Must-Have WordPress Blog Plugins

Subtitle: Why Should You Pay for Experience?

It’s only now that I’ve managed to build this blog into something I’m happy with (though it’s not quite perfect yet). Looking back at the timeline, starting from February 1, 2022, I fell victim to a backdoor attack. Because I ignored the security warnings, by February 5 I had to abandon the subdomain—originally built with open-source community software, but the system files were corrupted. I don’t know how to code or fix such issues, so after reinstalling, even reading the old database pulled only new data; it seems all previously generated content had been completely destroyed, leaving no choice but to delete everything permanently. On the 6th, I started looking for solutions. By the 8th, I’d installed a security plugin to block attacking IPs. On the 10th and 16th, plugin conflicts and theme skin errors caused site breakage and downtime, requiring several more reinstalls. It wasn’t until today—the 19th—that things finally stabilized (though I still have no idea whether hidden trojans or backdoor scripts remain).

At a manual labor rate of 15 RMB per hour, investing roughly three hours a day over 19 days adds up to nearly 900 RMB in labor costs. During that time, I also consulted fellow bloggers twice and bought them four coffees, bringing the actual total close to 1,000 RMB.

Had I relied on my experience today, resolving these issues by reinstalling and configuring plugins would have taken only about one hour. That’s the value of experience. I touched on this perspective before, though not framed around experience itself: Why Are Young People Growing Increasingly Pessimistic? (A Conspiracy Theory) [123456]. Today’s barriers to upward mobility, combined with short investment cycles and diminishing returns, exist precisely because experience has closed off arbitrage (bargain-hunting) opportunities. Without seasoned advisors backing you, your personal development pace will inevitably lag behind others’.

So yes, experience is absolutely worth paying for.

What Essential Plugins Do You Need to Build a WordPress Blog?

I’ve already listed them on the About page, but there are a few operational notes to keep in mind here.

First Key Point:

There’s no need to spend money on premium WordPress themes. I’ve tried both paid and open-source options, but ultimately chose free themes from the WordPress plugin directory. Despite what some say about foreign themes causing slow load times due to external resource calls, my site has never experienced delays or accessibility issues. So for most users, simply picking a satisfactory free theme from the WordPress admin dashboard will suffice—you just need to invest a little time choosing.

Then Comes the Plugins:

Bulk Convert Post Format: Batch-change content publishing formats; delete after migration is complete

You generally won’t need this plugin—install it only when necessary and remove it afterward. I used it to set the default post type to “Status,” because the previous theme allowed status posts to display full text directly (like Weibo), with clickable links embedded in the content. The current theme doesn’t support that; you’d have to click through to read the original post.

In short, this plugin is typically tied to specific theme functionality.

Auto-hyperlink URLs: Automatically convert plain URLs into clickable hyperlinks

I’ve always been lazy, and that tendency may continue. Instead of writing full posts with “read more” links, I sometimes just paste a raw URL. But WordPress treats bare URLs as plain text without clickability. This plugin automatically converts pasted links into functional hyperlinks. Most users won’t need it.

Simple User Avatar: Allow users to upload local images as avatars

If your theme supports displaying user avatars but relies on remote image hosting, you’ll face two problems: foreign servers are often blocked in China, and loading external resources slows down your site. Instead, use this alternative:

WP-China-Yes: Localizes WordPress for Chinese users—avatars load directly without fetching foreign resources

This plugin adapts WordPress for domestic use, calling Chinese avatar services instead. It doesn’t noticeably impact load speed and helps support local open-source initiatives.

Disable Comments: Turn off site-wide commenting

Given China’s regulatory environment and because this is intended as a long-term primary blog, combined with the requirement to complete public security filings, disabling comments via this plugin is necessary.

Wordfence Security: Essentially a WordPress security app; the free tier detects unauthorized file changes and blocks attacking IPs

After experiencing backdoors and trojans, I used this plugin to identify which program files had been modified, review the altered code, manually restore clean versions, and block attacking IPs through reverse detection. If you haven’t been attacked, you don’t need it—install it only after fixing an incident, then remove it. Theoretically, a WordPress site that hasn’t faced attacks is well-protected simply by hiding the login URL, limiting login attempts, and disabling user registration on the backend.

WPS Limit Login: Restricts login attempts and alerts you to frequent logins; allows manual IP blocking

This addresses security needs by detecting brute-force attacks through the login portal (repeatedly guessing usernames and passwords). Once logged in, attackers can modify user permissions via backdoors to gain admin access, then alter backend files and databases. After a set number of failed attempts, the plugin locks out the account, boosting security.

WPS Hidden Login: Hides and changes the backend login URL to prevent brute-force attacks

Since WordPress installs with a fixed default login address, it’s easily detected by bots and subjected to brute-force attacks. This plugin lets you change the login URL, masking the real endpoint and reducing attack risk.

Generally, these two plugins together satisfy basic security requirements.

WPJAM BASIC: Integrates optimization for WordPress load performance and proactive SEO submission

A popular Chinese developer’s bundled plugin; the free version is sufficient for most. Its main uses are submitting your site to Baidu for indexing and enabling caching acceleration. Most users don’t heavily rely on media files, so CDN acceleration and cloud storage are unnecessary—your server resources will suffice. Simply enable caching via this plugin (requires Memcached support, which most servers provide).

Copy the object-cache.php file from the wpjam-basic/template/ directory into your wp-content folder. If you’re running multiple sites, add this line to each site’s wp-config.php file (using distinct identifiers like ‘site1’, ‘site2’ prevents database confusion across sites):

define('WP_CACHE_KEY_SALT', 'site1');

define('WP_CACHE_KEY_SALT', 'site2');

Quick Adsense: Ad management plugin; currently displays Google and Baidu ads randomly—very sparse, almost unnoticeable

A straightforward ad plugin: paste your ad code, and it rotates randomly. The goal is minimal but non-zero visibility. Most themes now include built-in ad slots, but since mine doesn’t, I found this plugin.

Nofollow for External Links: Adds nofollow tags to outbound links (excluding blogroll) to improve SEO

Traffic still matters for this site. A crucial SEO principle is minimizing outbound link dilution—pointing visitors away from your own domain weakens your site’s authority. By adding nofollow tags to external links, you signal to search engines not to pass ranking credit elsewhere. This is especially important for blogs that frequently include “read more” links pointing outward. The plugin is simple: enable the single option (“Add nofollow to all external links”), then whitelist any pages where outbound linking is acceptable (and save).

I’m sharing this as a reference for anyone building a personal WordPress blog—and as a personal checklist in case I need to rebuild later.

Also, back up your site weekly. No plugin required—just download your WordPress files and database directly to your local machine to avoid losing everything if the database is corrupted. (I usually handle backups while writing posts.)

If you’re also building a site, you might find this useful: Comprehensive Website SEO Query Tool.

If you’re planning paid content or membership tiers, consider this theme solution: Build Your Own Knowledge-Monetization Platform (Create Your Own Online Course Site).