above that deserves its own warning, because it is the worst one to walk into.
If you offload a client’s media to the cloud, and you should, every image and video on that site is served from cloud storage instead of the local server. Infinite Uploads is the cleanest way to do this. It moves the media library off the server, delivering everything through a global CDN, and keeps hosting lean. For a maintenance portfolio it is one of the best decisions you can make.
But it changes the stakes of an accidental deactivation. Turn off a caching plugin and the site gets slower. Turn off the media offload plugin and every image and video URL can stop resolving at once. Not one broken image. The whole site, all at the same time. That is exactly the kind of plugin you hide and protect with ToggleWP, so the thing that makes the site fast cannot become the thing that takes it down.
The site quietly stops showing up on Google
This one does not announce itself. A site gets launched or staging updates deployed, but the “discourage search engines” box gets left ticked. Months later the client asks why they have vanished from Google. By then the damage is done, and takes a long time to recover from.
A good SEO plugin, Rank Math or Yoast, handles titles, schema, and sitemaps on every site you maintain. But it will not shout at you about the indexing setting. ToggleWP puts a warning right in the admin bar whenever search engines are being discouraged, so a single checkbox does not quietly cost your client a season of rankings.
A small guardrail, with a large consequence avoided.
Something expires that nobody was watching
Domains. SSL. Premium plugin licenses. Annual subscriptions. On one site you remember. Across thirty, something always slips, and an expired domain is the kind of outage that makes a client question whether they should be paying you at all.
ToggleWP’s reminder system tracks renewal dates across your sites and emails you before things lapse, not after. It is unglamorous and it has saved me more than once. Looking professional here is mostly about never being surprised.
On the flip side, it can also help prevent unwanted renewals. When a plugin is deactivated it will email you a reminder to check if it was a premium plugin with an annual renewal. Its much easier to cancel ahead of renewal than to request a refund, or lodge a costly chargeback to the plugin vendor for your oversight.
The backup you assumed was running, wasn’t
Every list puts backups first, and they are right to. But the failure mode is not “no backup plugin installed.” It is “a backup plugin installed that nobody checked.” A schedule that silently stopped. Backups saved to the same server as the site, which is no backup at all.
Run UpdraftPlus or Kadence Backups, which are stored offsite, on a schedule that matches how often the site changes. Then do the one thing most people skip: test a restore once, so you know it works before the night you are relying on it. A backup you have never restored is a hope, not a plan.
The slow leaks: visibility and speed
Two more that prevent problems rather than fix them.
Security is not just a firewall. It is knowing who logged into the admin, from where, and whether anything changed. Wordfence or Kadence Security cover the firewall and scanning. ToggleWP adds login monitoring with IP and country detection on top, so an unfamiliar login is something you notice early instead of discovering later. The security modules cover the rest.
Speed is the slow leak that turns into churn. A caching plugin like WP Rocket, plus media offloaded through Infinite Uploads so the server is not straining under images and video, keeps sites fast enough that clients never have a reason to complain.
The honest must-have list for maintenance
Strip it back and the must-have WordPress plugins for maintenance are the ones that match how sites actually fail. Backups you have tested. Security with real visibility. An SEO plugin with an indexing guardrail. Caching and media offload through Infinite Uploads to keep things fast and cheap. And a control layer, ToggleWP, that stops a well-meaning client from undoing any of it.
That last part is the one most lists miss. You can install every plugin perfectly and still get the Friday emergency, because the person paying you has admin rights. Take the accidental clicks off the table and most maintenance emergencies simply stop happening.
Seven ToggleWP modules are free, including login monitoring, security and authentication, and the staging and indexing warnings. You can start a free trial with no credit card, or run the free modules on every site you maintain today.
